privateloader | 307cbb13fec9d00e3b2787f369cb3e6b9b50e3c4285f86dfc41bb10533d50510

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2023, 11:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5102fb7f0bd2fd75d3b9e3dfaeacb2ee.exe
Size 1.1MB
Sample231120-m99weafe98
SHA256 307cbb13fec9d00e3b2787f369cb3e6b9b50e3c4285f86dfc41bb10533d50510
MD5 5102fb7f0bd2fd75d3b9e3dfaeacb2ee
SHA1 ae9c32b8c42aabd9cae257f1f61f071d11d2741e
SHA512 3c56dea94b5860f868b011f5f7e1c05b48412f9d60b7332d1800e066ee5ad4fde9501ff5cd81fd496d87e6f96897354e5bbfe561a64411a4621453048df23995
SSDEEP 24576:PyykK7Wkyn+D32IpvfYb1knWis2gT3E4jrBrpaU:a8Wky+SevAb1knLgDDjrBr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

privateloader redline risepro horda infostealer loader persistence stealer

Malware Config

Extracted

Family

redline

Botnet

horda

194.49.94.152:19053

Extracted

Family

risepro

194.49.94.152

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/3848-21-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk	3tk32Kb.exe

Executes dropped EXE 4 IoCs

pid	Process
4392	sx5wx34.exe
4888	jp8Nk07.exe
3360	2td2772.exe
1044	3tk32Kb.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5102fb7f0bd2fd75d3b9e3dfaeacb2ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	sx5wx34.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	jp8Nk07.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe"	3tk32Kb.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3360 set thread context of 3848	3360	2td2772.exe	102

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2424	schtasks.exe
3648	schtasks.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 4392	1080	5102fb7f0bd2fd75d3b9e3dfaeacb2ee.exe	87
PID 1080 wrote to memory of 4392	1080	5102fb7f0bd2fd75d3b9e3dfaeacb2ee.exe	87
PID 1080 wrote to memory of 4392	1080	5102fb7f0bd2fd75d3b9e3dfaeacb2ee.exe	87
PID 4392 wrote to memory of 4888	4392	sx5wx34.exe	88
PID 4392 wrote to memory of 4888	4392	sx5wx34.exe	88
PID 4392 wrote to memory of 4888	4392	sx5wx34.exe	88
PID 4888 wrote to memory of 3360	4888	jp8Nk07.exe	90
PID 4888 wrote to memory of 3360	4888	jp8Nk07.exe	90
PID 4888 wrote to memory of 3360	4888	jp8Nk07.exe	90
PID 3360 wrote to memory of 3848	3360	2td2772.exe	102
PID 3360 wrote to memory of 3848	3360	2td2772.exe	102
PID 3360 wrote to memory of 3848	3360	2td2772.exe	102
PID 3360 wrote to memory of 3848	3360	2td2772.exe	102
PID 3360 wrote to memory of 3848	3360	2td2772.exe	102
PID 3360 wrote to memory of 3848	3360	2td2772.exe	102
PID 3360 wrote to memory of 3848	3360	2td2772.exe	102
PID 3360 wrote to memory of 3848	3360	2td2772.exe	102
PID 4888 wrote to memory of 1044	4888	jp8Nk07.exe	103
PID 4888 wrote to memory of 1044	4888	jp8Nk07.exe	103
PID 4888 wrote to memory of 1044	4888	jp8Nk07.exe	103
PID 1044 wrote to memory of 2424	1044	3tk32Kb.exe	104
PID 1044 wrote to memory of 2424	1044	3tk32Kb.exe	104
PID 1044 wrote to memory of 2424	1044	3tk32Kb.exe	104
PID 1044 wrote to memory of 3648	1044	3tk32Kb.exe	106
PID 1044 wrote to memory of 3648	1044	3tk32Kb.exe	106
PID 1044 wrote to memory of 3648	1044	3tk32Kb.exe	106

C:\Users\Admin\AppData\Local\Temp\5102fb7f0bd2fd75d3b9e3dfaeacb2ee.exe
"C:\Users\Admin\AppData\Local\Temp\5102fb7f0bd2fd75d3b9e3dfaeacb2ee.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sx5wx34.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sx5wx34.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jp8Nk07.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jp8Nk07.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4888
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2td2772.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2td2772.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:3360
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        
        PID:3848
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3tk32Kb.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3tk32Kb.exe
      4⤵
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1044
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
        5⤵
        Creates scheduled task(s)
        
