Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
08-11-2024 19:00
General
-
Target
35003a67baec96d6e279deb72d443a7ebfecd1ecb60677381c0ec5b08853de80.exe
-
Size
359KB
-
MD5
e5f2e9320ce71483b68ce56ff93a1ee6
-
SHA1
ca6ac8e0a8f77f3027ed1fd22c8535966d2d72b1
-
SHA256
35003a67baec96d6e279deb72d443a7ebfecd1ecb60677381c0ec5b08853de80
-
SHA512
36262dff5f8db74dfb38d4e590b10eec191d38982680baeaa1dacae1e919b898fb78607d3807340c4a7f2015e3cf1c381218d656cfa04e0b982ca6e1b0e80acd
-
SSDEEP
6144:0mF+3qqPaE9D0B7EtecDprSMaJU6XoTeZkxmkzDPEATsuC:0shqn5UfcDprBaJFebEATsuC
Malware Config
Extracted
privateloader
http://212.193.30.45/proxies.txt
http://45.144.225.57/server.txt
pastebin.com/raw/A7dSG1te
http://wfsdragon.ru/api/setStats.php
2.56.59.42
Signatures
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Privateloader family
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\35003a67baec96d6e279deb72d443a7ebfecd1ecb60677381c0ec5b08853de80.exe"C:\Users\Admin\AppData\Local\Temp\35003a67baec96d6e279deb72d443a7ebfecd1ecb60677381c0ec5b08853de80.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
212KB
-
Filesize
224KB
-
Filesize
1024KB
-
Filesize
212KB
-
Filesize
620KB
-
Filesize
224KB
-
Filesize
620KB