privateloader | fd7ca23ec24b74e3bf0d1d54be67e6bd97987affa40014c43ea07191318866d8

Analysis

max time kernel
124s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16-06-2024 14:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

safe-archive/setup.exe
Size

736.0MB
MD5

2807c018ea2b8da2e2324da6d4181711
SHA1

0fbb3e33a2780932dec7ce4e45995fcbd1d4c4b9
SHA256

889d47ce91b7af3bcdbda903e7fa2533e45d77e4ff09b75885a572b5204bba54
SHA512

e050b85fddb43214bd327e3646e0ba9b9e985a70fa207d22670871a7ca68349213b05a615721aaa84a6a2211a32599586ae7548160e9da4e2941778d249309af
SSDEEP

98304:tw5NofUrgQZP/tn7/ejXG3qSi3V635t5pTHF:25NofUrrJ1nsSi3V635HFF

Score

10^/10

privateloader evasion loader

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

setup.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1"	setup.exe

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader

Drops file in System32 directory 4 IoCs

Processes:

setup.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	setup.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	setup.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	setup.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	setup.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

setup.exe

pid process

4572 setup.exe
4572 setup.exe

pid	process
4572	setup.exe
4572	setup.exe

C:\Users\Admin\AppData\Local\Temp\safe-archive\setup.exe
"C:\Users\Admin\AppData\Local\Temp\safe-archive\setup.exe"
1⤵
- Modifies firewall policy service
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:4572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:2776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4572-0-0x00007FF6B69C5000-0x00007FF6B6B7B000-memory.dmp

Filesize
1.7MB

Download
memory/4572-5-0x00007FFF14AE0000-0x00007FFF14AE2000-memory.dmp

Filesize
8KB

Download
memory/4572-4-0x00007FFF15BC0000-0x00007FFF15BC2000-memory.dmp

Filesize
8KB

Download
memory/4572-7-0x00007FF6B6860000-0x00007FF6B6E6B000-memory.dmp

Filesize
6.0MB

Download
memory/4572-6-0x00007FFF14AF0000-0x00007FFF14AF2000-memory.dmp

Filesize
8KB

Download
memory/4572-3-0x00007FFF15BB0000-0x00007FFF15BB2000-memory.dmp

Filesize
8KB

Download
memory/4572-2-0x00007FFF16E60000-0x00007FFF16E62000-memory.dmp

Filesize
8KB

Download
memory/4572-1-0x00007FFF16E50000-0x00007FFF16E52000-memory.dmp

Filesize
8KB

Download
memory/4572-18-0x00007FF6B69C5000-0x00007FF6B6B7B000-memory.dmp

Filesize
1.7MB

Download