Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    10-08-2024 14:11

General

  • Target

    284ae9899ae53d03d27bd3f72892d843fe5bbecb097f5.exe

  • Size

    4.3MB

  • MD5

    a412795f68e5dae5fbae528595b96916

  • SHA1

    e2f386ce478fbad462a873e656eea85dce550815

  • SHA256

    284ae9899ae53d03d27bd3f72892d843fe5bbecb097f52fc0b1b37d1040401d0

  • SHA512

    280a5f35ea216eae4c9d5dff2031af90caed46ba9cf62fc1daf46a34249e141d7f50677ab6245356cad771c0874227f7fe751fb38a43d198b6ab1163b60c9eea

  • SSDEEP

    98304:S6CCEFu6ZDeJ66CIydoPrNtcEVTyv6VSfj4bDLTbnK+H9:lNeTZDeEvajNavXfsnLnK+H

Malware Config

Signatures

  • Modifies firewall policy service 3 TTPs 1 IoCs
  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\284ae9899ae53d03d27bd3f72892d843fe5bbecb097f5.exe
    "C:\Users\Admin\AppData\Local\Temp\284ae9899ae53d03d27bd3f72892d843fe5bbecb097f5.exe"
    1⤵
    • Modifies firewall policy service
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    PID:2488

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2488-0-0x000000013F866000-0x000000013FADB000-memory.dmp

    Filesize

    2.5MB

  • memory/2488-3-0x0000000077750000-0x0000000077752000-memory.dmp

    Filesize

    8KB

  • memory/2488-1-0x0000000077750000-0x0000000077752000-memory.dmp

    Filesize

    8KB

  • memory/2488-5-0x0000000077750000-0x0000000077752000-memory.dmp

    Filesize

    8KB

  • memory/2488-21-0x000000013F700000-0x000000013FF20000-memory.dmp

    Filesize

    8.1MB

  • memory/2488-36-0x000007FEFD580000-0x000007FEFD582000-memory.dmp

    Filesize

    8KB

  • memory/2488-34-0x000007FEFD580000-0x000007FEFD582000-memory.dmp

    Filesize

    8KB

  • memory/2488-31-0x000007FEFD570000-0x000007FEFD572000-memory.dmp

    Filesize

    8KB

  • memory/2488-29-0x000007FEFD570000-0x000007FEFD572000-memory.dmp

    Filesize

    8KB

  • memory/2488-26-0x0000000077790000-0x0000000077792000-memory.dmp

    Filesize

    8KB

  • memory/2488-24-0x0000000077790000-0x0000000077792000-memory.dmp

    Filesize

    8KB

  • memory/2488-22-0x0000000077790000-0x0000000077792000-memory.dmp

    Filesize

    8KB

  • memory/2488-20-0x0000000077780000-0x0000000077782000-memory.dmp

    Filesize

    8KB

  • memory/2488-18-0x0000000077780000-0x0000000077782000-memory.dmp

    Filesize

    8KB

  • memory/2488-16-0x0000000077780000-0x0000000077782000-memory.dmp

    Filesize

    8KB

  • memory/2488-15-0x0000000077770000-0x0000000077772000-memory.dmp

    Filesize

    8KB

  • memory/2488-13-0x0000000077770000-0x0000000077772000-memory.dmp

    Filesize

    8KB

  • memory/2488-11-0x0000000077770000-0x0000000077772000-memory.dmp

    Filesize

    8KB

  • memory/2488-10-0x0000000077760000-0x0000000077762000-memory.dmp

    Filesize

    8KB

  • memory/2488-8-0x0000000077760000-0x0000000077762000-memory.dmp

    Filesize

    8KB

  • memory/2488-6-0x0000000077760000-0x0000000077762000-memory.dmp

    Filesize

    8KB

  • memory/2488-48-0x000000013F866000-0x000000013FADB000-memory.dmp

    Filesize

    2.5MB

  • memory/2488-49-0x000000013F700000-0x000000013FF20000-memory.dmp

    Filesize

    8.1MB