Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
11/05/2024, 04:18
General
- Target e3bbbb861502fda0d9204a2f7a88568a48ae7eda3ca71a3f24766b1619c63170.exe
- Size 14.2MB
- Sample240511-ew8gesch3w
- SHA256 e3bbbb861502fda0d9204a2f7a88568a48ae7eda3ca71a3f24766b1619c63170
Malware Config
Signatures
- PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 5 IoCs
- Suspicious behavior: EnumeratesProcesses 48 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3bbbb861502fda0d9204a2f7a88568a48ae7eda3ca71a3f24766b1619c63170.exe"C:\Users\Admin\AppData\Local\Temp\e3bbbb861502fda0d9204a2f7a88568a48ae7eda3ca71a3f24766b1619c63170.exe"1⤵
- Checks whether UAC is enabled
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2116-0-0x00007FFC9B283000-0x00007FFC9B285000-memory.dmp
memory/2116-1-0x000001BE2A790000-0x000001BE2B5BE000-memory.dmp
memory/2116-2-0x00007FFC9B280000-0x00007FFC9BD41000-memory.dmp
memory/2116-3-0x000001BE45A60000-0x000001BE45B3C000-memory.dmp
memory/2116-4-0x000001BE45B40000-0x000001BE45BE8000-memory.dmp
memory/2116-5-0x000001BE2B980000-0x000001BE2B98C000-memory.dmp
memory/2116-6-0x000001BE2D330000-0x000001BE2D35A000-memory.dmp
memory/2116-7-0x000001BE2B990000-0x000001BE2B9A6000-memory.dmp
memory/2116-8-0x000001BE2D360000-0x000001BE2D38C000-memory.dmp
memory/2116-9-0x000001BE47420000-0x000001BE474D0000-memory.dmp
memory/2116-10-0x000001BE474D0000-0x000001BE47572000-memory.dmp
memory/2116-11-0x000001BE47570000-0x000001BE475A2000-memory.dmp
memory/2116-12-0x000001BE2BA30000-0x000001BE2BA38000-memory.dmp
memory/2116-13-0x000001BE2BA60000-0x000001BE2BA72000-memory.dmp
memory/2116-14-0x000001BE475E0000-0x000001BE47690000-memory.dmp
memory/2116-15-0x000001BE47690000-0x000001BE476B4000-memory.dmp
memory/2116-16-0x000001BE47720000-0x000001BE477B2000-memory.dmp
memory/2116-17-0x000001BE478C0000-0x000001BE478D6000-memory.dmp
memory/2116-21-0x000001BE47940000-0x000001BE47948000-memory.dmp
memory/2116-20-0x000001BE47920000-0x000001BE47928000-memory.dmp
memory/2116-19-0x000001BE47960000-0x000001BE4796A000-memory.dmp
memory/2116-18-0x000001BE47900000-0x000001BE4790A000-memory.dmp
memory/2116-22-0x000001BE478B0000-0x000001BE478BA000-memory.dmp
memory/2116-23-0x000001BE478D0000-0x000001BE478DA000-memory.dmp
memory/2116-24-0x000001BE48360000-0x000001BE48888000-memory.dmp
memory/2116-25-0x000001BE488C0000-0x000001BE488E2000-memory.dmp
memory/2116-26-0x000001BE47E40000-0x000001BE47E48000-memory.dmp
memory/2116-27-0x000001BE48340000-0x000001BE48348000-memory.dmp
memory/2116-28-0x000001BE488A0000-0x000001BE488A8000-memory.dmp
memory/2116-29-0x00007FFC9B280000-0x00007FFC9BD41000-memory.dmp
memory/2116-31-0x000001BE49B60000-0x000001BE49B6E000-memory.dmp
memory/2116-30-0x000001BE4BCB0000-0x000001BE4BCE8000-memory.dmp
memory/2116-33-0x000001BE4C540000-0x000001BE4C55C000-memory.dmp
memory/2116-32-0x00007FFC9B280000-0x00007FFC9BD41000-memory.dmp
memory/2116-34-0x00007FFC9B280000-0x00007FFC9BD41000-memory.dmp
memory/2116-35-0x00007FFC9B280000-0x00007FFC9BD41000-memory.dmp
memory/2116-36-0x00007FFC9B283000-0x00007FFC9B285000-memory.dmp
memory/2116-37-0x00007FFC9B280000-0x00007FFC9BD41000-memory.dmp
memory/2116-38-0x00007FFC9B280000-0x00007FFC9BD41000-memory.dmp
memory/2116-39-0x00007FFC9B280000-0x00007FFC9BD41000-memory.dmp