Analysis

  • max time kernel
    300s
  • max time network
    298s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    10-06-2024 05:05

General

  • Target

    090532b208fb20c51b1c91360695c6aeca601aa1a3dc47f187e4fa2838110f74.exe

  • Size

    2.8MB

  • MD5

    f025f61f0c76f8227e2b56de5ddc6837

  • SHA1

    3c8c822cb4fabe36e7c54fc9c7861c6ffe575eb7

  • SHA256

    090532b208fb20c51b1c91360695c6aeca601aa1a3dc47f187e4fa2838110f74

  • SHA512

    094440d46f610bc270f45b12db1102f0d269d07bc5c40d325c6a47f2a7d8d688a58fcf98a60e566212566c81eccef04ea3175a9d14247ba89b9107de4d4fc44d

  • SSDEEP

    49152:7DS75yoBrPKmWbZDbVdc44G9QynnC2rFChfomljUoOdvOxBzzB:7/rXbZnTjOqCGFChomljUogYnB

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 1 IoCs
  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\090532b208fb20c51b1c91360695c6aeca601aa1a3dc47f187e4fa2838110f74.exe
    "C:\Users\Admin\AppData\Local\Temp\090532b208fb20c51b1c91360695c6aeca601aa1a3dc47f187e4fa2838110f74.exe"
    1⤵
    • Modifies firewall policy service
    • Drops file in System32 directory
    PID:3336
  • \??\c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
    1⤵
      PID:2684
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
      1⤵
        PID:4300

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/3336-1-0x00007FF7F2C90000-0x00007FF7F3314000-memory.dmp

        Filesize

        6.5MB