        PID:2424
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
        5⤵
        Creates scheduled task(s)
        
        PID:3648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FANBooster131.exe

Path C:\Users\Admin\AppData\Local\Temp\FANBooster131\FANBooster131.exe
Size 1.3MB
SHA256 b6a2c47ad7a79986ed25d0f0777593d69e3f74e4504f1e2f6bd1fad7f7a7bbbb
MD5 36f322d2f9255e186a4b96bf3401aa2f
SHA1 8bdce7b6b0b2e0f592fc58b9d49145b43ca3c36f
SHA512 f075fb2d7c33d7178bd2372b25b2f20e22877744391aa6db08bb158a096d4dc2b6cfcc1a05a551c7b196efea120546ef27b7e1004b4fa0b65438ea617efb242e
SSDEEP 24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJZrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TRrK5Zln2i6
MD5 SHA1 SHA512 SSDEEP

Submit Download

sx5wx34.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sx5wx34.exe
Size 953KB
SHA256 051a8897a79b3f2dee806042e5537958e44672beae74c0fdc650271dc5dc3048
MD5 cf7d67f3d2b335d3a3757ed2aad19bd8
SHA1 803ab7859b9c667e03bdf2f14d7cef21366ee674
SHA512 737aae7a5497ebb4de75c6e23d7345ea552710dd788d081c0c2538f1ac7a18ee589bc2c824fe77fc968a431c33d58cf44bb41522115ed0a143050149a8015f50
SSDEEP 12288:iMrWy90vvqunZTwp32mmToSdaM45OmCX/Rhcym4DykQnHUqo29NTBUeSTWTEI427:oy2PnWp32m6vdn49knElo2gTcl4psH
MD5 SHA1 SHA512 SSDEEP

Submit Download

sx5wx34.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sx5wx34.exe
Size 953KB
SHA256 051a8897a79b3f2dee806042e5537958e44672beae74c0fdc650271dc5dc3048
MD5 cf7d67f3d2b335d3a3757ed2aad19bd8
SHA1 803ab7859b9c667e03bdf2f14d7cef21366ee674
SHA512 737aae7a5497ebb4de75c6e23d7345ea552710dd788d081c0c2538f1ac7a18ee589bc2c824fe77fc968a431c33d58cf44bb41522115ed0a143050149a8015f50
SSDEEP 12288:iMrWy90vvqunZTwp32mmToSdaM45OmCX/Rhcym4DykQnHUqo29NTBUeSTWTEI427:oy2PnWp32m6vdn49knElo2gTcl4psH
MD5 SHA1 SHA512 SSDEEP

Submit Download

jp8Nk07.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jp8Nk07.exe
Size 828KB
SHA256 103c04739f86d634b8a46317a7ebfc298449f2c7619199fd5d6153bf7264a099
MD5 5cbd58553c09a5a02ea062c804a14b71
SHA1 b5fb4ba7705e76559191514c8c3099086bd4a234
SHA512 eebbf1b0b3f0762c0f78ba17aec411afd94b96ad286b185893de5650138c54c07d01907e52aa617c300336ce8885dbd75eab163c4e662fdb73de950e6aad96a5
SSDEEP 12288:6MrTy9068hHGHT0D32fmToS3o7l5S27X/Rhcym4DVkQQHs/d29RbBUWRT4TEy4CF:Fyoc432f6v36l1fncOd2DTuj4sGy
MD5 SHA1 SHA512 SSDEEP

Submit Download

jp8Nk07.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jp8Nk07.exe
Size 828KB
SHA256 103c04739f86d634b8a46317a7ebfc298449f2c7619199fd5d6153bf7264a099
MD5 5cbd58553c09a5a02ea062c804a14b71
SHA1 b5fb4ba7705e76559191514c8c3099086bd4a234
SHA512 eebbf1b0b3f0762c0f78ba17aec411afd94b96ad286b185893de5650138c54c07d01907e52aa617c300336ce8885dbd75eab163c4e662fdb73de950e6aad96a5
SSDEEP 12288:6MrTy9068hHGHT0D32fmToS3o7l5S27X/Rhcym4DVkQQHs/d29RbBUWRT4TEy4CF:Fyoc432f6v36l1fncOd2DTuj4sGy
MD5 SHA1 SHA512 SSDEEP

