Analysis

  • max time kernel
    141s
  • max time network
    103s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-05-2024 02:07

General

  • Target

    node.exe

  • Size

    6.6MB

  • MD5

    5f40521d2e1082fe1c734610c4a83911

  • SHA1

    86d54874cc8976cdb75a9dc8dcd817af50837796

  • SHA256

    79ac7ae94231a392d27f303418e305a60c4194dbbe143c5deffc977c7b2e7a78

  • SHA512

    ef2b54b46844cfb13cfdef6271e2a8b4e646d2e31ca55229e5c76ca90c649895533bc8fb83c4d50dd3721abb2a5e4c5ee32df5c4540e1c14498a5e9b550d3189

  • SSDEEP

    196608:QLqzi3tI29TS60FIEPgaJzR1VOoaOVxRtx:QLqzi3XT0uEp/ooaWzx

Malware Config

Signatures

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • UPX dump on OEP (original entry point) 3 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

Processes

  • C:\Users\Admin\AppData\Local\Temp\node.exe
    "C:\Users\Admin\AppData\Local\Temp\node.exe"
    1⤵
      PID:2840

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2840-0-0x0000000000400000-0x0000000001F1A000-memory.dmp

      Filesize

      27.1MB

    • memory/2840-1-0x0000000000400000-0x0000000001F1A000-memory.dmp

      Filesize

      27.1MB

    • memory/2840-2-0x0000000000400000-0x0000000001F1A000-memory.dmp

      Filesize

      27.1MB