privateloader | 09b7f55020638c72189bf0fb828953410f110f6b5b0aa6b1af669cc2451581e6

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-12-2024 16:57

Target

JaffaCakes118_09b7f55020638c72189bf0fb828953410f110f6b5b0aa6b1af669cc2451581e6.exe
Size

666.0MB
MD5

dfe614d5ea5019dfe90fbbc597a6347e
SHA1

ec8be683e0f53db9993347402e284133ae48b335
SHA256

09b7f55020638c72189bf0fb828953410f110f6b5b0aa6b1af669cc2451581e6
SHA512

159b1c0a8fb1a530e486e36a5b7cab9ad4044808f129e3408d0d5bc1c24dd732e5ac137d5a7a72b62f133bbb3b3e46e6864e6c5f507a96b6930314c7a0754e6a
SSDEEP

98304:2LQOrC2oJq3M+jRaLoFFlRHXQJX8OMOct9NTe4r0w8OUlXxtSDIzCLCc:yPrC29jfJtQJMONQ9Lr0w8vCq

Score

10^/10

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
Privateloader family
privateloader

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	JaffaCakes118_09b7f55020638c72189bf0fb828953410f110f6b5b0aa6b1af669cc2451581e6.exe
File opened for modification	C:\Windows\System32\GroupPolicy	JaffaCakes118_09b7f55020638c72189bf0fb828953410f110f6b5b0aa6b1af669cc2451581e6.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	JaffaCakes118_09b7f55020638c72189bf0fb828953410f110f6b5b0aa6b1af669cc2451581e6.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	JaffaCakes118_09b7f55020638c72189bf0fb828953410f110f6b5b0aa6b1af669cc2451581e6.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 3032	2136	JaffaCakes118_09b7f55020638c72189bf0fb828953410f110f6b5b0aa6b1af669cc2451581e6.exe	30
PID 2136 wrote to memory of 3032	2136	JaffaCakes118_09b7f55020638c72189bf0fb828953410f110f6b5b0aa6b1af669cc2451581e6.exe	30
PID 2136 wrote to memory of 3032	2136	JaffaCakes118_09b7f55020638c72189bf0fb828953410f110f6b5b0aa6b1af669cc2451581e6.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_09b7f55020638c72189bf0fb828953410f110f6b5b0aa6b1af669cc2451581e6.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_09b7f55020638c72189bf0fb828953410f110f6b5b0aa6b1af669cc2451581e6.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2136 -s 412
  2⤵
  PID:3032

C:\Windows\System32\GroupPolicy\gpt.ini

Filesize
127B

MD5
8ef9853d1881c5fe4d681bfb31282a01

SHA1
a05609065520e4b4e553784c566430ad9736f19f

SHA256
9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

SHA512
5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

Download Submit
memory/2136-0-0x000000013F760000-0x0000000140285000-memory.dmp

Filesize
11.1MB

Download