privateloader | 642b2c1febb5c0e7ba9afeb45b66b9baa7b02d0b24f8b8a3477e3bfdeffa5d6f

General

Target

642b2c1febb5c0e7ba9afeb45b66b9baa7b02d0b24f8b8a3477e3bfdeffa5d6f.exe
Size

2.7MB
MD5

9312ea4eeda1a918922ae99a21aa1718
SHA1

14985e90b26b71b219116dd072a8ed6055aa5356
SHA256

642b2c1febb5c0e7ba9afeb45b66b9baa7b02d0b24f8b8a3477e3bfdeffa5d6f
SHA512

fa1727bb597f93241abe718d1cb107c3a8e52dee6a2fc004f426215bda3aace50c1293a24bb5d670c1fd81dae2596623e4ae37bef4c0fc39c68af80d4362d625
SSDEEP

49152:TziCEgBRW2m7P2m9V0yO3xoNhEQfWNpp9ZM2wdXywZ12ufVKkAIbZnADTFV41b6M:TuCdm7PL9GyO3xwhEGWjXjju12OVYIVk

Score

10^/10

privateloader evasion loader

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

642b2c1febb5c0e7ba9afeb45b66b9baa7b02d0b24f8b8a3477e3bfdeffa5d6f.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1"	642b2c1febb5c0e7ba9afeb45b66b9baa7b02d0b24f8b8a3477e3bfdeffa5d6f.exe

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader

Drops file in System32 directory 4 IoCs

Processes:

642b2c1febb5c0e7ba9afeb45b66b9baa7b02d0b24f8b8a3477e3bfdeffa5d6f.exe

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	642b2c1febb5c0e7ba9afeb45b66b9baa7b02d0b24f8b8a3477e3bfdeffa5d6f.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	642b2c1febb5c0e7ba9afeb45b66b9baa7b02d0b24f8b8a3477e3bfdeffa5d6f.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	642b2c1febb5c0e7ba9afeb45b66b9baa7b02d0b24f8b8a3477e3bfdeffa5d6f.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	642b2c1febb5c0e7ba9afeb45b66b9baa7b02d0b24f8b8a3477e3bfdeffa5d6f.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

642b2c1febb5c0e7ba9afeb45b66b9baa7b02d0b24f8b8a3477e3bfdeffa5d6f.exe

pid	Process
2520	642b2c1febb5c0e7ba9afeb45b66b9baa7b02d0b24f8b8a3477e3bfdeffa5d6f.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

642b2c1febb5c0e7ba9afeb45b66b9baa7b02d0b24f8b8a3477e3bfdeffa5d6f.exe

description	pid	Process	procid_target
PID 2520 wrote to memory of 2776	2520	642b2c1febb5c0e7ba9afeb45b66b9baa7b02d0b24f8b8a3477e3bfdeffa5d6f.exe	31
PID 2520 wrote to memory of 2776	2520	642b2c1febb5c0e7ba9afeb45b66b9baa7b02d0b24f8b8a3477e3bfdeffa5d6f.exe	31
PID 2520 wrote to memory of 2776	2520	642b2c1febb5c0e7ba9afeb45b66b9baa7b02d0b24f8b8a3477e3bfdeffa5d6f.exe	31

C:\Users\Admin\AppData\Local\Temp\642b2c1febb5c0e7ba9afeb45b66b9baa7b02d0b24f8b8a3477e3bfdeffa5d6f.exe
"C:\Users\Admin\AppData\Local\Temp\642b2c1febb5c0e7ba9afeb45b66b9baa7b02d0b24f8b8a3477e3bfdeffa5d6f.exe"
1⤵
- Modifies firewall policy service
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2520 -s 232
  2⤵
  PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2520-0-0x000000013F796000-0x000000013F8F4000-memory.dmp

Filesize
1.4MB

Download
memory/2520-5-0x00000000777A0000-0x00000000777A2000-memory.dmp

Filesize
8KB

Download
memory/2520-3-0x00000000777A0000-0x00000000777A2000-memory.dmp

Filesize
8KB

Download
memory/2520-1-0x00000000777A0000-0x00000000777A2000-memory.dmp

Filesize
8KB

Download
memory/2520-10-0x00000000777B0000-0x00000000777B2000-memory.dmp

Filesize
8KB

Download
memory/2520-8-0x00000000777B0000-0x00000000777B2000-memory.dmp

Filesize
8KB

Download
memory/2520-6-0x00000000777B0000-0x00000000777B2000-memory.dmp

Filesize
8KB

Download
memory/2520-13-0x00000000777C0000-0x00000000777C2000-memory.dmp

Filesize
8KB

Download
memory/2520-11-0x00000000777C0000-0x00000000777C2000-memory.dmp

Filesize
8KB

Download
memory/2520-15-0x00000000777C0000-0x00000000777C2000-memory.dmp

Filesize
8KB

Download
memory/2520-20-0x00000000777D0000-0x00000000777D2000-memory.dmp

Filesize
8KB

Download
memory/2520-18-0x00000000777D0000-0x00000000777D2000-memory.dmp

Filesize
8KB

Download
memory/2520-16-0x00000000777D0000-0x00000000777D2000-memory.dmp

Filesize
8KB

Download
memory/2520-25-0x000007FEFD580000-0x000007FEFD582000-memory.dmp

Filesize
8KB

Download
memory/2520-23-0x000007FEFD580000-0x000007FEFD582000-memory.dmp

Filesize
8KB

Download
memory/2520-30-0x000007FEFD590000-0x000007FEFD592000-memory.dmp

Filesize
8KB

Download
memory/2520-28-0x000007FEFD590000-0x000007FEFD592000-memory.dmp

Filesize
8KB

Download
memory/2520-31-0x000000013F630000-0x000000013FBB0000-memory.dmp

Filesize
5.5MB

Download
memory/2520-42-0x000000013F796000-0x000000013F8F4000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads