Analysis
- user interaction
yes - max time kernel
300s - max time network
303s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
03/08/2026, 02:57
General
- Target 26317000001034282304setup.exe
- Size 23.5MB
- Sample260803-dfp5gabl2s
- SHA256 70223b2ef27056e400c839a07863ef6236c0ac7a10c287a45fe9fd4001d0bb13
Malware Config
Signatures
- Family: PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
- Drops file in Drivers directory 9 IoCs
- Executes dropped EXE 20 IoCs
- Loads dropped DLL 20 IoCs
- Checks whether UAC is enabled 1 TTPs 18 IoCs
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 38 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 36 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 18 IoCs
- Suspicious use of AdjustPrivilegeToken 60 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\26317000001034282304setup.exe"C:\Users\Admin\AppData\Local\Temp\26317000001034282304setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf7_temp_0\irsetup.exe__IRAOFF:520716 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\26317000001034282304setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Cediaineo\External.exe"C:\Program Files (x86)\Cediaineo\External.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\External.exe"C:\Users\Admin\AppData\Local\Microsoft\External.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\External.exe"C:\Users\Admin\AppData\Local\Microsoft\External.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Microsoft\External.exe"C:\Users\Admin\AppData\Local\Microsoft\External.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe/c copy /Y "C:\ProgramData\amdgpio2.tmp" "C:\Windows\System32\drivers\amdgpio2.sys"1⤵
- Drops file in Drivers directory
-
C:\Windows\System32\cmd.exe/c copy /Y "C:\ProgramData\amdi2c.tmp" "C:\Windows\System32\drivers\amdi2c.sys"1⤵
- Drops file in Drivers directory
-
C:\Users\Admin\AppData\Local\Microsoft\External.exe"C:\Users\Admin\AppData\Local\Microsoft\External.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Microsoft\External.exe"C:\Users\Admin\AppData\Local\Microsoft\External.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe/c copy /Y "C:\ProgramData\bcmfn2.tmp" "C:\Windows\System32\drivers\bcmfn2.sys"1⤵
- Drops file in Drivers directory
-
C:\Users\Admin\AppData\Local\Microsoft\External.exe"C:\Users\Admin\AppData\Local\Microsoft\External.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe/c copy /Y "C:\ProgramData\cht4vbd.tmp" "C:\Windows\System32\drivers\cht4vx64.sys"1⤵
- Drops file in Drivers directory
-
C:\Users\Admin\AppData\Local\Microsoft\External.exe"C:\Users\Admin\AppData\Local\Microsoft\External.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe/c copy /Y "C:\ProgramData\iai2c.tmp" "C:\Windows\System32\drivers\iai2c.sys"1⤵
- Drops file in Drivers directory
-
C:\Users\Admin\AppData\Local\Microsoft\External.exe"C:\Users\Admin\AppData\Local\Microsoft\External.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Microsoft\External.exe"C:\Users\Admin\AppData\Local\Microsoft\External.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe/c copy /Y "C:\ProgramData\iaLPSS2i_GPIO2_CNL.tmp" "C:\Windows\System32\drivers\iaLPSS2i_GPIO2_CNL.sys"1⤵
- Drops file in Drivers directory
-
