privateloader | 3d14e6c72351cf538fd93936575e24b19099814399d8122e89d6d1eb4b9ec6c8

General

Target
3d14e6c72351cf538fd93936575e24b19099814399d8122e89d6d1eb4b9ec6c8.exe
Size 13.4MB
Sample240511-crbwjsae23
SHA256 3d14e6c72351cf538fd93936575e24b19099814399d8122e89d6d1eb4b9ec6c8
MD5 f27996693b143cffdd7f292447d08c72
SHA1 abb3a3e356be57c93e13b9a968a00796eefd4f85
SHA512 dec063a264ead20b46afd83ebebff9432d195e35ec80d71ed7111a8867ecbfced3ca4f8acb12fb105857ddc5dc5c8719f7a976d37f58417ab5beb0530907efa1
SSDEEP 393216:I+sJZ8dis2trRxQ75JbYBZgyAKnwRAd1duF:I+sv812h0iBmyWAd1Q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

privateloader bootkit loader persistence

Malware Config

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader

Executes dropped EXE 2 IoCs

pid	Process
3844	join.me.exe
5100	LMIGuardianSvc.exe

Loads dropped DLL 4 IoCs

pid	Process
3844	join.me.exe
3844	join.me.exe
3844	join.me.exe
5100	LMIGuardianSvc.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	join.me.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	join.me.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	join.me.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	join.me.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	join.me.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	join.me.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3844	join.me.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3844	join.me.exe
3844	join.me.exe
3844	join.me.exe
3844	join.me.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3844	join.me.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	3844	join.me.exe
Token: SeCreateGlobalPrivilege	3844	join.me.exe
Token: SeCreateGlobalPrivilege	5100	LMIGuardianSvc.exe
Token: SeCreateGlobalPrivilege	5100	LMIGuardianSvc.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3844	join.me.exe
3844	join.me.exe
3844	join.me.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 3844	748	3d14e6c72351cf538fd93936575e24b19099814399d8122e89d6d1eb4b9ec6c8.exe	86
PID 748 wrote to memory of 3844	748	3d14e6c72351cf538fd93936575e24b19099814399d8122e89d6d1eb4b9ec6c8.exe	86
PID 748 wrote to memory of 3844	748	3d14e6c72351cf538fd93936575e24b19099814399d8122e89d6d1eb4b9ec6c8.exe	86
PID 3844 wrote to memory of 5100	3844	join.me.exe	89
PID 3844 wrote to memory of 5100	3844	join.me.exe	89
PID 3844 wrote to memory of 5100	3844	join.me.exe	89

C:\Users\Admin\AppData\Local\Temp\3d14e6c72351cf538fd93936575e24b19099814399d8122e89d6d1eb4b9ec6c8.exe
"C:\Users\Admin\AppData\Local\Temp\3d14e6c72351cf538fd93936575e24b19099814399d8122e89d6d1eb4b9ec6c8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:748
- C:\Users\Admin\AppData\Local\Temp\joi4834.tmp\join.me.exe
  "C:\Users\Admin\AppData\Local\Temp\joi4834.tmp\join.me.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Checks processor information in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\Users\Admin\AppData\Local\Temp\joi4834.tmp\LMIGuardianSvc.exe
    C:\Users\Admin\AppData\Local\Temp\joi4834.tmp\LMIGuardianSvc /escort 3844 /CUSTOM JoinMe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:5100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LMIGuardianDll.dll

Path C:\Users\Admin\AppData\Local\Temp\joi4834.tmp\LMIGuardianDll.dll
Size 1.5MB
SHA256 7b42d7bc6b0dd37806dde0975ecf1bc0cc7b1696a02c8c1c47950340986057d9
MD5 2461d2a50bdea2dee979abc6ad71f17a
SHA1 059da48f68a970c0b5b6a1872385086fe753e73b
SHA512 4ef270ccf9348bb25fb553a60b8347d8538e201073e9979db2caea1d6970383f6f364c387ea7a2d645d079c559bd672d3330e5e98c75b9be9410b290b20a3fa7
SSDEEP 24576:6AvaizjOcVDw7koCXmiolwTrjGFad6+ZvE:5nXmblwT3GFad6kE
MD5 SHA1 SHA512 SSDEEP

