privateloader | 011e18ab0139035119a50b38b3a4247cd18a4f3611f6ca62252186079075504d

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
29/12/2024, 10:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_011e18ab0139035119a50b38b3a4247cd18a4f3611f6ca62252186079075504d.exe
Size

657.0MB
MD5

1c066eeb570a13e903521d6089b2ae23
SHA1

4793865493aa7be0eb7fbfc7f8d0dd9d8433f4dd
SHA256

011e18ab0139035119a50b38b3a4247cd18a4f3611f6ca62252186079075504d
SHA512

35bfc85d03a09ed59a1506b86c1f60e5d554a49d0bdfbff3ae325853c7debf53e130225fa14db00069545cffe3001721c268317a6c5ddf00abb248cdecc6dcc2
SSDEEP

98304:jSLuk76B0Ml8QpvUe8TEVJ1/+3ZGEYYEmVcYKfUqC86pM:jSLuay6QpMe8A23Z7PVcsqx6p

Score

10^/10

privateloader loader vmprotect

Malware Config

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
Privateloader family
privateloader

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/1748-31-0x000000013F2B0000-0x000000013FECF000-memory.dmp	vmprotect

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	JaffaCakes118_011e18ab0139035119a50b38b3a4247cd18a4f3611f6ca62252186079075504d.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	JaffaCakes118_011e18ab0139035119a50b38b3a4247cd18a4f3611f6ca62252186079075504d.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	JaffaCakes118_011e18ab0139035119a50b38b3a4247cd18a4f3611f6ca62252186079075504d.exe
File opened for modification	C:\Windows\System32\GroupPolicy	JaffaCakes118_011e18ab0139035119a50b38b3a4247cd18a4f3611f6ca62252186079075504d.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1748	JaffaCakes118_011e18ab0139035119a50b38b3a4247cd18a4f3611f6ca62252186079075504d.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 3016	1748	JaffaCakes118_011e18ab0139035119a50b38b3a4247cd18a4f3611f6ca62252186079075504d.exe	31
PID 1748 wrote to memory of 3016	1748	JaffaCakes118_011e18ab0139035119a50b38b3a4247cd18a4f3611f6ca62252186079075504d.exe	31
PID 1748 wrote to memory of 3016	1748	JaffaCakes118_011e18ab0139035119a50b38b3a4247cd18a4f3611f6ca62252186079075504d.exe	31

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_011e18ab0139035119a50b38b3a4247cd18a4f3611f6ca62252186079075504d.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_011e18ab0139035119a50b38b3a4247cd18a4f3611f6ca62252186079075504d.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1748 -s 392
  2⤵
  PID:3016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\GroupPolicy\gpt.ini

Filesize
127B

MD5
8ef9853d1881c5fe4d681bfb31282a01

SHA1
a05609065520e4b4e553784c566430ad9736f19f

SHA256
9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

SHA512
5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

Download Submit
memory/1748-13-0x0000000077C10000-0x0000000077C12000-memory.dmp

Filesize
8KB

Download
memory/1748-11-0x0000000077C10000-0x0000000077C12000-memory.dmp

Filesize
8KB

Download
memory/1748-0-0x0000000077BF0000-0x0000000077BF2000-memory.dmp

Filesize
8KB

Download
memory/1748-5-0x000000013F618000-0x000000013F913000-memory.dmp

Filesize
3.0MB

Download
memory/1748-6-0x0000000077C00000-0x0000000077C02000-memory.dmp

Filesize
8KB

Download
memory/1748-20-0x0000000077C20000-0x0000000077C22000-memory.dmp

Filesize
8KB

Download
memory/1748-18-0x0000000077C20000-0x0000000077C22000-memory.dmp

Filesize
8KB

Download
memory/1748-16-0x0000000077C20000-0x0000000077C22000-memory.dmp

Filesize
8KB

Download
memory/1748-2-0x0000000077BF0000-0x0000000077BF2000-memory.dmp

Filesize
8KB

Download
memory/1748-15-0x0000000077C10000-0x0000000077C12000-memory.dmp

Filesize
8KB

Download
memory/1748-8-0x0000000077C00000-0x0000000077C02000-memory.dmp

Filesize
8KB

Download
memory/1748-10-0x0000000077C00000-0x0000000077C02000-memory.dmp

Filesize
8KB

Download
memory/1748-28-0x000007FEFDA70000-0x000007FEFDA72000-memory.dmp

Filesize
8KB

Download
memory/1748-25-0x000007FEFDA60000-0x000007FEFDA62000-memory.dmp

Filesize
8KB

Download
memory/1748-23-0x000007FEFDA60000-0x000007FEFDA62000-memory.dmp

Filesize
8KB

Download
memory/1748-30-0x000007FEFDA70000-0x000007FEFDA72000-memory.dmp

Filesize
8KB

Download
memory/1748-31-0x000000013F2B0000-0x000000013FECF000-memory.dmp

Filesize
12.1MB

Download
memory/1748-4-0x0000000077BF0000-0x0000000077BF2000-memory.dmp

Filesize
8KB

Download
memory/1748-42-0x000000013F618000-0x000000013F913000-memory.dmp

Filesize
3.0MB

Download