privateloader | 4d3341852934062b81cc8c0f6c3b1b0c76594998b1ef74a31caf79382790c1eb

Analysis

max time kernel
125s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 08:39

Target
2e448c667bcf8ad88fe4348710d16538_JaffaCakes118.exe
Size 16.9MB
Sample240510-kkpstsgd63
SHA256 4d3341852934062b81cc8c0f6c3b1b0c76594998b1ef74a31caf79382790c1eb
MD5 2e448c667bcf8ad88fe4348710d16538
SHA1 8064fbca3b789366511fb3c87a9582e43b349e88
SHA512 e24360da0a24d0ef56d67a1601d1909e925e2b9c519be08fecf535db3ea14ecd8441596991f02b953858d6c2525fa900ed34f9bd44bac308212346101cf584d4
SSDEEP 393216:K8xSu0uH36+PrS4jCJ3VZrueimktEN/2ZMxf7pcZ3vTYk7+uwAIAEK6:KCSFuXdrSWCJ33r0mktk7AH7+dAIpK6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader

Executes dropped EXE 1 IoCs

pid	Process
4672	2e448c667bcf8ad88fe4348710d16538_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 4672	2668	2e448c667bcf8ad88fe4348710d16538_JaffaCakes118.exe	91
PID 2668 wrote to memory of 4672	2668	2e448c667bcf8ad88fe4348710d16538_JaffaCakes118.exe	91
PID 2668 wrote to memory of 4672	2668	2e448c667bcf8ad88fe4348710d16538_JaffaCakes118.exe	91

C:\Users\Admin\AppData\Local\Temp\2e448c667bcf8ad88fe4348710d16538_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2e448c667bcf8ad88fe4348710d16538_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Users\Admin\AppData\Local\Temp\{3B15E32B-A8F1-46CE-A3AC-ECF1464390D2}\2e448c667bcf8ad88fe4348710d16538_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\{3B15E32B-A8F1-46CE-A3AC-ECF1464390D2}\2e448c667bcf8ad88fe4348710d16538_JaffaCakes118.exe /q"C:\Users\Admin\AppData\Local\Temp\2e448c667bcf8ad88fe4348710d16538_JaffaCakes118.exe" /tempdisk1folder"C:\Users\Admin\AppData\Local\Temp\{3B15E32B-A8F1-46CE-A3AC-ECF1464390D2}" /IS_temp
  2⤵
  - Executes dropped EXE
  PID:4672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3980,i,13281073920029625837,8253721632651544158,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
1⤵
PID:4416

0x0411.ini

Path C:\Users\Admin\AppData\Local\Temp\{3B15E32B-A8F1-46CE-A3AC-ECF1464390D2}\0x0411.ini
Size 14KB
SHA256 01b8625a29db41e0a190c0634ef3ee4f0878d2b56c92a407018b97bdf4ed7e7d
MD5 76d722f8c2ba980e0f1ed27d09bb0da9
SHA1 313c885aa60959817b1cd9923d6ea0a780cf540f
SHA512 e60d12477299892a93c596757c435f58b1818fd0b3cf154c822cd6f96249610cad7eb7e7f63fca563b401eab1296b4a7831377fb32c9437a3a506405e1b8a5f5
SSDEEP 384:DKeEbO3nlKWDUK21OxgCvk3aV4ls8Gb8YVyl:DKtbO3lKWoK21OxgCl7Fyl
MD5 SHA1 SHA512 SSDEEP

Submit Download

2e448c667bcf8ad88fe4348710d16538_JaffaCakes118.exe

Path C:\Users\Admin\AppData\Local\Temp\{3B15E32B-A8F1-46CE-A3AC-ECF1464390D2}\2e448c667bcf8ad88fe4348710d16538_JaffaCakes118.exe
Size 16.9MB
SHA256 4d3341852934062b81cc8c0f6c3b1b0c76594998b1ef74a31caf79382790c1eb
MD5 2e448c667bcf8ad88fe4348710d16538
SHA1 8064fbca3b789366511fb3c87a9582e43b349e88
SHA512 e24360da0a24d0ef56d67a1601d1909e925e2b9c519be08fecf535db3ea14ecd8441596991f02b953858d6c2525fa900ed34f9bd44bac308212346101cf584d4
SSDEEP 393216:K8xSu0uH36+PrS4jCJ3VZrueimktEN/2ZMxf7pcZ3vTYk7+uwAIAEK6:KCSFuXdrSWCJ33r0mktk7AH7+dAIpK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ISMSIDEL.INI

Path C:\Users\Admin\AppData\Local\Temp\{3B15E32B-A8F1-46CE-A3AC-ECF1464390D2}\_ISMSIDEL.INI
Size 948B
SHA256 1422474bc3edd78ffc24c682e441674197f55cfe3da0af0c7b76f1e905faa382
MD5 4f5fa1a0a56656296d66c8bbd9e60a03
SHA1 e64a035924d52ecc9b127c8ca2f149e396f048c6
SHA512 6afaf1a38ce87c36ca53e8155ec91718fb483e6e5075b541bdab1cdf5060d6eaf7f5b84314b399f8a1178b9757ea762c25a2d2e38677c337448ef3a02ab9a1a7
MD5 SHA1 SHA512

Submit Download

~E36D.tmp

Path C:\Users\Admin\AppData\Local\Temp\~E36D.tmp
Size 5KB
SHA256 48bc610ceb7407469ed19e7a90cc9739856000e71183ed9cabde7ca798766606
MD5 8fa3208d5b60ec974c2ddb2781842837
SHA1 711a3b383d096261edd8be9c1fd19ea2458b356f
SHA512 e806bd270eba89de21b5f30f07fb49b9c1e2a3f9f88b43ac8a7d9650fee52f44376221d222ad0d339b18a38924fb9c05f3bf0ee741e1d3af376bbf24c9dfcf53
SSDEEP 96:rEhkMZEMvO08KnEONPXsEbFWaEPRhS+gWPQPgWRGTwQbPrvnp6kY05w7tCYOvlnn:YhrFOq3cuQaEZhdxoIWRGcQbPr/p005x
MD5 SHA1 SHA512 SSDEEP

Submit Download