privateloader | 7dd544e44b731a9fb4ee33390c223fda80608d3ac515299133d389a18818004f

Analysis

max time kernel
135s
max time network
182s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
17/11/2023, 17:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 3.2MB
Sample231117-wdevtsda9z
SHA256 7dd544e44b731a9fb4ee33390c223fda80608d3ac515299133d389a18818004f
MD5 4fab4b4da27b655937ad6b0b7c273f45
SHA1 936662d432037ec8813ac0a5b68ce5bf00cd21d6
SHA512 6dd5bc6618f9d06335479860bac3bf4153c6489a87b0e23d6c71d5cde6284a78ab57f960c8fe8e67b4e8f953a348ac6578d8b1441c6ae7e1f59d7824b342e826
SSDEEP 49152:0xysLzAKJwEcm4f6a3vHX9lUjtL6D53aW3uOIbkiME0JjGTqjnc1:jc4Ss9lUjtL6D53aW3XoMrJjGTqjw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

privateloader risepro loader stealer

Malware Config

Extracted

Family

risepro

194.49.94.152

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2560 set thread context of 1152	2560	file.exe	29

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2560	file.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 1152	2560	file.exe	29
PID 2560 wrote to memory of 1152	2560	file.exe	29
PID 2560 wrote to memory of 1152	2560	file.exe	29
PID 2560 wrote to memory of 1152	2560	file.exe	29
PID 2560 wrote to memory of 1152	2560	file.exe	29
PID 2560 wrote to memory of 1152	2560	file.exe	29
PID 2560 wrote to memory of 1152	2560	file.exe	29
PID 2560 wrote to memory of 1152	2560	file.exe	29
PID 2560 wrote to memory of 1152	2560	file.exe	29
PID 2560 wrote to memory of 1152	2560	file.exe	29
PID 2560 wrote to memory of 1152	2560	file.exe	29
PID 2560 wrote to memory of 1152	2560	file.exe	29
PID 2560 wrote to memory of 1152	2560	file.exe	29
PID 2560 wrote to memory of 1152	2560	file.exe	29

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1152-0-0x0000000000400000-0x0000000000547000-memory.dmp

Download

memory/1152-2-0x0000000000400000-0x0000000000547000-memory.dmp

Download

memory/1152-4-0x0000000000400000-0x0000000000547000-memory.dmp

Download

memory/1152-7-0x0000000000400000-0x0000000000547000-memory.dmp

Download

memory/1152-8-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Download

memory/1152-6-0x0000000000400000-0x0000000000547000-memory.dmp

Download

memory/1152-5-0x0000000000400000-0x0000000000547000-memory.dmp

Download

memory/1152-9-0x0000000000400000-0x0000000000547000-memory.dmp

Download

memory/1152-11-0x0000000000400000-0x0000000000547000-memory.dmp

Download

memory/1152-13-0x0000000000400000-0x0000000000547000-memory.dmp

Download

memory/1152-15-0x0000000000400000-0x0000000000547000-memory.dmp

Download

memory/1152-14-0x0000000000400000-0x0000000000547000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads