PrivateDMA-Loader[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
PrivateDMA-Loader.exe
Size 17.7MB
Sample261024-rnkrlszv3p
SHA256 abff8cdfdfdb24a47516abe016f344d7c20508f3368911bd168818a0c4bdb452
MD5 246e722e2f6f77a3535c0918ebbe77c7
SHA1 41e8c469ec852deec4c20076d545f5e61b7c5841
SHA512 df71ab4de8bfc25aa09d759f5c65e1239b552d2ac5e9fbbd75ea74d73660bbe05ef06be1fa081628af5f39e85c829add628c2bf7fb08569b693705a95a19b396
SSDEEP 98304:NwIRQFnFguP7mO0IXgBjFjKE/N5pAJG6VTC6z57RYYF7/s9x999ZDhEUsRuPbjDI:qIEF57XgbKi+IEC6z57RNOvrZiUsYv
TLSH
T18617AE32B1A401EDD076D0B4D626BE53EF35708A033069E713E055762FAB9E49EBF621
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PrivateDMA-Loader.exe

File Explorer

PrivateDMA-Loader.exe

.exe 17.7MB

PrivateDMA-Loader.exe

IMPHASH 40827bea8c1cee99b0d9d9b16a78f5d2
SHA256 abff8cdfdfdb24a47516abe016f344d7c20508f3368911bd168818a0c4bdb452
MD5 246e722e2f6f77a3535c0918ebbe77c7
SHA1 41e8c469ec852deec4c20076d545f5e61b7c5841
SHA512 df71ab4de8bfc25aa09d759f5c65e1239b552d2ac5e9fbbd75ea74d73660bbe05ef06be1fa081628af5f39e85c829add628c2bf7fb08569b693705a95a19b396
SSDEEP 98304:NwIRQFnFguP7mO0IXgBjFjKE/N5pAJG6VTC6z57RYYF7/s9x999ZDhEUsRuPbjDI:qIEF57XgbKi+IEC6z57RNOvrZiUsYv
TLSH
T18617AE32B1A401EDD076D0B4D626BE53EF35708A033069E713E055762FAB9E49EBF621
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10241984

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDevice D3D11CreateDeviceAndSwapChain

dxgi

CreateDXGIFactory2 CreateDXGIFactory1

d3dcompiler_47

D3DCompile

d2d1

ord2 ord1 ord12

dwrite

DWriteCreateFactory

ole32

CreateStreamOnHGlobal CoTaskMemFree CoCreateInstance CoInitializeEx CoUninitialize GetHGlobalFromStream

winmm

timeGetDevCaps timeEndPeriod timeBeginPeriod

ws2_32

WSAGetLastError closesocket connect ioctlsocket getsockopt htonl htons ntohl socket WSAStartup WSACleanup WSAPoll accept bind getsockname listen recv sendto select recvfrom ntohs inet_ntop inet_pton shutdown setsockopt send

iphlpapi

FreeMibTable GetIpNetTable2 GetAdaptersAddresses SendARP

bcrypt

BCryptHashData BCryptOpenAlgorithmProvider BCryptFinishHash BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptGetProperty BCryptCreateHash

crypt32

CryptBinaryToStringA CryptProtectData CryptUnprotectData CryptStringToBinaryA CertGetNameStringW

shell32

ShellExecuteA SHGetKnownFolderPath SHCreateDirectoryExW ShellExecuteW

winhttp

WinHttpReadData WinHttpQueryDataAvailable WinHttpSetTimeouts WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest WinHttpReceiveResponse WinHttpCrackUrl WinHttpConnect WinHttpOpen WinHttpCloseHandle WinHttpQueryHeaders

dwmapi

DwmSetWindowAttribute DwmExtendFrameIntoClientArea

wintrust

WTHelperGetProvSignerFromChain WinVerifyTrust WTHelperProvDataFromStateData

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

setupapi

SetupDiGetDevicePropertyW SetupDiGetClassDevsA SetupDiGetDeviceRegistryPropertyA SetupDiOpenDevRegKey SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupIterateCabinetW SetupDiGetClassDevsW

kernel32

GetCommandLineW GetCommandLineA ExitProcess GetStdHandle UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind HeapAlloc IsProcessorFeaturePresent FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue HeapFree VirtualProtect RtlCaptureContext FlsAlloc InterlockedPushEntrySList RtlUnwindEx RtlLookupFunctionEntry GetStartupInfoW InitializeSListHead GetCPInfo EnumSystemLocalesW GetFileType GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleOutputCP GetStringTypeW LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns InitOnceComplete InitOnceBeginInitialize WakeAllConditionVariable WakeConditionVariable RaiseException RtlPcToFileHeader GetFileInformationByHandleEx CopyFile2 AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFinalPathNameByHandleW GetFileInformationByHandle FindFirstFileExW GetLocaleInfoEx SleepConditionVariableSRW GetEnvironmentVariableA GetEnvironmentVariableW SetEnvironmentVariableW GetFileAttributesW CloseHandle SetUnhandledExceptionFilter GetLastError SetLastError QueryPerformanceCounter GetFileSizeEx CreateMutexW Sleep GetCurrentProcess GetCurrentProcessId CompareStringW OpenProcess GetTickCount64 GetModuleFileNameW GetModuleHandleW GetProcAddress QueryFullProcessImageNameW MultiByteToWideChar WideCharToMultiByte AllocConsole AttachConsole SetConsoleCtrlHandler DeleteFileW FindClose FindFirstFileA FindNextFileA GetFileAttributesA GetCurrentThread SetThreadPriority GlobalMemoryStatusEx GetModuleFileNameA MoveFileExW K32GetProcessMemoryInfo CreateDirectoryW WaitForSingleObject SetWaitableTimerEx CreateWaitableTimerExW FreeLibrary GetModuleHandleA LoadLibraryExW LoadLibraryW SetEnvironmentVariableA CreateFileW FindFirstFileW ReadFile GetVolumeInformationA GetWindowsDirectoryA LocalFree GetComputerNameW GetSystemTimeAsFileTime TerminateProcess GetExitCodeProcess CreateProcessW GetSystemDirectoryW FormatMessageA FileTimeToSystemTime CopyFileW RtlCaptureStackBackTrace CreateFileA SetErrorMode GetCurrentThreadId SetThreadStackGuarantee GetLocalTime GetModuleHandleExW SetHandleInformation CreatePipe PeekNamedPipe ResumeThread CreateJobObjectW AssignProcessToJobObject SetInformationJobObject WriteFile GetOverlappedResult CancelIoEx ResetEvent CreateEventW SetupComm EscapeCommFunction GetCommState PurgeComm SetCommState SetCommTimeouts FindNextFileW GetThreadTimes CompareFileTime GlobalUnlock GlobalLock LoadLibraryA GetFileAttributesExW GlobalAlloc RtlUnwind WaitForSingleObjectEx CreateDirectoryA GlobalFree GetLocaleInfoA IsDBCSLeadByte TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetLogicalProcessorInformationEx GetExitCodeThread SwitchToThread GetSystemTimePreciseAsFileTime LCMapStringW GetLocaleInfoW IsValidLocale SetPriorityClass FlushFileBuffers HeapReAlloc GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap HeapSize GetUserDefaultLCID SetEndOfFile WriteConsoleW QueryPerformanceFrequency DeleteFileA

user32

OpenClipboard CloseClipboard SetClipboardData EmptyClipboard GetClipboardData GetKeyboardLayout TrackMouseEvent GetMessageExtraInfo GetKeyState GetCapture SetCapture ReleaseCapture IsWindowUnicode SetCursorPos GetCursorPos ClientToScreen LoadCursorA PtInRect GetDisplayConfigBufferSizes ScreenToClient EnumDisplaySettingsExW LoadImageW SendMessageW LoadCursorW GetWindowThreadProcessId GetWindowLongW SetCursor MessageBoxW MessageBoxA ReleaseDC GetDC GetWindowRect GetClientRect AllowSetForegroundWindow SetForegroundWindow GetForegroundWindow GetSystemMetrics KillTimer SetTimer IsIconic SetWindowPos ShowWindow GetAsyncKeyState EnumDisplayMonitors UpdateWindow EnumDisplayDevicesW DestroyWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW PeekMessageW DispatchMessageW TranslateMessage GetMonitorInfoW UnregisterClassW MonitorFromWindow MonitorFromPoint DisplayConfigGetDeviceInfo QueryDisplayConfig LoadIconW SetDisplayConfig

gdi32

GetDeviceCaps GetStockObject

advapi32

RegQueryValueExW RegOpenKeyExA RegSetValueExA RegCloseKey RegCreateKeyExA RegQueryValueExA RegOpenKeyExW

newdev

UpdateDriverForPlugAndPlayDevicesW

cabinet

ord45 ord40 ord43

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress

Name

.text

Size

10.4MB

Virtual Size

10.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

6.3MB

Virtual Size

6.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

353KB

Virtual Size

549KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

272KB

Virtual Size

271KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

77KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

345KB

Virtual Size

345KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

PrivateDMA-Loader.exe

d3d11

dxgi

d3dcompiler_47

d2d1

dwrite

ole32

winmm

ws2_32

iphlpapi

bcrypt

crypt32

shell32

winhttp

dwmapi

wintrust

version

setupapi

kernel32

user32

gdi32

advapi32

newdev

cabinet

imm32

api-ms-win-core-synch-l1-2-0

generic