privateloader | 9b21d8e1e19b0fb942220bf5e40977b4b3bc273b3217acc235ade05554ef3318

Analysis

max time kernel
124s
max time network
140s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 00:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_9b21d8e1e19b0fb942220bf5e40977b4b3bc273b3217acc235ade05554ef3318.exe
Size

659.0MB
MD5

24fd496166faa7cc4569adbabadd1a58
SHA1

c76350cbb7867d7959fb0e58e2543b2df07f39ef
SHA256

9b21d8e1e19b0fb942220bf5e40977b4b3bc273b3217acc235ade05554ef3318
SHA512

412196df8393317a8fd72fbeeea7dc4e2cd5553829fd3218f65ae986df67d01eb149d90e5f8bad0289fd1ef03d1c6767d07759cf0b8d179cbc483282b8bfd970
SSDEEP

98304:fUuYyj3O4isajZvJJhuYdHOzFSpsip5+nKUueER+w7lnh5R1XYtrEZSR:cryrOyMZ3gYXprH+SpR+w7dZu+

Score

10^/10

privateloader loader

Malware Config

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
Privateloader family
privateloader

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	JaffaCakes118_9b21d8e1e19b0fb942220bf5e40977b4b3bc273b3217acc235ade05554ef3318.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	JaffaCakes118_9b21d8e1e19b0fb942220bf5e40977b4b3bc273b3217acc235ade05554ef3318.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	JaffaCakes118_9b21d8e1e19b0fb942220bf5e40977b4b3bc273b3217acc235ade05554ef3318.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	JaffaCakes118_9b21d8e1e19b0fb942220bf5e40977b4b3bc273b3217acc235ade05554ef3318.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1760	JaffaCakes118_9b21d8e1e19b0fb942220bf5e40977b4b3bc273b3217acc235ade05554ef3318.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 3052	1760	JaffaCakes118_9b21d8e1e19b0fb942220bf5e40977b4b3bc273b3217acc235ade05554ef3318.exe	31
PID 1760 wrote to memory of 3052	1760	JaffaCakes118_9b21d8e1e19b0fb942220bf5e40977b4b3bc273b3217acc235ade05554ef3318.exe	31
PID 1760 wrote to memory of 3052	1760	JaffaCakes118_9b21d8e1e19b0fb942220bf5e40977b4b3bc273b3217acc235ade05554ef3318.exe	31

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9b21d8e1e19b0fb942220bf5e40977b4b3bc273b3217acc235ade05554ef3318.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9b21d8e1e19b0fb942220bf5e40977b4b3bc273b3217acc235ade05554ef3318.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1760 -s 212
  2⤵
  PID:3052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\GroupPolicy\gpt.ini

Filesize
127B

MD5
8ef9853d1881c5fe4d681bfb31282a01

SHA1
a05609065520e4b4e553784c566430ad9736f19f

SHA256
9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

SHA512
5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

Download Submit
memory/1760-7-0x0000000077960000-0x0000000077962000-memory.dmp

Filesize
8KB

Download
memory/1760-42-0x000000013FAD2000-0x000000013FE04000-memory.dmp

Filesize
3.2MB

Download
memory/1760-9-0x0000000077960000-0x0000000077962000-memory.dmp

Filesize
8KB

Download
memory/1760-17-0x0000000077980000-0x0000000077982000-memory.dmp

Filesize
8KB

Download
memory/1760-15-0x0000000077980000-0x0000000077982000-memory.dmp

Filesize
8KB

Download
memory/1760-14-0x0000000077970000-0x0000000077972000-memory.dmp

Filesize
8KB

Download
memory/1760-12-0x0000000077970000-0x0000000077972000-memory.dmp

Filesize
8KB

Download
memory/1760-10-0x0000000077970000-0x0000000077972000-memory.dmp

Filesize
8KB

Download
memory/1760-19-0x0000000077980000-0x0000000077982000-memory.dmp

Filesize
8KB

Download
memory/1760-22-0x000007FEFD690000-0x000007FEFD692000-memory.dmp

Filesize
8KB

Download
memory/1760-4-0x0000000077950000-0x0000000077952000-memory.dmp

Filesize
8KB

Download
memory/1760-5-0x0000000077960000-0x0000000077962000-memory.dmp

Filesize
8KB

Download
memory/1760-28-0x000007FEFD6A0000-0x000007FEFD6A2000-memory.dmp

Filesize
8KB

Download
memory/1760-2-0x0000000077950000-0x0000000077952000-memory.dmp

Filesize
8KB

Download
memory/1760-0-0x0000000077950000-0x0000000077952000-memory.dmp

Filesize
8KB

Download
memory/1760-30-0x000007FEFD6A0000-0x000007FEFD6A2000-memory.dmp

Filesize
8KB

Download
memory/1760-31-0x000000013F770000-0x00000001403CB000-memory.dmp

Filesize
12.4MB

Download
memory/1760-24-0x000007FEFD690000-0x000007FEFD692000-memory.dmp

Filesize
8KB

Download
memory/1760-25-0x000000013FAD2000-0x000000013FE04000-memory.dmp

Filesize
3.2MB

Download