privateloader | 9e32c348d19c642c1c2fd6b73213656cf905ea38a623542bd21a48983c90d2b6

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26/12/2024, 16:41

Target

JaffaCakes118_9e32c348d19c642c1c2fd6b73213656cf905ea38a623542bd21a48983c90d2b6.exe
Size

691.0MB
MD5

ee9447f4deb0272240facc06567b942c
SHA1

d7e82cfadf985cdfa672ccae8ae1409ca369ab2b
SHA256

9e32c348d19c642c1c2fd6b73213656cf905ea38a623542bd21a48983c90d2b6
SHA512

17d155e8152d59489f88fa563cf02fc86a8c88284d8b7178a2ed9d6d3b57293482d3584aa8605395675aea3188a222e494ed44339ffeb7f33db580b894e7db17
SSDEEP

98304:k5HaTOMOct9rFK9MA51EEMwh9jbPBow1oF+QW:khAONQ9RIrnB9S+

Score

10^/10

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
Privateloader family
privateloader

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	JaffaCakes118_9e32c348d19c642c1c2fd6b73213656cf905ea38a623542bd21a48983c90d2b6.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	JaffaCakes118_9e32c348d19c642c1c2fd6b73213656cf905ea38a623542bd21a48983c90d2b6.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	JaffaCakes118_9e32c348d19c642c1c2fd6b73213656cf905ea38a623542bd21a48983c90d2b6.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	JaffaCakes118_9e32c348d19c642c1c2fd6b73213656cf905ea38a623542bd21a48983c90d2b6.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 2856	1832	JaffaCakes118_9e32c348d19c642c1c2fd6b73213656cf905ea38a623542bd21a48983c90d2b6.exe	31
PID 1832 wrote to memory of 2856	1832	JaffaCakes118_9e32c348d19c642c1c2fd6b73213656cf905ea38a623542bd21a48983c90d2b6.exe	31
PID 1832 wrote to memory of 2856	1832	JaffaCakes118_9e32c348d19c642c1c2fd6b73213656cf905ea38a623542bd21a48983c90d2b6.exe	31

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9e32c348d19c642c1c2fd6b73213656cf905ea38a623542bd21a48983c90d2b6.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9e32c348d19c642c1c2fd6b73213656cf905ea38a623542bd21a48983c90d2b6.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1832 -s 396
  2⤵
  PID:2856

memory/1832-1-0x000000013F2D0000-0x000000013FDEE000-memory.dmp

Filesize
11.1MB

Download