Submit Download

2td2772.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2td2772.exe
Size 493KB
SHA256 5e9e2157b3401f19520f9d5ac0815466b4b573b801aacc8dbb61d0ab2d5a296c
MD5 ce632a59583aecf555964030234bec55
SHA1 6fc345b68409847800cc43e55078a91e3e16eed1
SHA512 4ecb56618f14d4ec432722c507bd8384a5c9e28b75be0c911015a196b56e314b29479160eddc32bf195794bd9c144a1a09f78a4b5fa74e8f28c3591d273fc8c9
SSDEEP 6144:x3nNKoPE2gZB/6fZOE0EUAOADSS0TqqWEn3OxYkzqxpf7RxI7B45t66666qs8x:5nNTPE2CEgESShZ2QVuff7RxI7BM7x
MD5 SHA1 SHA512 SSDEEP

Submit Download

2td2772.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2td2772.exe
Size 493KB
SHA256 5e9e2157b3401f19520f9d5ac0815466b4b573b801aacc8dbb61d0ab2d5a296c
MD5 ce632a59583aecf555964030234bec55
SHA1 6fc345b68409847800cc43e55078a91e3e16eed1
SHA512 4ecb56618f14d4ec432722c507bd8384a5c9e28b75be0c911015a196b56e314b29479160eddc32bf195794bd9c144a1a09f78a4b5fa74e8f28c3591d273fc8c9
SSDEEP 6144:x3nNKoPE2gZB/6fZOE0EUAOADSS0TqqWEn3OxYkzqxpf7RxI7B45t66666qs8x:5nNTPE2CEgESShZ2QVuff7RxI7BM7x
MD5 SHA1 SHA512 SSDEEP

Submit Download

3tk32Kb.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3tk32Kb.exe
Size 1.3MB
SHA256 b6a2c47ad7a79986ed25d0f0777593d69e3f74e4504f1e2f6bd1fad7f7a7bbbb
MD5 36f322d2f9255e186a4b96bf3401aa2f
SHA1 8bdce7b6b0b2e0f592fc58b9d49145b43ca3c36f
SHA512 f075fb2d7c33d7178bd2372b25b2f20e22877744391aa6db08bb158a096d4dc2b6cfcc1a05a551c7b196efea120546ef27b7e1004b4fa0b65438ea617efb242e
SSDEEP 24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJZrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TRrK5Zln2i6
MD5 SHA1 SHA512 SSDEEP

Submit Download

3tk32Kb.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3tk32Kb.exe
Size 1.3MB
SHA256 b6a2c47ad7a79986ed25d0f0777593d69e3f74e4504f1e2f6bd1fad7f7a7bbbb
MD5 36f322d2f9255e186a4b96bf3401aa2f
SHA1 8bdce7b6b0b2e0f592fc58b9d49145b43ca3c36f
SHA512 f075fb2d7c33d7178bd2372b25b2f20e22877744391aa6db08bb158a096d4dc2b6cfcc1a05a551c7b196efea120546ef27b7e1004b4fa0b65438ea617efb242e
SSDEEP 24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJZrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TRrK5Zln2i6
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3848-27-0x0000000074360000-0x0000000074B10000-memory.dmp

Download

memory/3848-21-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3848-28-0x0000000007EB0000-0x0000000008454000-memory.dmp

Download

memory/3848-32-0x00000000079A0000-0x0000000007A32000-memory.dmp

Download

memory/3848-34-0x0000000007990000-0x00000000079A0000-memory.dmp

Download

memory/3848-35-0x0000000007B90000-0x0000000007B9A000-memory.dmp

Download

memory/3848-37-0x0000000008A80000-0x0000000009098000-memory.dmp

Download

memory/3848-38-0x0000000007D40000-0x0000000007E4A000-memory.dmp

Download

memory/3848-39-0x0000000007C70000-0x0000000007C82000-memory.dmp

Download

memory/3848-40-0x0000000007CD0000-0x0000000007D0C000-memory.dmp

Download

memory/3848-41-0x0000000007E50000-0x0000000007E9C000-memory.dmp

Download

memory/3848-42-0x0000000074360000-0x0000000074B10000-memory.dmp

Download

memory/3848-43-0x0000000007990000-0x00000000079A0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads