Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
15-06-2024 20:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
file.rar
Resource
win7-20240611-en
privateloaderriseprosocks5systemztofseebootkitbotnetcollectiondiscoveryevasionexecutionloaderpersistencespywarestealertrojan
windows7-x64
55 signatures
150 seconds
Behavioral task
behavioral2
Sample
amdhip64.dll
Resource
win7-20240611-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
concrt140.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
msvcp140.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
res_mods/1.23.0.0/scripts/client/gui/mods/mod_a.pyc
Resource
win7-20240611-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral6
Sample
setup.exe
Resource
win7-20240508-en
windows7-x64
9 signatures
150 seconds
General
-
Target
setup.exe
-
Size
785.0MB
-
MD5
640e910d06ebab4b066a696ba0e78b55
-
SHA1
534e97d66e68eab6fa916fabe05beaef822b56e8
-
SHA256
9b5e9a1b37be8612f14d52bd6a1bfbb850a05164d677738bcf6ea41c1a1c97a6
-
SHA512
9dd5f8b06e675912e53833e4cc7a77ab06a3e25d7e23c907f351e715011c1096baaed0e8a1dd5ec56d69124988fb1bce082ee3cda3b5b70ee301fedb56b01177
-
SSDEEP
98304:rO0hNxrp27xGHwGZpRiE5ygmAfrjQxuN7:rOUnQAHwipRtw1ol
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1" setup.exe -
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol setup.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI setup.exe File opened for modification C:\Windows\System32\GroupPolicy setup.exe File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini setup.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2368 setup.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2880 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2880 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe 2880 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2368 wrote to memory of 2588 2368 setup.exe 29 PID 2368 wrote to memory of 2588 2368 setup.exe 29 PID 2368 wrote to memory of 2588 2368 setup.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Modifies firewall policy service
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2368 -s 2322⤵PID:2588
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2880