Overview

overview

7

Static

static

3

privateAss....4.exe

windows11-21h2-x64

7

$PLUGINSDI...er.dll

windows11-21h2-x64

3

$PLUGINSDI...ls.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...ll.dll

windows11-21h2-x64

3

$PLUGINSDIR/app-32.7z

windows11-21h2-x64

1

privateAss...er.exe

windows11-21h2-x64

4

resources/elevate.exe

windows11-21h2-x64

3

vk_swiftshader.dll

windows11-21h2-x64

3

vulkan-1.dll

windows11-21h2-x64

3

$PLUGINSDIR/app-64.7z

windows11-21h2-x64

1

LICENSES.c...m.html

windows11-21h2-x64

4

d3dcompiler_47.dll

windows11-21h2-x64

1

ffmpeg.dll

windows11-21h2-x64

1

libEGL.dll

windows11-21h2-x64

1

libGLESv2.dll

windows11-21h2-x64

1

privateAss...er.exe

windows11-21h2-x64

4

resources/elevate.exe

windows11-21h2-x64

3

vk_swiftshader.dll

windows11-21h2-x64

1

vulkan-1.dll

windows11-21h2-x64

1

$PLUGINSDI...m64.7z

windows11-21h2-x64

1

LICENSES.c...m.html

windows11-21h2-x64

4

d3dcompiler_47.dll

windows11-21h2-x64

1

ffmpeg.dll

windows11-21h2-x64

1

libEGL.dll

windows11-21h2-x64

1

libGLESv2.dll

windows11-21h2-x64

1

privateAss...er.exe

windows11-21h2-x64

resources/elevate.exe

windows11-21h2-x64

3

vk_swiftshader.dll

windows11-21h2-x64

1

$PLUGINSDI...ec.dll

windows11-21h2-x64

3

$PLUGINSDI...7z.dll

windows11-21h2-x64

3

$R0/Uninst...er.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    03/06/2026, 22:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    privateAssetDownloader.exe
  • Size 152.4MB
  • Sample260603-2bt5maez21
  • SHA256 b77300c8996951c72cf4757067feb0cb1a92271441b0b1dae2a3ecdee0cc9ee0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
discovery

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\privateAssetDownloader.exe
    "C:\Users\Admin\AppData\Local\Temp\privateAssetDownloader.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2312
    • C:\Users\Admin\AppData\Local\Temp\privateAssetDownloader.exe
      "C:\Users\Admin\AppData\Local\Temp\privateAssetDownloader.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\privateassetdownloader" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1728,i,1690056417988534516,10392487520906564027,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1720 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3292
    • C:\Users\Admin\AppData\Local\Temp\privateAssetDownloader.exe
      "C:\Users\Admin\AppData\Local\Temp\privateAssetDownloader.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\privateassetdownloader" --field-trial-handle=2096,i,1690056417988534516,10392487520906564027,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:11
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4376
    • C:\Users\Admin\AppData\Local\Temp\privateAssetDownloader.exe
      "C:\Users\Admin\AppData\Local\Temp\privateAssetDownloader.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\privateassetdownloader" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2492,i,1690056417988534516,10392487520906564027,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2608
    • C:\Users\Admin\AppData\Local\Temp\privateAssetDownloader.exe
      "C:\Users\Admin\AppData\Local\Temp\privateAssetDownloader.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\privateassetdownloader" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=3336,i,1690056417988534516,10392487520906564027,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1644 /prefetch:10
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2104

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        default.dic
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
        • Size 2B
        • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
        • MD5 SHA1 SHA512
        Submit Download

        memory/2104-65-0x000000000FA60000-0x000000000FA61000-memory.dmp
        Download

        memory/2104-67-0x000000000FA60000-0x000000000FA61000-memory.dmp
        Download

        memory/2104-66-0x000000000FA60000-0x000000000FA61000-memory.dmp
        Download

        memory/2104-71-0x000000000FA60000-0x000000000FA61000-memory.dmp
        Download

        memory/2104-74-0x000000000FA60000-0x000000000FA61000-memory.dmp
        Download

        memory/2104-77-0x000000000FA60000-0x000000000FA61000-memory.dmp
        Download

        memory/2104-76-0x000000000FA60000-0x000000000FA61000-memory.dmp
        Download

        memory/2104-75-0x000000000FA60000-0x000000000FA61000-memory.dmp
        Download

        memory/2104-73-0x000000000FA60000-0x000000000FA61000-memory.dmp
        Download

        memory/2104-72-0x000000000FA60000-0x000000000FA61000-memory.dmp
        Download