Analysis
-
max time kernel
10s -
max time network
48s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
14-03-2024 08:29
General
-
Target
file.exe
-
Size
5.6MB
-
MD5
d08e21ef739bcb9d74508790a6e6238f
-
SHA1
74576503141f26edab05ce2da89b66cb3bcf293b
-
SHA256
42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d
-
SHA512
6ea1cd13b0bda1b69d0af26f073e2eb1eb2722b83a39c4b53148528fb88e09133ef7d095dc6617c5571e4a5248e0162f68afe13a4b1daa522797912a69b5dbee
-
SSDEEP
98304:eImo/NRpwP2DkKA+Ga5q73V41AmcR1Miq465iU7Fem+KOd8PbXLgKiOvG6ZB6Q3H:Xm0Rouq61i1U5Um+J+jkjEG6Zw
Score
10/10
Malware Config
Extracted
Family
privateloader
C2
45.15.156.229
195.20.16.45
77.105.147.130
Signatures
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
-
Drops file in System32 directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
9.9MB