privateloader | 493a03d593db0e285796a53f12cbb0bd23686c45bda99c7e8b38d4c32c65bdff

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29-12-2024 01:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_493a03d593db0e285796a53f12cbb0bd23686c45bda99c7e8b38d4c32c65bdff.exe
Size

675.0MB
MD5

b34566c6cbe042bec91bdf846196b131
SHA1

67f4bf9b318bc129ad67c60e5ab3e461a683f3ac
SHA256

493a03d593db0e285796a53f12cbb0bd23686c45bda99c7e8b38d4c32c65bdff
SHA512

38f50de7a5674f386459bfc5f33a1396f2b1f45a487457cbb30d18dbd5d0723d1c90c3d08d19ed73e40520eb5efa0e1e71769efc2c9490af511ece4bbfb56b0c
SSDEEP

196608:zcl7360bbXb2BAWyMYmjY7WLkJv9DOSFtRNyWai0TckzbHyo2pkdyhjSN:zkKEXb2BAWyMYmYXbT0TcubH8Uy

Score

10^/10

privateloader loader

Malware Config

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
Privateloader family
privateloader

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	JaffaCakes118_493a03d593db0e285796a53f12cbb0bd23686c45bda99c7e8b38d4c32c65bdff.exe
File opened for modification	C:\Windows\System32\GroupPolicy	JaffaCakes118_493a03d593db0e285796a53f12cbb0bd23686c45bda99c7e8b38d4c32c65bdff.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	JaffaCakes118_493a03d593db0e285796a53f12cbb0bd23686c45bda99c7e8b38d4c32c65bdff.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	JaffaCakes118_493a03d593db0e285796a53f12cbb0bd23686c45bda99c7e8b38d4c32c65bdff.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1820	JaffaCakes118_493a03d593db0e285796a53f12cbb0bd23686c45bda99c7e8b38d4c32c65bdff.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 2648	1820	JaffaCakes118_493a03d593db0e285796a53f12cbb0bd23686c45bda99c7e8b38d4c32c65bdff.exe	31
PID 1820 wrote to memory of 2648	1820	JaffaCakes118_493a03d593db0e285796a53f12cbb0bd23686c45bda99c7e8b38d4c32c65bdff.exe	31
PID 1820 wrote to memory of 2648	1820	JaffaCakes118_493a03d593db0e285796a53f12cbb0bd23686c45bda99c7e8b38d4c32c65bdff.exe	31

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_493a03d593db0e285796a53f12cbb0bd23686c45bda99c7e8b38d4c32c65bdff.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_493a03d593db0e285796a53f12cbb0bd23686c45bda99c7e8b38d4c32c65bdff.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1820 -s 392
  2⤵
  PID:2648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\GroupPolicy\gpt.ini

Filesize
127B

MD5
8ef9853d1881c5fe4d681bfb31282a01

SHA1
a05609065520e4b4e553784c566430ad9736f19f

SHA256
9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

SHA512
5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

Download Submit
memory/1820-16-0x0000000076FD0000-0x0000000076FD2000-memory.dmp

Filesize
8KB

Download
memory/1820-42-0x000000013F68D000-0x000000013FA67000-memory.dmp

Filesize
3.9MB

Download
memory/1820-0-0x0000000076FA0000-0x0000000076FA2000-memory.dmp

Filesize
8KB

Download
memory/1820-9-0x0000000076FB0000-0x0000000076FB2000-memory.dmp

Filesize
8KB

Download
memory/1820-7-0x0000000076FB0000-0x0000000076FB2000-memory.dmp

Filesize
8KB

Download
memory/1820-5-0x0000000076FB0000-0x0000000076FB2000-memory.dmp

Filesize
8KB

Download
memory/1820-4-0x0000000076FA0000-0x0000000076FA2000-memory.dmp

Filesize
8KB

Download
memory/1820-2-0x0000000076FA0000-0x0000000076FA2000-memory.dmp

Filesize
8KB

Download
memory/1820-10-0x0000000076FC0000-0x0000000076FC2000-memory.dmp

Filesize
8KB

Download
memory/1820-14-0x0000000076FC0000-0x0000000076FC2000-memory.dmp

Filesize
8KB

Download
memory/1820-28-0x000007FEFCEA0000-0x000007FEFCEA2000-memory.dmp

Filesize
8KB

Download
memory/1820-30-0x000007FEFCEA0000-0x000007FEFCEA2000-memory.dmp

Filesize
8KB

Download
memory/1820-25-0x000007FEFCE90000-0x000007FEFCE92000-memory.dmp

Filesize
8KB

Download
memory/1820-23-0x000007FEFCE90000-0x000007FEFCE92000-memory.dmp

Filesize
8KB

Download
memory/1820-20-0x0000000076FD0000-0x0000000076FD2000-memory.dmp

Filesize
8KB

Download
memory/1820-18-0x0000000076FD0000-0x0000000076FD2000-memory.dmp

Filesize
8KB

Download
memory/1820-15-0x000000013F68D000-0x000000013FA67000-memory.dmp

Filesize
3.9MB

Download
memory/1820-31-0x000000013F330000-0x0000000140069000-memory.dmp

Filesize
13.2MB

Download
memory/1820-12-0x0000000076FC0000-0x0000000076FC2000-memory.dmp

Filesize
8KB

Download