privateloader | 357b4d2394dfe1dc376f73901cbd1bb1224f665a7b4c46e7a40c57bb53e03c37

Analysis

max time kernel
13s
max time network
35s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
23-12-2024 15:05

Target

JaffaCakes118_357b4d2394dfe1dc376f73901cbd1bb1224f665a7b4c46e7a40c57bb53e03c37.exe
Size

693.8MB
MD5

4b330268e47192540de0405f1fdd731e
SHA1

aff6597a598c477134177928b667460501419e48
SHA256

357b4d2394dfe1dc376f73901cbd1bb1224f665a7b4c46e7a40c57bb53e03c37
SHA512

524258a115e31d7f0858d1639486228ceb09c35247cd5cea973d0e7ff4e9580de108fa312330b51218a16c007f754e4771d532682339938b8564ae44073a3937
SSDEEP

196608:QmklKk8ZCnlHTwIo5MJay+eWQFo443kGu:Q8k8Z6lHqmq55

Score

10^/10

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
Privateloader family
privateloader

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/2044-10-0x000000013FDA0000-0x0000000140BF4000-memory.dmp	vmprotect
behavioral1/memory/2044-5-0x000000013FDA0000-0x0000000140BF4000-memory.dmp	vmprotect
behavioral1/memory/2044-19-0x000000013FDA0000-0x0000000140BF4000-memory.dmp	vmprotect
behavioral1/memory/2044-20-0x000000013FDA0000-0x0000000140BF4000-memory.dmp	vmprotect

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	JaffaCakes118_357b4d2394dfe1dc376f73901cbd1bb1224f665a7b4c46e7a40c57bb53e03c37.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	JaffaCakes118_357b4d2394dfe1dc376f73901cbd1bb1224f665a7b4c46e7a40c57bb53e03c37.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	JaffaCakes118_357b4d2394dfe1dc376f73901cbd1bb1224f665a7b4c46e7a40c57bb53e03c37.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	JaffaCakes118_357b4d2394dfe1dc376f73901cbd1bb1224f665a7b4c46e7a40c57bb53e03c37.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2044	JaffaCakes118_357b4d2394dfe1dc376f73901cbd1bb1224f665a7b4c46e7a40c57bb53e03c37.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 3052	2044	JaffaCakes118_357b4d2394dfe1dc376f73901cbd1bb1224f665a7b4c46e7a40c57bb53e03c37.exe	30
PID 2044 wrote to memory of 3052	2044	JaffaCakes118_357b4d2394dfe1dc376f73901cbd1bb1224f665a7b4c46e7a40c57bb53e03c37.exe	30
PID 2044 wrote to memory of 3052	2044	JaffaCakes118_357b4d2394dfe1dc376f73901cbd1bb1224f665a7b4c46e7a40c57bb53e03c37.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_357b4d2394dfe1dc376f73901cbd1bb1224f665a7b4c46e7a40c57bb53e03c37.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_357b4d2394dfe1dc376f73901cbd1bb1224f665a7b4c46e7a40c57bb53e03c37.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2044 -s 224
  2⤵
  PID:3052

memory/2044-6-0x0000000140118000-0x000000014047A000-memory.dmp

Filesize
3.4MB

Download
memory/2044-10-0x000000013FDA0000-0x0000000140BF4000-memory.dmp

Filesize
14.3MB

Download
memory/2044-4-0x0000000077D90000-0x0000000077D92000-memory.dmp

Filesize
8KB

Download
memory/2044-5-0x000000013FDA0000-0x0000000140BF4000-memory.dmp

Filesize
14.3MB

Download
memory/2044-2-0x0000000077D90000-0x0000000077D92000-memory.dmp

Filesize
8KB

Download
memory/2044-0-0x0000000077D90000-0x0000000077D92000-memory.dmp

Filesize
8KB

Download
memory/2044-18-0x0000000140118000-0x000000014047A000-memory.dmp

Filesize
3.4MB

Download
memory/2044-19-0x000000013FDA0000-0x0000000140BF4000-memory.dmp

Filesize
14.3MB

Download
memory/2044-20-0x000000013FDA0000-0x0000000140BF4000-memory.dmp

Filesize
14.3MB

Download