privateloader | d963acee9e469ee9b95e16ca8d4f77412663b6f92928d885cd35c82595bea7ef

General

Target

d963acee9e469ee9b95e16ca8d4f77412663b6f92928d885cd35c82595bea7ef.exe
Size

4.3MB
MD5

d25bee31c30313658d2e010c0fb5f66e
SHA1

003a49d195dd719b9af213fedcf9c39d8b6bf480
SHA256

d963acee9e469ee9b95e16ca8d4f77412663b6f92928d885cd35c82595bea7ef
SHA512

323bc94eb61a776c4a2a112d064bef17bd9874e3560040672288cd4447065dca4bc47bb346ebb13319bf999163704fc56beed345bd8c24dc487803f3a8db3dc7
SSDEEP

98304:dbFhmDz7Avv/xXkMfPikM5JofdF7r8tH9gAMhPQLv+Wu5Vm:dFAnE55fb46LSH9gAMBQTRM

Score

10^/10

privateloader evasion loader

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

d963acee9e469ee9b95e16ca8d4f77412663b6f92928d885cd35c82595bea7ef.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1"	d963acee9e469ee9b95e16ca8d4f77412663b6f92928d885cd35c82595bea7ef.exe

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader

Drops file in System32 directory 4 IoCs

Processes:

d963acee9e469ee9b95e16ca8d4f77412663b6f92928d885cd35c82595bea7ef.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	d963acee9e469ee9b95e16ca8d4f77412663b6f92928d885cd35c82595bea7ef.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	d963acee9e469ee9b95e16ca8d4f77412663b6f92928d885cd35c82595bea7ef.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	d963acee9e469ee9b95e16ca8d4f77412663b6f92928d885cd35c82595bea7ef.exe
File opened for modification	C:\Windows\System32\GroupPolicy	d963acee9e469ee9b95e16ca8d4f77412663b6f92928d885cd35c82595bea7ef.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

d963acee9e469ee9b95e16ca8d4f77412663b6f92928d885cd35c82595bea7ef.exe

pid process

2140 d963acee9e469ee9b95e16ca8d4f77412663b6f92928d885cd35c82595bea7ef.exe

pid	process
2140	d963acee9e469ee9b95e16ca8d4f77412663b6f92928d885cd35c82595bea7ef.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

d963acee9e469ee9b95e16ca8d4f77412663b6f92928d885cd35c82595bea7ef.exe

description	pid	process	target process
PID 2140 wrote to memory of 2340	2140	d963acee9e469ee9b95e16ca8d4f77412663b6f92928d885cd35c82595bea7ef.exe	WerFault.exe
PID 2140 wrote to memory of 2340	2140	d963acee9e469ee9b95e16ca8d4f77412663b6f92928d885cd35c82595bea7ef.exe	WerFault.exe
PID 2140 wrote to memory of 2340	2140	d963acee9e469ee9b95e16ca8d4f77412663b6f92928d885cd35c82595bea7ef.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\d963acee9e469ee9b95e16ca8d4f77412663b6f92928d885cd35c82595bea7ef.exe
"C:\Users\Admin\AppData\Local\Temp\d963acee9e469ee9b95e16ca8d4f77412663b6f92928d885cd35c82595bea7ef.exe"
1⤵
- Modifies firewall policy service
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2140

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2140 -s 220
2⤵
PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2140-10-0x00000000771D0000-0x00000000771D2000-memory.dmp

Filesize
8KB

Download
memory/2140-8-0x00000000771D0000-0x00000000771D2000-memory.dmp

Filesize
8KB

Download
memory/2140-6-0x00000000771D0000-0x00000000771D2000-memory.dmp

Filesize
8KB

Download
memory/2140-5-0x000000013F715000-0x000000013F97B000-memory.dmp

Filesize
2.4MB

Download
memory/2140-4-0x00000000771C0000-0x00000000771C2000-memory.dmp

Filesize
8KB

Download
memory/2140-2-0x00000000771C0000-0x00000000771C2000-memory.dmp

Filesize
8KB

Download
memory/2140-0-0x00000000771C0000-0x00000000771C2000-memory.dmp

Filesize
8KB

Download
memory/2140-36-0x000007FEFCFE0000-0x000007FEFCFE2000-memory.dmp

Filesize
8KB

Download
memory/2140-34-0x000007FEFCFE0000-0x000007FEFCFE2000-memory.dmp

Filesize
8KB

Download
memory/2140-31-0x000007FEFCFD0000-0x000007FEFCFD2000-memory.dmp

Filesize
8KB

Download
memory/2140-29-0x000007FEFCFD0000-0x000007FEFCFD2000-memory.dmp

Filesize
8KB

Download
memory/2140-26-0x0000000077200000-0x0000000077202000-memory.dmp

Filesize
8KB

Download
memory/2140-24-0x0000000077200000-0x0000000077202000-memory.dmp

Filesize
8KB

Download
memory/2140-22-0x0000000077200000-0x0000000077202000-memory.dmp

Filesize
8KB

Download
memory/2140-21-0x00000000771F0000-0x00000000771F2000-memory.dmp

Filesize
8KB

Download
memory/2140-20-0x000000013F5B0000-0x000000013FDC4000-memory.dmp

Filesize
8.1MB

Download
memory/2140-18-0x00000000771F0000-0x00000000771F2000-memory.dmp

Filesize
8KB

Download
memory/2140-16-0x00000000771F0000-0x00000000771F2000-memory.dmp

Filesize
8KB

Download
memory/2140-15-0x00000000771E0000-0x00000000771E2000-memory.dmp

Filesize
8KB

Download
memory/2140-13-0x00000000771E0000-0x00000000771E2000-memory.dmp

Filesize
8KB

Download
memory/2140-11-0x00000000771E0000-0x00000000771E2000-memory.dmp

Filesize
8KB

Download
memory/2140-48-0x000000013F715000-0x000000013F97B000-memory.dmp

Filesize
2.4MB

Download
memory/2140-49-0x000000013F5B0000-0x000000013FDC4000-memory.dmp

Filesize
8.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads