privateloader | 3c405151d59ea76d411aa6898792373cd563324fa3c19afd67f9a0236ab7358b

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/07/2026, 02:35

Target
3c405151d59ea76d411aa6898792373cd563324fa3c19afd67f9a0236ab7358b.exe
Size 2.5MB
Sample260726-c2964aycnf
SHA256 3c405151d59ea76d411aa6898792373cd563324fa3c19afd67f9a0236ab7358b
MD5 55ef16c6bc615a79c09aebdfb6077b39
SHA1 ecce12d8ec9bcb7cbab627c3539e7eb199bc4bb3
SHA512 b7c4acb0bcfd6d26c54bbe992e4def4ba50e00809b133ad8a66053a2cc08208e1c689fe1ce0b2b7775c1f212fbe823b2651202b0888bca900cf46ccc203d7178
SSDEEP 49152:IKkl/M0EOFreudY6+idOP3SmT13QhkMrapZKAZc677HB1+vch5:IKa/3EOFreodOPJZORSZKA9XBU
TLSH
T12CC512842F8A25FFD28BC7788151680FB9677BE3BD23B449678565090E327FA0FB2154
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	3c405151d59ea76d411aa6898792373cd563324fa3c19afd67f9a0236ab7358b.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	3c405151d59ea76d411aa6898792373cd563324fa3c19afd67f9a0236ab7358b.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	3c405151d59ea76d411aa6898792373cd563324fa3c19afd67f9a0236ab7358b.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	3c405151d59ea76d411aa6898792373cd563324fa3c19afd67f9a0236ab7358b.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\logs\StorGroupPolicy.log	svchost.exe

C:\Users\Admin\AppData\Local\Temp\3c405151d59ea76d411aa6898792373cd563324fa3c19afd67f9a0236ab7358b.exe
"C:\Users\Admin\AppData\Local\Temp\3c405151d59ea76d411aa6898792373cd563324fa3c19afd67f9a0236ab7358b.exe"
1⤵
- Drops file in System32 directory
PID:2632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:5648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
- Drops file in Windows directory
PID:3504

memory/2632-0-0x00007FF759200000-0x00007FF759899000-memory.dmp

Download