Submit Download

LMIGuardianSvc.exe

Path C:\Users\Admin\AppData\Local\Temp\joi4834.tmp\LMIGuardianSvc.exe
Size 402KB
SHA256 ab3a9b3f93343a79fcbfa876f059498b4bc66611e5410c622b6c57adc690ed00
MD5 beac1abbe5e58ed3beffce79ef31c533
SHA1 7042f47c9da9c0ce66a87d501a7cf90033e717b7
SHA512 335ed00ff28cd501ef4a75e6b886370b16565dff60e48e4f747394ab751d2cc5b1506fcb9b0dec00c72c75abda12396e0e80095a4b80e0759f9fa1c5e6a20098
SSDEEP 3072:5TZobIcCzW+7KD5jmXYbXurcxA84/LFtXCJ4e3xw:56bGWTs/Btypw
MD5 SHA1 SHA512 SSDEEP

Submit Download

MediaClientLib.dll

Path C:\Users\Admin\AppData\Local\Temp\joi4834.tmp\MediaClientLib.dll
Size 5.0MB
SHA256 51c2d71d086742f6b6debe4b31bf9f47809ead66e85578d1cac76ac97a98907e
MD5 b1e2d90b42a416d37d6961abd3fd289e
SHA1 6d40f9dc6b4f9a70c76d22345542d4994d49ff37
SHA512 9d701cf217dc2c1c598826fc65f94a7af49d5a9b533eff90d95204c2acd0d23e66b1131165596e68d8f078d39b318b65fb5596dd4375abb13cc45699171d9680
SSDEEP 98304:wkGjWyHb8zER5XTG+24IU4u0ll38zgbn3fZx576LUC+ozPO:xGjN78zE8F38zgbn3t7Mo
MD5 SHA1 SHA512 SSDEEP

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\Temp\joi4834.tmp\config.json
Size 389B
SHA256 426d021cc2667e163c712dc2cc8e4a07c4200eec816979adc64b49a8525bfda5
MD5 ad1759146c1a0ab239abbd7f3e94f895
SHA1 c7c88d1fa5fac5aa6fc592cb26fbe196858c93fd
SHA512 10dc6fc877938bb9989765c5dc29a34f649976fee20873d542742fc0aa2d9262090f439a5c7ee49f29989c655313208a33ef846d0a3c23a97fa8e4a6d90e6496
MD5 SHA1 SHA512

Submit Download

jmlaunchermgr.dll

Path C:\Users\Admin\AppData\Local\Temp\joi4834.tmp\jmlaunchermgr.dll
Size 301KB
SHA256 8259daca1508472bd26bbc5359c46bf2cf846c0caffe3c8c5760086ee043aa5a
MD5 751e29de7814bf16287044fb94018cc5
SHA1 b1c06f846028fb3e53cc9ca0cc1295f850954759
SHA512 8174393492537a1cbdc2d398c5ad7a459749974fd937382844b5f893ee55ae8a1b94c335be7320489277fd6655c893b6fdf4ed49a2448342e84c6491a82a1937
SSDEEP 3072:77vtUaLG6dP0qKQKn9XWUzkCQa5apsuXUaJijgH3tadoDPzPmrRd4u4+z822w1KP:771c6dRtXa5anEaJijAtadaPmKynKJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jmsettings.dll

Path C:\Users\Admin\AppData\Local\Temp\joi4834.tmp\jmsettings.dll
Size 182KB
SHA256 9f5131643a9b48f249dd0f9da1420ab9854813129dfeb65bd99150678bb1c2af
MD5 a3eb21ddc13d102af81fe9a710719758
SHA1 13c487af7d3919ced1e6f04cdea875702d74f2bd
SHA512 4c1102a71ee52876c5118be71be41192ecd27247f56a6cbf510c49844076bc5c95afad89d4ec4b5f24448692632f7cfb8abedb8428e0924c39258409a39004b4
SSDEEP 3072:L61FUk7q7Ed9gxAfVR7Rj/vqrUSkj+bcRugSwO:LcFUREDMcV77qrayQutw
MD5 SHA1 SHA512 SSDEEP

Submit Download

join.me.exe

Path C:\Users\Admin\AppData\Local\Temp\joi4834.tmp\join.me.exe
Size 31.0MB
SHA256 0fc26e04d9e3a85648fe7a0d9f214fc1d41d84d3d6cf9877a1e2190b2d71795f
MD5 f714b71e62f4b27379f8b36864920d24
SHA1 6a8c3519a058510281cff7722729e11c41513b07
SHA512 01f784c8a1607dc031daea2699cc79c355f4233c73ff7addf7f632ef0d684732a23d76d5ec9cc79feedc3df3d521d2576000596cedaff4f7737eaddaa1b652d4
SSDEEP 393216:pZV0uCvEOBnRUCSKvQzvsAbMvMaQ8eh0KrEJsv6tWKFdu9CnN:pZ2tJFRUCNAYe7+N
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads