privateloader | 090532b208fb20c51b1c91360695c6aeca601aa1a3dc47f187e4fa2838110f74

Analysis

max time kernel
120s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08-06-2024 14:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

090532b208fb20c51b1c91360695c6aeca601aa1a3dc47f187e4fa2838110f74.exe
Size

2.8MB
MD5

f025f61f0c76f8227e2b56de5ddc6837
SHA1

3c8c822cb4fabe36e7c54fc9c7861c6ffe575eb7
SHA256

090532b208fb20c51b1c91360695c6aeca601aa1a3dc47f187e4fa2838110f74
SHA512

094440d46f610bc270f45b12db1102f0d269d07bc5c40d325c6a47f2a7d8d688a58fcf98a60e566212566c81eccef04ea3175a9d14247ba89b9107de4d4fc44d
SSDEEP

49152:7DS75yoBrPKmWbZDbVdc44G9QynnC2rFChfomljUoOdvOxBzzB:7/rXbZnTjOqCGFChomljUogYnB

Score

10^/10

privateloader evasion loader

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1"	090532b208fb20c51b1c91360695c6aeca601aa1a3dc47f187e4fa2838110f74.exe

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	api.myip.com
6	api.myip.com
12	ipinfo.io
13	ipinfo.io

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	090532b208fb20c51b1c91360695c6aeca601aa1a3dc47f187e4fa2838110f74.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	090532b208fb20c51b1c91360695c6aeca601aa1a3dc47f187e4fa2838110f74.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	090532b208fb20c51b1c91360695c6aeca601aa1a3dc47f187e4fa2838110f74.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	090532b208fb20c51b1c91360695c6aeca601aa1a3dc47f187e4fa2838110f74.exe

C:\Users\Admin\AppData\Local\Temp\090532b208fb20c51b1c91360695c6aeca601aa1a3dc47f187e4fa2838110f74.exe
"C:\Users\Admin\AppData\Local\Temp\090532b208fb20c51b1c91360695c6aeca601aa1a3dc47f187e4fa2838110f74.exe"
1⤵
- Modifies firewall policy service
- Drops file in System32 directory
PID:5104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5104-0-0x00007FF700040000-0x00007FF7006C4000-memory.dmp

Filesize
6.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads