privateloader | d963acee9e469ee9b95e16ca8d4f77412663b6f92928d885cd35c82595bea7ef

Analysis

max time kernel
141s
max time network
140s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
27-06-2024 23:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AppGate2103v0115.exe
Size

4.3MB
MD5

d25bee31c30313658d2e010c0fb5f66e
SHA1

003a49d195dd719b9af213fedcf9c39d8b6bf480
SHA256

d963acee9e469ee9b95e16ca8d4f77412663b6f92928d885cd35c82595bea7ef
SHA512

323bc94eb61a776c4a2a112d064bef17bd9874e3560040672288cd4447065dca4bc47bb346ebb13319bf999163704fc56beed345bd8c24dc487803f3a8db3dc7
SSDEEP

98304:dbFhmDz7Avv/xXkMfPikM5JofdF7r8tH9gAMhPQLv+Wu5Vm:dFAnE55fb46LSH9gAMBQTRM

Score

10^/10

privateloader evasion loader

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 1 IoCs
evasion

Modify Registry
T1112

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

AppGate2103v0115.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1" AppGate2103v0115.exe
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 api.myip.com
6 api.myip.com
7 ipinfo.io
8 ipinfo.io

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1"	AppGate2103v0115.exe

flow	ioc
5	api.myip.com
6	api.myip.com
7	ipinfo.io
8	ipinfo.io

Drops file in System32 directory 4 IoCs

Processes:

AppGate2103v0115.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	AppGate2103v0115.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	AppGate2103v0115.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	AppGate2103v0115.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	AppGate2103v0115.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

AppGate2103v0115.exe

pid process

2820 AppGate2103v0115.exe
2820 AppGate2103v0115.exe

pid	process
2820	AppGate2103v0115.exe
2820	AppGate2103v0115.exe

C:\Users\Admin\AppData\Local\Temp\AppGate2103v0115.exe
"C:\Users\Admin\AppData\Local\Temp\AppGate2103v0115.exe"
1⤵
- Modifies firewall policy service
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2820

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:4376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:2164

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\GroupPolicy\gpt.ini
Filesize
127B

MD5
8ef9853d1881c5fe4d681bfb31282a01

SHA1
a05609065520e4b4e553784c566430ad9736f19f

SHA256
9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

SHA512
5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

Download Submit
memory/2820-3-0x00007FFD6B2F0000-0x00007FFD6B2F2000-memory.dmp

Filesize
8KB

Download
memory/2820-8-0x00007FFD68370000-0x00007FFD68372000-memory.dmp

Filesize
8KB

Download
memory/2820-5-0x00007FFD6B080000-0x00007FFD6B082000-memory.dmp

Filesize
8KB

Download
memory/2820-6-0x00007FFD6B090000-0x00007FFD6B092000-memory.dmp

Filesize
8KB

Download
memory/2820-4-0x00007FFD6B300000-0x00007FFD6B302000-memory.dmp

Filesize
8KB

Download
memory/2820-0-0x00007FFD6B100000-0x00007FFD6B2DB000-memory.dmp

Filesize
1.9MB

Download
memory/2820-7-0x00007FFD68360000-0x00007FFD68362000-memory.dmp

Filesize
8KB

Download
memory/2820-1-0x00007FFD6B2E0000-0x00007FFD6B2E2000-memory.dmp

Filesize
8KB

Download
memory/2820-9-0x00007FF7866D0000-0x00007FF786EE4000-memory.dmp

Filesize
8.1MB

Download
memory/2820-2-0x00007FFD6B100000-0x00007FFD6B2DB000-memory.dmp

Filesize
1.9MB

Download
memory/2820-21-0x000001730E160000-0x000001730E168000-memory.dmp

Filesize
32KB

Download
memory/2820-20-0x000001730FB40000-0x000001730FBAC000-memory.dmp

Filesize
432KB

Download
memory/2820-22-0x000001730FB40000-0x000001730FBAC000-memory.dmp

Filesize
432KB

Download
memory/2820-24-0x00007FFD6B100000-0x00007FFD6B2DB000-memory.dmp

Filesize
1.9MB

Download