privateloader | ee1601ec6b9ef7f3b330976020f7850ac37ec2b395d4556a93ec431e1decb5b5

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-12-2024 16:21

Target

JaffaCakes118_ee1601ec6b9ef7f3b330976020f7850ac37ec2b395d4556a93ec431e1decb5b5.exe
Size

652.0MB
MD5

c99c4c3d5514deffea71ee7fd32673ed
SHA1

d5263c86bae0f351a78e0bb2f78e50002104bb62
SHA256

ee1601ec6b9ef7f3b330976020f7850ac37ec2b395d4556a93ec431e1decb5b5
SHA512

3d8f34c6097bbb2b74259fcfb6af1430467d97be962ce81fd03580482027d95a596b525a2148b562d3db098f3c73f7bd5f43198e7d99bbf23692f597ebd7ed4d
SSDEEP

196608:y55H0eo/kBtjRMOYoJe4yBnvbECfjPMtIi8ZAe:yXUe3oVzBjEOrMtIf

Score

10^/10

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
Privateloader family
privateloader

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1728-11-0x000000013FAB0000-0x000000014097B000-memory.dmp	vmprotect
behavioral1/memory/1728-10-0x000000013FAB0000-0x000000014097B000-memory.dmp	vmprotect
behavioral1/memory/1728-20-0x000000013FAB0000-0x000000014097B000-memory.dmp	vmprotect
behavioral1/memory/1728-21-0x000000013FAB0000-0x000000014097B000-memory.dmp	vmprotect

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	JaffaCakes118_ee1601ec6b9ef7f3b330976020f7850ac37ec2b395d4556a93ec431e1decb5b5.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	JaffaCakes118_ee1601ec6b9ef7f3b330976020f7850ac37ec2b395d4556a93ec431e1decb5b5.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	JaffaCakes118_ee1601ec6b9ef7f3b330976020f7850ac37ec2b395d4556a93ec431e1decb5b5.exe
File opened for modification	C:\Windows\System32\GroupPolicy	JaffaCakes118_ee1601ec6b9ef7f3b330976020f7850ac37ec2b395d4556a93ec431e1decb5b5.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1728	JaffaCakes118_ee1601ec6b9ef7f3b330976020f7850ac37ec2b395d4556a93ec431e1decb5b5.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2844	1728	JaffaCakes118_ee1601ec6b9ef7f3b330976020f7850ac37ec2b395d4556a93ec431e1decb5b5.exe	30
PID 1728 wrote to memory of 2844	1728	JaffaCakes118_ee1601ec6b9ef7f3b330976020f7850ac37ec2b395d4556a93ec431e1decb5b5.exe	30
PID 1728 wrote to memory of 2844	1728	JaffaCakes118_ee1601ec6b9ef7f3b330976020f7850ac37ec2b395d4556a93ec431e1decb5b5.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ee1601ec6b9ef7f3b330976020f7850ac37ec2b395d4556a93ec431e1decb5b5.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ee1601ec6b9ef7f3b330976020f7850ac37ec2b395d4556a93ec431e1decb5b5.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1728 -s 488
  2⤵
  PID:2844

memory/1728-6-0x000000013FE18000-0x000000014017C000-memory.dmp

Filesize
3.4MB

Download
memory/1728-4-0x00000000778B0000-0x00000000778B2000-memory.dmp

Filesize
8KB

Download
memory/1728-2-0x00000000778B0000-0x00000000778B2000-memory.dmp

Filesize
8KB

Download
memory/1728-0-0x00000000778B0000-0x00000000778B2000-memory.dmp

Filesize
8KB

Download
memory/1728-11-0x000000013FAB0000-0x000000014097B000-memory.dmp

Filesize
14.8MB

Download
memory/1728-10-0x000000013FAB0000-0x000000014097B000-memory.dmp

Filesize
14.8MB

Download
memory/1728-19-0x000000013FE18000-0x000000014017C000-memory.dmp

Filesize
3.4MB

Download
memory/1728-20-0x000000013FAB0000-0x000000014097B000-memory.dmp

Filesize
14.8MB

Download
memory/1728-21-0x000000013FAB0000-0x000000014097B000-memory.dmp

Filesize
14.8MB

Download