privateloader | 6d0d02d23acb1d9763c183bd2a2c5791af4c64964262af241c716b2edcd2d1f8

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-12-2024 06:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_6d0d02d23acb1d9763c183bd2a2c5791af4c64964262af241c716b2edcd2d1f8.exe
Size

655.0MB
MD5

3c579d601ce3840afad9bbbf3b720ae3
SHA1

e29a2f27111e4fe3342ef19a7269a031957b7a62
SHA256

6d0d02d23acb1d9763c183bd2a2c5791af4c64964262af241c716b2edcd2d1f8
SHA512

3d4893cbb4b0b0bc91c390a8462f537eaa5c7f3bc45bdfa1a16380371108fefa1db920ebba6b8c3038071b78ae281d35e22368ca334b6bf2bfdda19d900bd1ac
SSDEEP

98304:h2PrQwDV4h9PCR7dYskHmyA8dVZQFWTzIDalBsH4XiupIwaLXu8sFppzv:h2PtV4bPCNdYsCACVZR4DalBVX30SLp

Score

10^/10

privateloader loader vmprotect

Malware Config

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
Privateloader family
privateloader

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/2840-31-0x000000013F0C0000-0x000000013FCED000-memory.dmp	vmprotect

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	JaffaCakes118_6d0d02d23acb1d9763c183bd2a2c5791af4c64964262af241c716b2edcd2d1f8.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	JaffaCakes118_6d0d02d23acb1d9763c183bd2a2c5791af4c64964262af241c716b2edcd2d1f8.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	JaffaCakes118_6d0d02d23acb1d9763c183bd2a2c5791af4c64964262af241c716b2edcd2d1f8.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	JaffaCakes118_6d0d02d23acb1d9763c183bd2a2c5791af4c64964262af241c716b2edcd2d1f8.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2840	JaffaCakes118_6d0d02d23acb1d9763c183bd2a2c5791af4c64964262af241c716b2edcd2d1f8.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 2892	2840	JaffaCakes118_6d0d02d23acb1d9763c183bd2a2c5791af4c64964262af241c716b2edcd2d1f8.exe	30
PID 2840 wrote to memory of 2892	2840	JaffaCakes118_6d0d02d23acb1d9763c183bd2a2c5791af4c64964262af241c716b2edcd2d1f8.exe	30
PID 2840 wrote to memory of 2892	2840	JaffaCakes118_6d0d02d23acb1d9763c183bd2a2c5791af4c64964262af241c716b2edcd2d1f8.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6d0d02d23acb1d9763c183bd2a2c5791af4c64964262af241c716b2edcd2d1f8.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6d0d02d23acb1d9763c183bd2a2c5791af4c64964262af241c716b2edcd2d1f8.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2840 -s 176
  2⤵
  PID:2892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2840-15-0x000000013F428000-0x000000013F722000-memory.dmp

Filesize
3.0MB

Download
memory/2840-14-0x00000000775D0000-0x00000000775D2000-memory.dmp

Filesize
8KB

Download
memory/2840-12-0x00000000775D0000-0x00000000775D2000-memory.dmp

Filesize
8KB

Download
memory/2840-10-0x00000000775D0000-0x00000000775D2000-memory.dmp

Filesize
8KB

Download
memory/2840-9-0x00000000775C0000-0x00000000775C2000-memory.dmp

Filesize
8KB

Download
memory/2840-7-0x00000000775C0000-0x00000000775C2000-memory.dmp

Filesize
8KB

Download
memory/2840-5-0x00000000775C0000-0x00000000775C2000-memory.dmp

Filesize
8KB

Download
memory/2840-4-0x00000000775B0000-0x00000000775B2000-memory.dmp

Filesize
8KB

Download
memory/2840-2-0x00000000775B0000-0x00000000775B2000-memory.dmp

Filesize
8KB

Download
memory/2840-0-0x00000000775B0000-0x00000000775B2000-memory.dmp

Filesize
8KB

Download
memory/2840-30-0x000007FEFD2E0000-0x000007FEFD2E2000-memory.dmp

Filesize
8KB

Download
memory/2840-28-0x000007FEFD2E0000-0x000007FEFD2E2000-memory.dmp

Filesize
8KB

Download
memory/2840-25-0x000007FEFD2D0000-0x000007FEFD2D2000-memory.dmp

Filesize
8KB

Download
memory/2840-23-0x000007FEFD2D0000-0x000007FEFD2D2000-memory.dmp

Filesize
8KB

Download
memory/2840-20-0x00000000775E0000-0x00000000775E2000-memory.dmp

Filesize
8KB

Download
memory/2840-18-0x00000000775E0000-0x00000000775E2000-memory.dmp

Filesize
8KB

Download
memory/2840-16-0x00000000775E0000-0x00000000775E2000-memory.dmp

Filesize
8KB

Download
memory/2840-31-0x000000013F0C0000-0x000000013FCED000-memory.dmp

Filesize
12.2MB

Download
memory/2840-42-0x000000013F428000-0x000000013F722000-memory.dmp

Filesize
3.0MB

Download