Analysis
-
max time kernel
93s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10-11-2024 03:36
General
-
Target
Setup.exe
-
Size
365KB
-
MD5
795ce67cb525ba86787c5798be9743b0
-
SHA1
06fff7597dac5f80c3908c58f54ad627785329e8
-
SHA256
1cad831d1d3b9981f3545c394f93dd0944965cc3c3fc969aa1265b91066ceb93
-
SHA512
bcc25e1706cf4e630f09eef301a11af73b46803918478464bc99c6c2131cdd6dd2a8b85f20f977fe37286b1ecb1e1c7382d4885d3f20807b83738c72a1a17f52
-
SSDEEP
6144:g/6bm/6MGEtDn5v86mi/DudxVRbmCigaA:gt/nGEtt86mi/Duzbmn
Malware Config
Extracted
privateloader
http://212.193.30.45/proxies.txt
http://45.144.225.57/server.txt
pastebin.com/raw/A7dSG1te
http://wfsdragon.ru/api/setStats.php
2.56.59.42
Signatures
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Privateloader family
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 7922⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3924 -ip 39241⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
204KB
-
Filesize
212KB
-
Filesize
1024KB
-
Filesize
408KB
-
Filesize
204KB
-
Filesize
212KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
212KB