privateloader | 01459aeff1523dcabb066384e0360d2984dbdda919a3783ef7c072a08f961bd9

General

Target

a32d49c89b000373d646acf337f5ad9aa65560f7804b46de3c846fbed77e3139.exe
Size

4.8MB
MD5

e921ce4ed0ec9ab7f58724d7b2f4e377
SHA1

8a4fc01c939d411af40ee3df2f23b6bcec4e989b
SHA256

a32d49c89b000373d646acf337f5ad9aa65560f7804b46de3c846fbed77e3139
SHA512

ae845092c0456367990c511b6bdb3107689c14312f71b11aeaf18051fff2f565d29d0204bfbda9288e5185f274bc78f292bdfea3f0cd7f103aaee2ae02ed43c2
SSDEEP

98304:wWoj48rmA6lPPvKStJwzTgJceL/v/DDrIM5PgZLHR6a0Qxk:us8r3AH7nwvwFLvHsMOUa0S

Score

10^/10

privateloader evasion loader

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1"	a32d49c89b000373d646acf337f5ad9aa65560f7804b46de3c846fbed77e3139.exe

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	a32d49c89b000373d646acf337f5ad9aa65560f7804b46de3c846fbed77e3139.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	a32d49c89b000373d646acf337f5ad9aa65560f7804b46de3c846fbed77e3139.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	a32d49c89b000373d646acf337f5ad9aa65560f7804b46de3c846fbed77e3139.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	a32d49c89b000373d646acf337f5ad9aa65560f7804b46de3c846fbed77e3139.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2708	a32d49c89b000373d646acf337f5ad9aa65560f7804b46de3c846fbed77e3139.exe
2708	a32d49c89b000373d646acf337f5ad9aa65560f7804b46de3c846fbed77e3139.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 976	2708	a32d49c89b000373d646acf337f5ad9aa65560f7804b46de3c846fbed77e3139.exe	31
PID 2708 wrote to memory of 976	2708	a32d49c89b000373d646acf337f5ad9aa65560f7804b46de3c846fbed77e3139.exe	31
PID 2708 wrote to memory of 976	2708	a32d49c89b000373d646acf337f5ad9aa65560f7804b46de3c846fbed77e3139.exe	31

C:\Users\Admin\AppData\Local\Temp\a32d49c89b000373d646acf337f5ad9aa65560f7804b46de3c846fbed77e3139.exe
"C:\Users\Admin\AppData\Local\Temp\a32d49c89b000373d646acf337f5ad9aa65560f7804b46de3c846fbed77e3139.exe"
1⤵
- Modifies firewall policy service
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2708 -s 220
  2⤵
  PID:976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\GroupPolicy\gpt.ini

Filesize
127B

MD5
8ef9853d1881c5fe4d681bfb31282a01

SHA1
a05609065520e4b4e553784c566430ad9736f19f

SHA256
9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

SHA512
5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

Download Submit
memory/2708-16-0x0000000076FB0000-0x0000000076FB2000-memory.dmp

Filesize
8KB

Download
memory/2708-42-0x000000013FD16000-0x000000014000A000-memory.dmp

Filesize
3.0MB

Download
memory/2708-15-0x0000000076FA0000-0x0000000076FA2000-memory.dmp

Filesize
8KB

Download
memory/2708-4-0x0000000076F80000-0x0000000076F82000-memory.dmp

Filesize
8KB

Download
memory/2708-2-0x0000000076F80000-0x0000000076F82000-memory.dmp

Filesize
8KB

Download
memory/2708-0-0x0000000076F80000-0x0000000076F82000-memory.dmp

Filesize
8KB

Download
memory/2708-11-0x0000000076FA0000-0x0000000076FA2000-memory.dmp

Filesize
8KB

Download
memory/2708-13-0x0000000076FA0000-0x0000000076FA2000-memory.dmp

Filesize
8KB

Download
memory/2708-5-0x000000013FD16000-0x000000014000A000-memory.dmp

Filesize
3.0MB

Download
memory/2708-6-0x0000000076F90000-0x0000000076F92000-memory.dmp

Filesize
8KB

Download
memory/2708-20-0x0000000076FB0000-0x0000000076FB2000-memory.dmp

Filesize
8KB

Download
memory/2708-18-0x0000000076FB0000-0x0000000076FB2000-memory.dmp

Filesize
8KB

Download
memory/2708-23-0x000007FEFCFA0000-0x000007FEFCFA2000-memory.dmp

Filesize
8KB

Download
memory/2708-25-0x000007FEFCFA0000-0x000007FEFCFA2000-memory.dmp

Filesize
8KB

Download
memory/2708-28-0x000007FEFCFB0000-0x000007FEFCFB2000-memory.dmp

Filesize
8KB

Download
memory/2708-30-0x000007FEFCFB0000-0x000007FEFCFB2000-memory.dmp

Filesize
8KB

Download
memory/2708-31-0x000000013FBB0000-0x00000001404DA000-memory.dmp

Filesize
9.2MB

Download
memory/2708-8-0x0000000076F90000-0x0000000076F92000-memory.dmp

Filesize
8KB

Download
memory/2708-10-0x0000000076F90000-0x0000000076F92000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads