privateloader | fd7ca23ec24b74e3bf0d1d54be67e6bd97987affa40014c43ea07191318866d8

Analysis

max time kernel
124s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16-06-2024 01:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

safe-archive/setup.exe
Size

736.0MB
MD5

2807c018ea2b8da2e2324da6d4181711
SHA1

0fbb3e33a2780932dec7ce4e45995fcbd1d4c4b9
SHA256

889d47ce91b7af3bcdbda903e7fa2533e45d77e4ff09b75885a572b5204bba54
SHA512

e050b85fddb43214bd327e3646e0ba9b9e985a70fa207d22670871a7ca68349213b05a615721aaa84a6a2211a32599586ae7548160e9da4e2941778d249309af
SSDEEP

98304:tw5NofUrgQZP/tn7/ejXG3qSi3V635t5pTHF:25NofUrrJ1nsSi3V635HFF

Score

10^/10

privateloader evasion loader

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

setup.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1"	setup.exe

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader

Drops file in System32 directory 4 IoCs

Processes:

setup.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	setup.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	setup.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	setup.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	setup.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

setup.exe

pid process

1196 setup.exe
1196 setup.exe

pid	process
1196	setup.exe
1196	setup.exe

C:\Users\Admin\AppData\Local\Temp\safe-archive\setup.exe
"C:\Users\Admin\AppData\Local\Temp\safe-archive\setup.exe"
1⤵
- Modifies firewall policy service
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:1028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\GroupPolicy\gpt.ini

Filesize
127B

MD5
8ef9853d1881c5fe4d681bfb31282a01

SHA1
a05609065520e4b4e553784c566430ad9736f19f

SHA256
9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

SHA512
5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

Download Submit
memory/1196-0-0x00007FF6CD5B5000-0x00007FF6CD76B000-memory.dmp

Filesize
1.7MB

Download
memory/1196-5-0x00007FFA12210000-0x00007FFA12212000-memory.dmp

Filesize
8KB

Download
memory/1196-4-0x00007FFA12E20000-0x00007FFA12E22000-memory.dmp

Filesize
8KB

Download
memory/1196-3-0x00007FFA12D50000-0x00007FFA12D52000-memory.dmp

Filesize
8KB

Download
memory/1196-2-0x00007FFA14820000-0x00007FFA14822000-memory.dmp

Filesize
8KB

Download
memory/1196-1-0x00007FFA14810000-0x00007FFA14812000-memory.dmp

Filesize
8KB

Download
memory/1196-6-0x00007FFA12220000-0x00007FFA12222000-memory.dmp

Filesize
8KB

Download
memory/1196-8-0x00007FF6CD450000-0x00007FF6CDA5B000-memory.dmp

Filesize
6.0MB

Download
memory/1196-18-0x00007FF6CD5B5000-0x00007FF6CD76B000-memory.dmp

Filesize
1.7MB

Download