privateloader | 9e32c348d19c642c1c2fd6b73213656cf905ea38a623542bd21a48983c90d2b6

Analysis

max time kernel
132s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2024, 16:41

Target

JaffaCakes118_9e32c348d19c642c1c2fd6b73213656cf905ea38a623542bd21a48983c90d2b6.exe
Size

691.0MB
MD5

ee9447f4deb0272240facc06567b942c
SHA1

d7e82cfadf985cdfa672ccae8ae1409ca369ab2b
SHA256

9e32c348d19c642c1c2fd6b73213656cf905ea38a623542bd21a48983c90d2b6
SHA512

17d155e8152d59489f88fa563cf02fc86a8c88284d8b7178a2ed9d6d3b57293482d3584aa8605395675aea3188a222e494ed44339ffeb7f33db580b894e7db17
SSDEEP

98304:k5HaTOMOct9rFK9MA51EEMwh9jbPBow1oF+QW:khAONQ9RIrnB9S+

Score

10^/10

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
Privateloader family
privateloader

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	JaffaCakes118_9e32c348d19c642c1c2fd6b73213656cf905ea38a623542bd21a48983c90d2b6.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	JaffaCakes118_9e32c348d19c642c1c2fd6b73213656cf905ea38a623542bd21a48983c90d2b6.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	JaffaCakes118_9e32c348d19c642c1c2fd6b73213656cf905ea38a623542bd21a48983c90d2b6.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	JaffaCakes118_9e32c348d19c642c1c2fd6b73213656cf905ea38a623542bd21a48983c90d2b6.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9e32c348d19c642c1c2fd6b73213656cf905ea38a623542bd21a48983c90d2b6.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9e32c348d19c642c1c2fd6b73213656cf905ea38a623542bd21a48983c90d2b6.exe"
1⤵
- Drops file in System32 directory
PID:1868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:2404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:2896

memory/1868-0-0x00007FF6ABB10000-0x00007FF6AC62E000-memory.dmp

Filesize
11.1MB

Download