privateloader | f2e670818e4cdba07da7fdcd5055df9a04395f84493dad4e8d542672dc627528

General

Target

fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
Size

3.0MB
MD5

fd9f5030af40a386ff59f85dca14e8ff
SHA1

66b5833195bfde7c50c80617c083f6ee685b30c8
SHA256

f2e670818e4cdba07da7fdcd5055df9a04395f84493dad4e8d542672dc627528
SHA512

5b6fac42fdd46f18e69ec6070b9ea42ae6dbdbfd236588a6b45fa73ab37674e34ed91d4a0b175c23377fd82c246531788297c747b8dc2172c4e93857746c6fa9
SSDEEP

49152:5OBJAfm58yMhvsdmMcn8dyUrXXR663Ji05ZnVDsfb4vfLVFrlMix:omm6thvOPLY65nnnBib4bpJ

Score

10^/10

privateloader loader vmprotect

Malware Config

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/2316-5-0x000000013F9F0000-0x000000014005B000-memory.dmp	vmprotect
behavioral1/memory/2316-10-0x000000013F9F0000-0x000000014005B000-memory.dmp	vmprotect
behavioral1/memory/2316-21-0x000000013F9F0000-0x000000014005B000-memory.dmp	vmprotect

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe

pid	process
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
2316	fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fd9f5030af40a386ff59f85dca14e8ff_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2316-6-0x000000013FAE8000-0x000000013FD82000-memory.dmp

Filesize
2.6MB

Download
memory/2316-4-0x00000000778C0000-0x00000000778C2000-memory.dmp

Filesize
8KB

Download
memory/2316-2-0x00000000778C0000-0x00000000778C2000-memory.dmp

Filesize
8KB

Download
memory/2316-0-0x00000000778C0000-0x00000000778C2000-memory.dmp

Filesize
8KB

Download
memory/2316-5-0x000000013F9F0000-0x000000014005B000-memory.dmp

Filesize
6.4MB

Download
memory/2316-10-0x000000013F9F0000-0x000000014005B000-memory.dmp

Filesize
6.4MB

Download
memory/2316-20-0x000000013FAE8000-0x000000013FD82000-memory.dmp

Filesize
2.6MB

Download
memory/2316-21-0x000000013F9F0000-0x000000014005B000-memory.dmp

Filesize
6.4MB

Download

Analysis

Sharing