C:\Users\Admin\AppData\Local\Microsoft\External.exe"C:\Users\Admin\AppData\Local\Microsoft\External.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe/c copy /Y "C:\ProgramData\iaLPSS2i_GPIO2_GLK.tmp" "C:\Windows\System32\drivers\iaLPSS2i_GPIO2_GLK.sys"1⤵
- Drops file in Drivers directory
-
C:\Users\Admin\AppData\Local\Microsoft\External.exe"C:\Users\Admin\AppData\Local\Microsoft\External.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Microsoft\External.exe"C:\Users\Admin\AppData\Local\Microsoft\External.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Microsoft\External.exe"C:\Users\Admin\AppData\Local\Microsoft\External.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe/c copy /Y "C:\ProgramData\iaLPSS2i_I2C.tmp" "C:\Windows\System32\drivers\iaLPSS2i_I2C.sys"1⤵
- Drops file in Drivers directory
-
C:\Users\Admin\AppData\Local\Microsoft\External.exe"C:\Users\Admin\AppData\Local\Microsoft\External.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe/c copy /Y "C:\ProgramData\iaLPSS2i_I2C_BXT_P.tmp" "C:\Windows\System32\drivers\iaLPSS2i_I2C_BXT_P.sys"1⤵
- Drops file in Drivers directory
-
C:\Users\Admin\AppData\Local\Microsoft\External.exe"C:\Users\Admin\AppData\Local\Microsoft\External.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Microsoft\External.exe"C:\Users\Admin\AppData\Local\Microsoft\External.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Microsoft\External.exe"C:\Users\Admin\AppData\Local\Microsoft\External.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Microsoft\External.exe"C:\Users\Admin\AppData\Local\Microsoft\External.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Detection.dll
External.exe
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
cloudmusic.dll
libEGL.dll
libcef.dll
locale.dat
ssl_ciphers.cache
vcruntime140.dll
qmgr.db
qmgr.db
qmgr.db
qmgr.db
qmgr.jfm
qmgr.jfm
qmgr.jfm
bits_debug.log
bits_debug.log
bits_debug.log
irsetup.exe
531448be31c23ef2e3aa35d5ebd39b8f
amdgpio2.sys
memory/1416-273-0x00000000051C0000-0x00000000051C4000-memory.dmp
memory/1416-341-0x0000000004800000-0x0000000004804000-memory.dmp
memory/1416-122-0x0000000003110000-0x0000000003112000-memory.dmp
memory/1416-124-0x0000000004EE0000-0x0000000004EF0000-memory.dmp
memory/1416-132-0x00000000050A0000-0x00000000050B0000-memory.dmp
memory/1416-156-0x0000000006110000-0x0000000006114000-memory.dmp
memory/1416-158-0x0000000006190000-0x0000000006194000-memory.dmp
memory/1416-159-0x0000000006190000-0x0000000006194000-memory.dmp
memory/1416-163-0x0000000072ED0000-0x00000000741E7000-memory.dmp
memory/1416-165-0x0000000006110000-0x0000000007427000-memory.dmp
memory/1416-169-0x0000000072ED0000-0x00000000741E7000-memory.dmp
memory/1416-171-0x00000000035F0000-0x00000000035F2000-memory.dmp
memory/1416-173-0x0000000072ED0000-0x00000000741E7000-memory.dmp
memory/1416-174-0x0000000006110000-0x0000000007427000-memory.dmp
memory/1416-176-0x00000000035F0000-0x00000000035F2000-memory.dmp
memory/1416-116-0x0000000003110000-0x0000000003112000-memory.dmp
memory/1416-227-0x0000000005140000-0x0000000005144000-memory.dmp
memory/1416-229-0x00000000051C0000-0x00000000051C4000-memory.dmp
memory/1416-230-0x00000000051C0000-0x00000000051C4000-memory.dmp
memory/1416-103-0x0000000003110000-0x0000000003112000-memory.dmp
memory/1416-239-0x0000000072ED0000-0x00000000741E7000-memory.dmp
