Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
-
submitted
06-06-2024 09:22
General
-
Target
9ed5bbcdc3ba7bd86c534424f7a5c8f80bac6618b7b79cd8caad7060272e107f.exe
-
Size
3.3MB
-
MD5
30747903174aaf785850d4c0a306dd1f
-
SHA1
6312833fd6b72358334d21ad2ce689ca3defb0c6
-
SHA256
9ed5bbcdc3ba7bd86c534424f7a5c8f80bac6618b7b79cd8caad7060272e107f
-
SHA512
74ed2e8188f60b9ec6d087f6e10b5b5cb79b8abeb625bd8f574c7d6f604ea888d487f893d1f89a53970e496de1d3dbefdc886132de02c7c1bd5d9e0a7132ec21
-
SSDEEP
49152:v0JkLMjIxOE3cqFjTdiqH7ZQiIK4ePyS5wfm26hEbH4BMEt96kSOIsk3G8pxxuln:cxw3/tT5H7ZNIK4YLS0BLz6kyLWOPOP
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 1 IoCs
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ed5bbcdc3ba7bd86c534424f7a5c8f80bac6618b7b79cd8caad7060272e107f.exe"C:\Users\Admin\AppData\Local\Temp\9ed5bbcdc3ba7bd86c534424f7a5c8f80bac6618b7b79cd8caad7060272e107f.exe"1⤵
- Modifies firewall policy service
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
6.7MB
-
Filesize
1.5MB