Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
10/05/2024, 12:24
General
-
Target
be4fd58d0f1f2c09fcae3dbd62455e9cf0f64ecd1a9b146d8cdf62fc599e2d8e.exe
-
Size
20.7MB
-
MD5
f9ef9ef748c14a0ee658e1c5e8976d9a
-
SHA1
04e4f14d802cdd8c959b4ca6985f23c200aa9c27
-
SHA256
be4fd58d0f1f2c09fcae3dbd62455e9cf0f64ecd1a9b146d8cdf62fc599e2d8e
-
SHA512
994234e7d3f418f956d4d0ff893002aeba0872b72494a655e4d1afd144c1ba01668292ae511ce51286943d61210c0aa51125bc1baa3a2e0bc139b8e47629b988
-
SSDEEP
393216:MAPl3DhyMECuPsKT1ZMOfAVowjV7viWmE12OnOxrmU32n/uSaQoy0urpRvpSkhA3:TlzoMECOBYVvVjiWbYOnOxrmU32n/uSQ
Malware Config
Signatures
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\be4fd58d0f1f2c09fcae3dbd62455e9cf0f64ecd1a9b146d8cdf62fc599e2d8e.exe"C:\Users\Admin\AppData\Local\Temp\be4fd58d0f1f2c09fcae3dbd62455e9cf0f64ecd1a9b146d8cdf62fc599e2d8e.exe"1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
816KB
-
Filesize
36.0MB
-
Filesize
816KB
-
Filesize
36.0MB