memory/1416-240-0x0000000006110000-0x0000000007427000-memory.dmp
memory/1416-271-0x0000000005140000-0x0000000005144000-memory.dmp
memory/1416-102-0x0000000072ED0000-0x00000000741E7000-memory.dmp
memory/1416-274-0x00000000051C0000-0x00000000051C4000-memory.dmp
memory/1416-278-0x0000000072ED0000-0x00000000741E7000-memory.dmp
memory/1416-279-0x0000000006110000-0x0000000007427000-memory.dmp
memory/1416-91-0x0000000002AF0000-0x0000000002B61000-memory.dmp
memory/1416-92-0x0000000072ED0000-0x00000000741E7000-memory.dmp
memory/1416-97-0x0000000072ED1000-0x0000000072F15000-memory.dmp
memory/1416-99-0x0000000002AF0000-0x0000000002B61000-memory.dmp
memory/1416-98-0x0000000072ED0000-0x00000000741E7000-memory.dmp
memory/1416-471-0x00000000051D0000-0x00000000051D4000-memory.dmp
memory/1416-310-0x0000000006110000-0x0000000007427000-memory.dmp
memory/1416-101-0x0000000003110000-0x0000000003112000-memory.dmp
memory/1416-467-0x0000000004A50000-0x0000000004A54000-memory.dmp
memory/1416-119-0x0000000003740000-0x0000000004A57000-memory.dmp
memory/1416-343-0x0000000004F40000-0x0000000004F44000-memory.dmp
memory/1416-344-0x0000000004F40000-0x0000000004F44000-memory.dmp
memory/1416-470-0x00000000051D0000-0x00000000051D4000-memory.dmp
memory/1416-351-0x0000000072ED0000-0x00000000741E7000-memory.dmp
memory/1416-352-0x0000000006110000-0x0000000007427000-memory.dmp
memory/1416-441-0x0000000006110000-0x0000000007427000-memory.dmp
memory/1416-440-0x0000000072ED0000-0x00000000741E7000-memory.dmp
memory/1416-404-0x0000000006110000-0x0000000007427000-memory.dmp
memory/1416-396-0x0000000004800000-0x0000000004804000-memory.dmp
memory/1416-398-0x0000000004F40000-0x0000000004F44000-memory.dmp
memory/1416-399-0x0000000004F40000-0x0000000004F44000-memory.dmp
memory/1416-403-0x0000000072ED0000-0x00000000741E7000-memory.dmp
memory/1948-89-0x0000000000400000-0x0000000000527000-memory.dmp
memory/1948-4-0x0000000000400000-0x0000000000527000-memory.dmp
memory/1948-5-0x0000000000526000-0x0000000000527000-memory.dmp
memory/2060-468-0x00000000023D0000-0x00000000023D2000-memory.dmp
memory/2060-431-0x00000000023D0000-0x00000000023D2000-memory.dmp
memory/2060-438-0x00000000023D0000-0x00000000023D2000-memory.dmp
memory/2060-417-0x0000000072ED0000-0x00000000741E7000-memory.dmp
memory/2060-430-0x00000000023D0000-0x00000000023D2000-memory.dmp
memory/2060-443-0x0000000003100000-0x0000000004417000-memory.dmp
memory/2060-479-0x0000000004740000-0x0000000005A57000-memory.dmp
memory/4084-306-0x0000000003EF0000-0x0000000005207000-memory.dmp
memory/4084-314-0x0000000072ED0000-0x00000000741E7000-memory.dmp
memory/4084-349-0x0000000003E80000-0x0000000005197000-memory.dmp
memory/4084-480-0x0000000072ED0000-0x00000000741E7000-memory.dmp
memory/4084-303-0x00000000030F0000-0x00000000030F2000-memory.dmp
memory/4084-300-0x00000000030F0000-0x00000000030F2000-memory.dmp
memory/4084-293-0x00000000030F0000-0x00000000030F2000-memory.dmp
memory/4084-292-0x00000000030F0000-0x00000000030F2000-memory.dmp
memory/4084-287-0x0000000072ED0000-0x00000000741E7000-memory.dmp
memory/4084-359-0x0000000072ED0000-0x00000000741E7000-memory.dmp
memory/4084-360-0x0000000003E80000-0x0000000005197000-memory.dmp
memory/4512-361-0x0000000072ED0000-0x00000000741E7000-memory.dmp
memory/4512-405-0x0000000072ED0000-0x00000000741E7000-memory.dmp