Behavioral task
behavioral1
Sample
5cee7776c29a4dd090c9934b60603e13.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5cee7776c29a4dd090c9934b60603e13.exe
Resource
win10v2004-20231215-en
General
-
Target
5cee7776c29a4dd090c9934b60603e13
-
Size
1.0MB
-
MD5
5cee7776c29a4dd090c9934b60603e13
-
SHA1
852a13264f49f562f7eb4ca58fc44ae36635089e
-
SHA256
2be92d7d191fc4c3499bc51ccf9a2c438233cfcde7fbe7b3557ae77892ac5508
-
SHA512
5b480f8c401cda61580ba58b7e3db452a7e77e0dfa70d8779eb644c757c306262c808e8d2de276288fca00662918ebc0752f3c07809828b4b32dc7a97d32269c
-
SSDEEP
12288:00lRfZEyufdBGp4MAuVE9RtyncxQRhJJzhoqgH5sB4dxHG64:0ExZoGp/ARhQRh9B4d3
Malware Config
Extracted
privateloader
http://37.0.10.214/proxies.txt
http://37.0.10.244/server.txt
http://wfsdragon.ru/api/setStats.php
37.0.10.237
Signatures
-
Privateloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5cee7776c29a4dd090c9934b60603e13
Files
-
5cee7776c29a4dd090c9934b60603e13.exe windows:6 windows x86 arch:x86
93fd4ae8d78e56fe707a53a5a49cf9e3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetPriorityClass
GetCurrentProcess
lstrcatA
GetModuleHandleA
SetCurrentDirectoryA
GetModuleHandleExA
lstrcpyA
GetProcAddress
GetLastError
HeapFree
lstrlenA
lstrcpynA
GetProcessHeap
WriteConsoleW
QueryPerformanceCounter
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
CloseHandle
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
TerminateProcess
RaiseException
RtlUnwind
FreeLibrary
LoadLibraryExW
EncodePointer
ReadFile
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
WriteFile
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetFileType
HeapAlloc
LCMapStringW
GetConsoleOutputCP
GetFileSizeEx
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetStringTypeW
CreateFileW
FlushFileBuffers
HeapSize
HeapReAlloc
SetEndOfFile
DecodePointer
Sections
.text Size: 161KB - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 822KB - Virtual size: 821KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