Overview

overview

10

Static

static

1

b42b24d054...18.exe

windows7-x64

10

b42b24d054...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    112s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-05-2024 10:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b42b24d0549e201cf0727f1edeaacbebfed2eeec6af9eff6bdea4bf4ab0a1918.exe

  • Size

    8.3MB

  • MD5

    e99605f8de15e4ac43c1ac5c56c2b783

  • SHA1

    5399b6e0623ce3f4e979014ce2fc072896bb6e56

  • SHA256

    b42b24d0549e201cf0727f1edeaacbebfed2eeec6af9eff6bdea4bf4ab0a1918

  • SHA512

    83c2085df6d7434e0fadda727bf16fd55daaff1a3ab14960d5086d9e8e6e19c7ca2127fe9feb917ae5c68584462c18bbb7ac345a4f3ee521b6cd9a9274ba4c25

  • SSDEEP

    98304:J+UnFjkb2q0JaPq+KVWIqZe5rCph13dYFCd3D1JZIfNMWsYzo1ZHuOWq+fu+s7GP:XC1pSWpZeBCph1oCdiG0zGMOWq+WDSP

Score
10/10
privateloaderevasionloader

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 1 IoCs
    evasion
  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b42b24d0549e201cf0727f1edeaacbebfed2eeec6af9eff6bdea4bf4ab0a1918.exe
    "C:\Users\Admin\AppData\Local\Temp\b42b24d0549e201cf0727f1edeaacbebfed2eeec6af9eff6bdea4bf4ab0a1918.exe"
    1⤵
    • Modifies firewall policy service
    • Drops file in System32 directory
    PID:2288
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
    1⤵
      PID:4620
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
      1⤵
        PID:64

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2288-2-0x00007FF7CC010000-0x00007FF7CCF30000-memory.dmp

        Filesize

        15.1MB

        Download