privateloader | b4acbc40dd3771dba2042ad78841961dc9e41f7a9ec55e0768354004589a5da2

Analysis

max time kernel
124s
max time network
129s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
29-12-2024 13:33

Target

JaffaCakes118_b4acbc40dd3771dba2042ad78841961dc9e41f7a9ec55e0768354004589a5da2.exe
Size

702.0MB
MD5

49352ed329c86996b5d1ee0a1d2bbfb1
SHA1

46c84bb649cc1021bff016202fdb758a05117cef
SHA256

b4acbc40dd3771dba2042ad78841961dc9e41f7a9ec55e0768354004589a5da2
SHA512

30d4bc2fae9f06447ff1f95467fe09d206ed6da265e591a698dfe6e4d0c02b6b3758ed0b05cb658bbde55238d77222824b59f477c5435d928cf99499d6624846
SSDEEP

98304:dEI1vrDktAlV4TRkhgFNicA/qFC336qEJVSdNHu1GImorT:d1p3ktUV4ligFfA/qjqqIrj

Score

10^/10

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
Privateloader family
privateloader

VMProtect packed file 5 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/2384-6-0x000000013F3D0000-0x00000001400BE000-memory.dmp	vmprotect
behavioral1/memory/2384-18-0x000000013F3D0000-0x00000001400BE000-memory.dmp	vmprotect
behavioral1/memory/2384-17-0x000000013F3D0000-0x00000001400BE000-memory.dmp	vmprotect
behavioral1/memory/2384-20-0x000000013F3D0000-0x00000001400BE000-memory.dmp	vmprotect
behavioral1/memory/2384-21-0x000000013F3D0000-0x00000001400BE000-memory.dmp	vmprotect

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	JaffaCakes118_b4acbc40dd3771dba2042ad78841961dc9e41f7a9ec55e0768354004589a5da2.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	JaffaCakes118_b4acbc40dd3771dba2042ad78841961dc9e41f7a9ec55e0768354004589a5da2.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	JaffaCakes118_b4acbc40dd3771dba2042ad78841961dc9e41f7a9ec55e0768354004589a5da2.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	JaffaCakes118_b4acbc40dd3771dba2042ad78841961dc9e41f7a9ec55e0768354004589a5da2.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2384	JaffaCakes118_b4acbc40dd3771dba2042ad78841961dc9e41f7a9ec55e0768354004589a5da2.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2812	2384	JaffaCakes118_b4acbc40dd3771dba2042ad78841961dc9e41f7a9ec55e0768354004589a5da2.exe	31
PID 2384 wrote to memory of 2812	2384	JaffaCakes118_b4acbc40dd3771dba2042ad78841961dc9e41f7a9ec55e0768354004589a5da2.exe	31
PID 2384 wrote to memory of 2812	2384	JaffaCakes118_b4acbc40dd3771dba2042ad78841961dc9e41f7a9ec55e0768354004589a5da2.exe	31

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b4acbc40dd3771dba2042ad78841961dc9e41f7a9ec55e0768354004589a5da2.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b4acbc40dd3771dba2042ad78841961dc9e41f7a9ec55e0768354004589a5da2.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2384 -s 376
  2⤵
  PID:2812

C:\Windows\System32\GroupPolicy\gpt.ini

Filesize
127B

MD5
8ef9853d1881c5fe4d681bfb31282a01

SHA1
a05609065520e4b4e553784c566430ad9736f19f

SHA256
9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

SHA512
5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

Download Submit
memory/2384-6-0x000000013F3D0000-0x00000001400BE000-memory.dmp

Filesize
12.9MB

Download
memory/2384-18-0x000000013F3D0000-0x00000001400BE000-memory.dmp

Filesize
12.9MB

Download
memory/2384-17-0x000000013F3D0000-0x00000001400BE000-memory.dmp

Filesize
12.9MB

Download
memory/2384-9-0x000000013F748000-0x000000013FA8A000-memory.dmp

Filesize
3.3MB

Download
memory/2384-4-0x0000000077E30000-0x0000000077E32000-memory.dmp

Filesize
8KB

Download
memory/2384-2-0x0000000077E30000-0x0000000077E32000-memory.dmp

Filesize
8KB

Download
memory/2384-0-0x0000000077E30000-0x0000000077E32000-memory.dmp

Filesize
8KB

Download
memory/2384-19-0x000000013F748000-0x000000013FA8A000-memory.dmp

Filesize
3.3MB

Download
memory/2384-20-0x000000013F3D0000-0x00000001400BE000-memory.dmp

Filesize
12.9MB

Download
memory/2384-21-0x000000013F3D0000-0x00000001400BE000-memory.dmp

Filesize
12.9MB

Download