privateloader | 01459aeff1523dcabb066384e0360d2984dbdda919a3783ef7c072a08f961bd9

General

Target

a32d49c89b000373d646acf337f5ad9aa65560f7804b46de3c846fbed77e3139.exe
Size

4.8MB
MD5

e921ce4ed0ec9ab7f58724d7b2f4e377
SHA1

8a4fc01c939d411af40ee3df2f23b6bcec4e989b
SHA256

a32d49c89b000373d646acf337f5ad9aa65560f7804b46de3c846fbed77e3139
SHA512

ae845092c0456367990c511b6bdb3107689c14312f71b11aeaf18051fff2f565d29d0204bfbda9288e5185f274bc78f292bdfea3f0cd7f103aaee2ae02ed43c2
SSDEEP

98304:wWoj48rmA6lPPvKStJwzTgJceL/v/DDrIM5PgZLHR6a0Qxk:us8r3AH7nwvwFLvHsMOUa0S

Score

10^/10

privateloader evasion loader

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

a32d49c89b000373d646acf337f5ad9aa65560f7804b46de3c846fbed77e3139.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1"	a32d49c89b000373d646acf337f5ad9aa65560f7804b46de3c846fbed77e3139.exe

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader

Drops file in System32 directory 4 IoCs

Processes:

a32d49c89b000373d646acf337f5ad9aa65560f7804b46de3c846fbed77e3139.exe

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	a32d49c89b000373d646acf337f5ad9aa65560f7804b46de3c846fbed77e3139.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	a32d49c89b000373d646acf337f5ad9aa65560f7804b46de3c846fbed77e3139.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	a32d49c89b000373d646acf337f5ad9aa65560f7804b46de3c846fbed77e3139.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	a32d49c89b000373d646acf337f5ad9aa65560f7804b46de3c846fbed77e3139.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a32d49c89b000373d646acf337f5ad9aa65560f7804b46de3c846fbed77e3139.exe

pid	Process
1996	a32d49c89b000373d646acf337f5ad9aa65560f7804b46de3c846fbed77e3139.exe
1996	a32d49c89b000373d646acf337f5ad9aa65560f7804b46de3c846fbed77e3139.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a32d49c89b000373d646acf337f5ad9aa65560f7804b46de3c846fbed77e3139.exe

description	pid	Process	procid_target
PID 1996 wrote to memory of 2776	1996	a32d49c89b000373d646acf337f5ad9aa65560f7804b46de3c846fbed77e3139.exe	29
PID 1996 wrote to memory of 2776	1996	a32d49c89b000373d646acf337f5ad9aa65560f7804b46de3c846fbed77e3139.exe	29
PID 1996 wrote to memory of 2776	1996	a32d49c89b000373d646acf337f5ad9aa65560f7804b46de3c846fbed77e3139.exe	29

C:\Users\Admin\AppData\Local\Temp\a32d49c89b000373d646acf337f5ad9aa65560f7804b46de3c846fbed77e3139.exe
"C:\Users\Admin\AppData\Local\Temp\a32d49c89b000373d646acf337f5ad9aa65560f7804b46de3c846fbed77e3139.exe"
1⤵
- Modifies firewall policy service
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1996 -s 220
  2⤵
  PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1996-15-0x000000013F2D6000-0x000000013F5CA000-memory.dmp

Filesize
3.0MB

Download
memory/1996-14-0x0000000077940000-0x0000000077942000-memory.dmp

Filesize
8KB

Download
memory/1996-12-0x0000000077940000-0x0000000077942000-memory.dmp

Filesize
8KB

Download
memory/1996-10-0x0000000077940000-0x0000000077942000-memory.dmp

Filesize
8KB

Download
memory/1996-9-0x0000000077930000-0x0000000077932000-memory.dmp

Filesize
8KB

Download
memory/1996-7-0x0000000077930000-0x0000000077932000-memory.dmp

Filesize
8KB

Download
memory/1996-5-0x0000000077930000-0x0000000077932000-memory.dmp

Filesize
8KB

Download
memory/1996-4-0x0000000077920000-0x0000000077922000-memory.dmp

Filesize
8KB

Download
memory/1996-2-0x0000000077920000-0x0000000077922000-memory.dmp

Filesize
8KB

Download
memory/1996-0-0x0000000077920000-0x0000000077922000-memory.dmp

Filesize
8KB

Download
memory/1996-30-0x000007FEFD740000-0x000007FEFD742000-memory.dmp

Filesize
8KB

Download
memory/1996-32-0x000000013F170000-0x000000013FA9A000-memory.dmp

Filesize
9.2MB

Download
memory/1996-28-0x000007FEFD740000-0x000007FEFD742000-memory.dmp

Filesize
8KB

Download
memory/1996-25-0x000007FEFD730000-0x000007FEFD732000-memory.dmp

Filesize
8KB

Download
memory/1996-23-0x000007FEFD730000-0x000007FEFD732000-memory.dmp

Filesize
8KB

Download
memory/1996-20-0x0000000077950000-0x0000000077952000-memory.dmp

Filesize
8KB

Download
memory/1996-18-0x0000000077950000-0x0000000077952000-memory.dmp

Filesize
8KB

Download
memory/1996-16-0x0000000077950000-0x0000000077952000-memory.dmp

Filesize
8KB

Download
memory/1996-42-0x000000013F2D6000-0x000000013F5CA000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads