Analysis
-
max time kernel
300s -
max time network
298s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
10-06-2024 05:05
Static task
static1
Behavioral task
behavioral1
Sample
090532b208fb20c51b1c91360695c6aeca601aa1a3dc47f187e4fa2838110f74.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
090532b208fb20c51b1c91360695c6aeca601aa1a3dc47f187e4fa2838110f74.exe
Resource
win10-20240404-en
General
-
Target
090532b208fb20c51b1c91360695c6aeca601aa1a3dc47f187e4fa2838110f74.exe
-
Size
2.8MB
-
MD5
f025f61f0c76f8227e2b56de5ddc6837
-
SHA1
3c8c822cb4fabe36e7c54fc9c7861c6ffe575eb7
-
SHA256
090532b208fb20c51b1c91360695c6aeca601aa1a3dc47f187e4fa2838110f74
-
SHA512
094440d46f610bc270f45b12db1102f0d269d07bc5c40d325c6a47f2a7d8d688a58fcf98a60e566212566c81eccef04ea3175a9d14247ba89b9107de4d4fc44d
-
SSDEEP
49152:7DS75yoBrPKmWbZDbVdc44G9QynnC2rFChfomljUoOdvOxBzzB:7/rXbZnTjOqCGFChomljUogYnB
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1" 090532b208fb20c51b1c91360695c6aeca601aa1a3dc47f187e4fa2838110f74.exe -
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 api.myip.com 3 api.myip.com 5 ipinfo.io 6 ipinfo.io -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol 090532b208fb20c51b1c91360695c6aeca601aa1a3dc47f187e4fa2838110f74.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI 090532b208fb20c51b1c91360695c6aeca601aa1a3dc47f187e4fa2838110f74.exe File opened for modification C:\Windows\System32\GroupPolicy 090532b208fb20c51b1c91360695c6aeca601aa1a3dc47f187e4fa2838110f74.exe File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini 090532b208fb20c51b1c91360695c6aeca601aa1a3dc47f187e4fa2838110f74.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\090532b208fb20c51b1c91360695c6aeca601aa1a3dc47f187e4fa2838110f74.exe"C:\Users\Admin\AppData\Local\Temp\090532b208fb20c51b1c91360695c6aeca601aa1a3dc47f187e4fa2838110f74.exe"1⤵
- Modifies firewall policy service
- Drops file in System32 directory
PID:3336
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵PID:2684
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:4300