privateloader | e3cd90fe855b430449aa00f87f135fc4d61f6a5e592dcba177e9067b00ab632e

General

Target

e3cd90fe855b430449aa00f87f135fc4d61f6a5e592dcba177e9067b00ab632e.exe
Size

4.3MB
MD5

61d67e67d5492a03cd4a04b11e6c737c
SHA1

f6ed2279bfd5fb2c42af498b4356ed460ff48d58
SHA256

e3cd90fe855b430449aa00f87f135fc4d61f6a5e592dcba177e9067b00ab632e
SHA512

e94be7bafe8e3ac5f9e703d777351fd60bdb3b78def6adec748c1d3d9867cd164a000bf0d82ef4b44ab9302866aeb7ffe8adf8c18e74b075c30f4213aafd0722
SSDEEP

98304:HEQQ7VWJEL5xZdj/MFScKbeppRZRxWwDv3yiv:khV35xHoAcMeVgwDvv

Score

10^/10

privateloader evasion loader

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1"	e3cd90fe855b430449aa00f87f135fc4d61f6a5e592dcba177e9067b00ab632e.exe

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	e3cd90fe855b430449aa00f87f135fc4d61f6a5e592dcba177e9067b00ab632e.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	e3cd90fe855b430449aa00f87f135fc4d61f6a5e592dcba177e9067b00ab632e.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	e3cd90fe855b430449aa00f87f135fc4d61f6a5e592dcba177e9067b00ab632e.exe
File opened for modification	C:\Windows\System32\GroupPolicy	e3cd90fe855b430449aa00f87f135fc4d61f6a5e592dcba177e9067b00ab632e.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2104	e3cd90fe855b430449aa00f87f135fc4d61f6a5e592dcba177e9067b00ab632e.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2732	2104	e3cd90fe855b430449aa00f87f135fc4d61f6a5e592dcba177e9067b00ab632e.exe	31
PID 2104 wrote to memory of 2732	2104	e3cd90fe855b430449aa00f87f135fc4d61f6a5e592dcba177e9067b00ab632e.exe	31
PID 2104 wrote to memory of 2732	2104	e3cd90fe855b430449aa00f87f135fc4d61f6a5e592dcba177e9067b00ab632e.exe	31

C:\Users\Admin\AppData\Local\Temp\e3cd90fe855b430449aa00f87f135fc4d61f6a5e592dcba177e9067b00ab632e.exe
"C:\Users\Admin\AppData\Local\Temp\e3cd90fe855b430449aa00f87f135fc4d61f6a5e592dcba177e9067b00ab632e.exe"
1⤵
- Modifies firewall policy service
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2104 -s 388
  2⤵
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2104-0-0x000000013FB06000-0x000000013FDB4000-memory.dmp

Filesize
2.7MB

Download
memory/2104-3-0x0000000077680000-0x0000000077682000-memory.dmp

Filesize
8KB

Download
memory/2104-1-0x0000000077680000-0x0000000077682000-memory.dmp

Filesize
8KB

Download
memory/2104-5-0x0000000077680000-0x0000000077682000-memory.dmp

Filesize
8KB

Download
memory/2104-15-0x00000000776A0000-0x00000000776A2000-memory.dmp

Filesize
8KB

Download
memory/2104-13-0x00000000776A0000-0x00000000776A2000-memory.dmp

Filesize
8KB

Download
memory/2104-11-0x00000000776A0000-0x00000000776A2000-memory.dmp

Filesize
8KB

Download
memory/2104-10-0x0000000077690000-0x0000000077692000-memory.dmp

Filesize
8KB

Download
memory/2104-8-0x0000000077690000-0x0000000077692000-memory.dmp

Filesize
8KB

Download
memory/2104-6-0x0000000077690000-0x0000000077692000-memory.dmp

Filesize
8KB

Download
memory/2104-21-0x00000000776B0000-0x00000000776B2000-memory.dmp

Filesize
8KB

Download
memory/2104-26-0x00000000776C0000-0x00000000776C2000-memory.dmp

Filesize
8KB

Download
memory/2104-24-0x00000000776C0000-0x00000000776C2000-memory.dmp

Filesize
8KB

Download
memory/2104-22-0x00000000776C0000-0x00000000776C2000-memory.dmp

Filesize
8KB

Download
memory/2104-19-0x00000000776B0000-0x00000000776B2000-memory.dmp

Filesize
8KB

Download
memory/2104-17-0x00000000776B0000-0x00000000776B2000-memory.dmp

Filesize
8KB

Download
memory/2104-16-0x000000013F9A0000-0x00000001401FE000-memory.dmp

Filesize
8.4MB

Download
memory/2104-36-0x000007FEFD4F0000-0x000007FEFD4F2000-memory.dmp

Filesize
8KB

Download
memory/2104-34-0x000007FEFD4F0000-0x000007FEFD4F2000-memory.dmp

Filesize
8KB

Download
memory/2104-31-0x000007FEFD4E0000-0x000007FEFD4E2000-memory.dmp

Filesize
8KB

Download
memory/2104-29-0x000007FEFD4E0000-0x000007FEFD4E2000-memory.dmp

Filesize
8KB

Download
memory/2104-48-0x000000013FB06000-0x000000013FDB4000-memory.dmp

Filesize
2.7MB

Download
memory/2104-49-0x000000013F9A0000-0x00000001401FE000-memory.dmp

Filesize
8.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads