privateloader | d963acee9e469ee9b95e16ca8d4f77412663b6f92928d885cd35c82595bea7ef

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 01:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d963acee9e469ee9b95e16ca8d4f77412663b6f92928d885cd35c82595bea7ef.exe
Size

4.3MB
MD5

d25bee31c30313658d2e010c0fb5f66e
SHA1

003a49d195dd719b9af213fedcf9c39d8b6bf480
SHA256

d963acee9e469ee9b95e16ca8d4f77412663b6f92928d885cd35c82595bea7ef
SHA512

323bc94eb61a776c4a2a112d064bef17bd9874e3560040672288cd4447065dca4bc47bb346ebb13319bf999163704fc56beed345bd8c24dc487803f3a8db3dc7
SSDEEP

98304:dbFhmDz7Avv/xXkMfPikM5JofdF7r8tH9gAMhPQLv+Wu5Vm:dFAnE55fb46LSH9gAMBQTRM

Score

10^/10

privateloader evasion loader

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

d963acee9e469ee9b95e16ca8d4f77412663b6f92928d885cd35c82595bea7ef.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1"	d963acee9e469ee9b95e16ca8d4f77412663b6f92928d885cd35c82595bea7ef.exe

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

15 api.myip.com
16 api.myip.com
19 ipinfo.io
20 ipinfo.io

flow	ioc
15	api.myip.com
16	api.myip.com
19	ipinfo.io
20	ipinfo.io

Drops file in System32 directory 4 IoCs

Processes:

d963acee9e469ee9b95e16ca8d4f77412663b6f92928d885cd35c82595bea7ef.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	d963acee9e469ee9b95e16ca8d4f77412663b6f92928d885cd35c82595bea7ef.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	d963acee9e469ee9b95e16ca8d4f77412663b6f92928d885cd35c82595bea7ef.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	d963acee9e469ee9b95e16ca8d4f77412663b6f92928d885cd35c82595bea7ef.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	d963acee9e469ee9b95e16ca8d4f77412663b6f92928d885cd35c82595bea7ef.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

d963acee9e469ee9b95e16ca8d4f77412663b6f92928d885cd35c82595bea7ef.exe

pid process

732 d963acee9e469ee9b95e16ca8d4f77412663b6f92928d885cd35c82595bea7ef.exe
732 d963acee9e469ee9b95e16ca8d4f77412663b6f92928d885cd35c82595bea7ef.exe

pid	process
732	d963acee9e469ee9b95e16ca8d4f77412663b6f92928d885cd35c82595bea7ef.exe
732	d963acee9e469ee9b95e16ca8d4f77412663b6f92928d885cd35c82595bea7ef.exe

C:\Users\Admin\AppData\Local\Temp\d963acee9e469ee9b95e16ca8d4f77412663b6f92928d885cd35c82595bea7ef.exe
"C:\Users\Admin\AppData\Local\Temp\d963acee9e469ee9b95e16ca8d4f77412663b6f92928d885cd35c82595bea7ef.exe"
1⤵
- Modifies firewall policy service
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:3060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:5000

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\GroupPolicy\gpt.ini
Filesize
127B

MD5
8ef9853d1881c5fe4d681bfb31282a01

SHA1
a05609065520e4b4e553784c566430ad9736f19f

SHA256
9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

SHA512
5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

Download Submit
memory/732-3-0x00007FFF57410000-0x00007FFF57412000-memory.dmp

Filesize
8KB

Download
memory/732-4-0x00007FFF56180000-0x00007FFF56182000-memory.dmp

Filesize
8KB

Download
memory/732-0-0x00007FF7728A5000-0x00007FF772B0B000-memory.dmp

Filesize
2.4MB

Download
memory/732-2-0x00007FFF57400000-0x00007FFF57402000-memory.dmp

Filesize
8KB

Download
memory/732-5-0x00007FF772740000-0x00007FF772F54000-memory.dmp

Filesize
8.1MB

Download
memory/732-6-0x00007FFF56190000-0x00007FFF56192000-memory.dmp

Filesize
8KB

Download
memory/732-7-0x00007FFF55050000-0x00007FFF55052000-memory.dmp

Filesize
8KB

Download
memory/732-8-0x00007FFF55060000-0x00007FFF55062000-memory.dmp

Filesize
8KB

Download
memory/732-1-0x00007FFF573F0000-0x00007FFF573F2000-memory.dmp

Filesize
8KB

Download
memory/732-20-0x000002C7E2520000-0x000002C7E2676000-memory.dmp

Filesize
1.3MB

Download
memory/732-22-0x00007FF7728A5000-0x00007FF772B0B000-memory.dmp

Filesize
2.4MB

Download
memory/732-23-0x00007FF772740000-0x00007FF772F54000-memory.dmp

Filesize
8.1MB

Download
memory/732-27-0x000002C7E2520000-0x000002C7E2676000-memory.dmp

Filesize
1.3MB

Download