privateloader | bcb4e53a2c2a50dc8d6f689955b5bda3ad7c9888ba96d0ca3a39df9038be2e8f

Analysis

max time kernel
120s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 10:16

Target
bcb4e53a2c2a50dc8d6f689955b5bda3ad7c9888ba96d0ca3a39df9038be2e8f.exe
Size 13.0MB
Sample240512-ma925aba5z
SHA256 bcb4e53a2c2a50dc8d6f689955b5bda3ad7c9888ba96d0ca3a39df9038be2e8f
MD5 29b8beb205ab003a922ace600827a125
SHA1 b96dd047c38b6f9d18cf4e473826f3983d56eed9
SHA512 381998181ba149efb3902b3cb855a68ae4fc872fbf4eff9cea263008479a4e83f931655f0dbde614d2f38dc52841aa00bd0899defb755ff49d7a13e348c5f73f
SSDEEP 196608:r98wjVX9Gqne0CbHN0pFAHqoyXc9BDal:r98wL7e0CbHN8eH4c9s
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader

Loads dropped DLL 1 IoCs

pid	Process
1140	bcb4e53a2c2a50dc8d6f689955b5bda3ad7c9888ba96d0ca3a39df9038be2e8f.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3180	1140	WerFault.exe	80

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1140	bcb4e53a2c2a50dc8d6f689955b5bda3ad7c9888ba96d0ca3a39df9038be2e8f.exe
1140	bcb4e53a2c2a50dc8d6f689955b5bda3ad7c9888ba96d0ca3a39df9038be2e8f.exe
1140	bcb4e53a2c2a50dc8d6f689955b5bda3ad7c9888ba96d0ca3a39df9038be2e8f.exe
1140	bcb4e53a2c2a50dc8d6f689955b5bda3ad7c9888ba96d0ca3a39df9038be2e8f.exe
1140	bcb4e53a2c2a50dc8d6f689955b5bda3ad7c9888ba96d0ca3a39df9038be2e8f.exe

C:\Users\Admin\AppData\Local\Temp\bcb4e53a2c2a50dc8d6f689955b5bda3ad7c9888ba96d0ca3a39df9038be2e8f.exe
"C:\Users\Admin\AppData\Local\Temp\bcb4e53a2c2a50dc8d6f689955b5bda3ad7c9888ba96d0ca3a39df9038be2e8f.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1140
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 1376
  2⤵
  - Program crash
  PID:3180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1140 -ip 1140
1⤵
PID:5008

E2EECore.2.7.2.dll

Path C:\Users\Admin\AppData\Local\Temp\E2EECore.2.7.2.dll
Size 8.4MB
SHA256 982a177924762f270b36fe34c7d6847392b48ae53151dc2011078dceef487a53
MD5 8b6c94bbdbfb213e94a5dcb4fac28ce3
SHA1 b56102ca4f03556f387f8b30e2b404efabe0cb65
SHA512 9d6d63b5d8cf7a978d7e91126d7a343c2f7acd00022da9d692f63e50835fdd84a59a93328564f10622f2b1f6adfd7febdd98b8ddb294d0754ed45cc9c165d25a
SSDEEP 98304:z0PpiCcXz5iqFaFxZkyE2kCeQ+LDSBRAN9ijNnQobT9wdxd+tNrspBAUZLh7ZV/T:QyDBaFxZNb+LwRAN9w1X9wdxrpV9/J
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1140-0-0x0000000000400000-0x0000000001193000-memory.dmp

Download