Analysis
-
max time kernel
141s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
02-05-2024 02:07
Behavioral task
behavioral1
Sample
c9daca7de1b623867aee943a1d508573841f2584ffa91aaaf09de2a883d2733f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c9daca7de1b623867aee943a1d508573841f2584ffa91aaaf09de2a883d2733f.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
cleaner.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
cleaner.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
node.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
node.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral7
Sample
service.js
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
service.js
Resource
win10v2004-20240419-en
General
-
Target
node.exe
-
Size
6.6MB
-
MD5
5f40521d2e1082fe1c734610c4a83911
-
SHA1
86d54874cc8976cdb75a9dc8dcd817af50837796
-
SHA256
79ac7ae94231a392d27f303418e305a60c4194dbbe143c5deffc977c7b2e7a78
-
SHA512
ef2b54b46844cfb13cfdef6271e2a8b4e646d2e31ca55229e5c76ca90c649895533bc8fb83c4d50dd3721abb2a5e4c5ee32df5c4540e1c14498a5e9b550d3189
-
SSDEEP
196608:QLqzi3tI29TS60FIEPgaJzR1VOoaOVxRtx:QLqzi3XT0uEp/ooaWzx
Malware Config
Signatures
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
UPX dump on OEP (original entry point) 3 IoCs
resource yara_rule behavioral6/memory/2840-0-0x0000000000400000-0x0000000001F1A000-memory.dmp UPX behavioral6/memory/2840-1-0x0000000000400000-0x0000000001F1A000-memory.dmp UPX behavioral6/memory/2840-2-0x0000000000400000-0x0000000001F1A000-memory.dmp UPX -
resource yara_rule behavioral6/memory/2840-0-0x0000000000400000-0x0000000001F1A000-memory.dmp upx behavioral6/memory/2840-1-0x0000000000400000-0x0000000001F1A000-memory.dmp upx behavioral6/memory/2840-2-0x0000000000400000-0x0000000001F1A000-memory.dmp upx