Analysis
- max time kernel
149s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
05/11/2024, 09:56
General
- Target faae62d9ef3a65ae1dae20d55b8e787661aaf452ad3b6bdd80ea267d3bd070bd.exe
- Size 732KB
- Sample241105-lym2tsykds
- SHA256 faae62d9ef3a65ae1dae20d55b8e787661aaf452ad3b6bdd80ea267d3bd070bd
Malware Config
Extracted
-
privateloader
-
http://212.193.30.45/proxies.txt
-
http://85.202.169.116/server.txt
-
pastebin.com/raw/A7dSG1te
-
http://wfsdragon.ru/api/setStats.php
-
85.202.169.116
Signatures
- PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
- Privateloader family
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\faae62d9ef3a65ae1dae20d55b8e787661aaf452ad3b6bdd80ea267d3bd070bd.exe"C:\Users\Admin\AppData\Local\Temp\faae62d9ef3a65ae1dae20d55b8e787661aaf452ad3b6bdd80ea267d3bd070bd.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\faae62d9ef3a65ae1dae20d55b8e787661aaf452ad3b6bdd80ea267d3bd070bd.exe"C:\Users\Admin\AppData\Local\Temp\faae62d9ef3a65ae1dae20d55b8e787661aaf452ad3b6bdd80ea267d3bd070bd.exe"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3996-11-0x0000000000400000-0x0000000000438000-memory.dmp
memory/3996-6-0x0000000000400000-0x0000000000438000-memory.dmp
memory/3996-16-0x0000000000400000-0x0000000000438000-memory.dmp
memory/3996-15-0x0000000000400000-0x0000000000438000-memory.dmp
memory/3996-14-0x0000000000400000-0x0000000000438000-memory.dmp
memory/3996-5-0x0000000000400000-0x0000000000438000-memory.dmp
memory/3996-9-0x0000000000400000-0x0000000000438000-memory.dmp
memory/3996-10-0x0000000000400000-0x0000000000438000-memory.dmp
memory/3996-7-0x0000000000400000-0x0000000000438000-memory.dmp
memory/5040-0-0x0000000074A7E000-0x0000000074A7F000-memory.dmp
memory/5040-1-0x0000000000B20000-0x0000000000C1A000-memory.dmp
memory/5040-12-0x0000000074A70000-0x0000000075220000-memory.dmp
memory/5040-4-0x0000000074A70000-0x0000000075220000-memory.dmp
memory/5040-3-0x0000000007D00000-0x00000000082A4000-memory.dmp
memory/5040-2-0x0000000003040000-0x0000000003041000-memory.dmp