Analysis
- max time kernel
133s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
18/08/2024, 12:31
General
- Target 9312ea4eeda1a918922ae99a21aa1718.exe
- Size 2.7MB
- Sample240818-pp5gastdja
- SHA256 642b2c1febb5c0e7ba9afeb45b66b9baa7b02d0b24f8b8a3477e3bfdeffa5d6f
Score
10/10
Malware Config
Signatures
- Modifies firewall policy service 3 TTPs 1 IoCs
- PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
- Drops file in System32 directory 4 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9312ea4eeda1a918922ae99a21aa1718.exe"C:\Users\Admin\AppData\Local\Temp\9312ea4eeda1a918922ae99a21aa1718.exe"1⤵
- Modifies firewall policy service
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
gpt.ini
memory/2992-0-0x00007FF71AA96000-0x00007FF71ABF4000-memory.dmp
memory/2992-3-0x00007FF8ED8B0000-0x00007FF8ED8B2000-memory.dmp
memory/2992-2-0x00007FF8EF120000-0x00007FF8EF122000-memory.dmp
memory/2992-1-0x00007FF8EF110000-0x00007FF8EF112000-memory.dmp
memory/2992-4-0x00007FF8ED8C0000-0x00007FF8ED8C2000-memory.dmp
memory/2992-5-0x00007FF8ECA60000-0x00007FF8ECA62000-memory.dmp
memory/2992-6-0x00007FF8ECA70000-0x00007FF8ECA72000-memory.dmp
memory/2992-7-0x00007FF71A930000-0x00007FF71AEB0000-memory.dmp
memory/2992-18-0x000001E171D00000-0x000001E171D6B000-memory.dmp
memory/2992-19-0x00007FF71AA96000-0x00007FF71ABF4000-memory.dmp