privateloader | a5807e33536aa04995d7535f80cf34bf4b97e17d45460010e4e50fc17362b1af

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2023, 21:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1fdc318507804359d8e6af1513346223.exe
Size 1.1MB
Sample231121-ztvsrshd21
SHA256 a5807e33536aa04995d7535f80cf34bf4b97e17d45460010e4e50fc17362b1af
MD5 1fdc318507804359d8e6af1513346223
SHA1 a7c1afea7828c897c59ed9c772c1ac079528c256
SHA512 b56753f546994b82b5edc2b97485f12d03a29945f5c2e73b95530a36ebed048b0e560bae681eee9d4268899c3482798e1594e6cefd645556037f7360932d5a2f
SSDEEP 12288:YMrOy90kP13wtNZYXabCvpwg8khlZRsVJ8P3Gq1Y/5tw4+JoIbJGlVDbOHhdfUvL:GyNpX8awg8OZ+V+JPbQVDbeUK+1uJs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

privateloader redline risepro horda infostealer loader persistence stealer

Malware Config

Extracted

Family

redline

Botnet

horda

194.49.94.152:19053

Extracted

Family

risepro

194.49.94.152

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/1756-21-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk	3Pd73pG.exe

Executes dropped EXE 4 IoCs

pid	Process
3324	KZ7Im67.exe
5032	WH8PF76.exe
4708	2wl0661.exe
940	3Pd73pG.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	KZ7Im67.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	WH8PF76.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe"	3Pd73pG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	1fdc318507804359d8e6af1513346223.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4708 set thread context of 1756	4708	2wl0661.exe	101

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2576	4708	WerFault.exe	88

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2168	schtasks.exe
4600	schtasks.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 3324	1792	1fdc318507804359d8e6af1513346223.exe	86
PID 1792 wrote to memory of 3324	1792	1fdc318507804359d8e6af1513346223.exe	86
PID 1792 wrote to memory of 3324	1792	1fdc318507804359d8e6af1513346223.exe	86
PID 3324 wrote to memory of 5032	3324	KZ7Im67.exe	87
PID 3324 wrote to memory of 5032	3324	KZ7Im67.exe	87
PID 3324 wrote to memory of 5032	3324	KZ7Im67.exe	87
PID 5032 wrote to memory of 4708	5032	WH8PF76.exe	88
PID 5032 wrote to memory of 4708	5032	WH8PF76.exe	88
PID 5032 wrote to memory of 4708	5032	WH8PF76.exe	88
PID 4708 wrote to memory of 1756	4708	2wl0661.exe	101
PID 4708 wrote to memory of 1756	4708	2wl0661.exe	101
PID 4708 wrote to memory of 1756	4708	2wl0661.exe	101
PID 4708 wrote to memory of 1756	4708	2wl0661.exe	101
PID 4708 wrote to memory of 1756	4708	2wl0661.exe	101
PID 4708 wrote to memory of 1756	4708	2wl0661.exe	101
PID 4708 wrote to memory of 1756	4708	2wl0661.exe	101
PID 4708 wrote to memory of 1756	4708	2wl0661.exe	101
PID 5032 wrote to memory of 940	5032	WH8PF76.exe	105
PID 5032 wrote to memory of 940	5032	WH8PF76.exe	105
PID 5032 wrote to memory of 940	5032	WH8PF76.exe	105
PID 940 wrote to memory of 2168	940	3Pd73pG.exe	106
PID 940 wrote to memory of 2168	940	3Pd73pG.exe	106
PID 940 wrote to memory of 2168	940	3Pd73pG.exe	106
PID 940 wrote to memory of 4600	940	3Pd73pG.exe	108
PID 940 wrote to memory of 4600	940	3Pd73pG.exe	108
PID 940 wrote to memory of 4600	940	3Pd73pG.exe	108

C:\Users\Admin\AppData\Local\Temp\1fdc318507804359d8e6af1513346223.exe
"C:\Users\Admin\AppData\Local\Temp\1fdc318507804359d8e6af1513346223.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KZ7Im67.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KZ7Im67.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3324
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\WH8PF76.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\WH8PF76.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:5032
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2wl0661.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2wl0661.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:4708
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        
        PID:1756
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 592
        5⤵
        Program crash
        
        PID:2576
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Pd73pG.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Pd73pG.exe
      4⤵
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:940
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
        5⤵
        Creates scheduled task(s)
        
        PID:2168
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
        5⤵
        Creates scheduled task(s)
        
        PID:4600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4708 -ip 4708
1⤵
PID:1924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FANBooster131.exe

Path C:\Users\Admin\AppData\Local\Temp\FANBooster131\FANBooster131.exe
Size 1.3MB
SHA256 a99d586b8dda8dd2cdd47a2d164d31926384e01deda0fd0beef0514716e2dbbd
MD5 03254a77c635ce479cf88d10345385b4
SHA1 20a8f73b0184a2bd57df815acdf5cf7a7bbb911f
SHA512 0a8aa5dde2a61d8da71b27fd30c92c5550d3c26553d3fd80e711dd0f4b881945cd108407a0fa7a0081fb06f76871d683b4dd007743bdeb76c6e9d35bbffa2679
SSDEEP 24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJZrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TRrK5Zln2i6
MD5 SHA1 SHA512 SSDEEP

Submit Download

KZ7Im67.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KZ7Im67.exe
Size 935KB
SHA256 c1023f59f0494a3c3d54c0a948aa6c8faa75a3d8cf8d54a3f2219f25ead02076
MD5 be6c14829d9b381b994db39d6ca3fb3c
SHA1 b7200115389bd497610d877fdaf5f5f570c2ae0b
SHA512 00acf00381c5bdb9367a3194939e4935810d20cc34f11eea3e13503c24510b2f32c7ab5754e23ef8b8ec124826076219caf3fa8be52c481a57852813a262714f
SSDEEP 12288:TMrry90lUHoYXabCpnwc8khPxtHK2XP3fqJb/5vNKJJoIbMGyL7bO91cfUeWCT01:oy3X8kwc8O/3bJJPb2L7bvUST6
MD5 SHA1 SHA512 SSDEEP

Submit Download

KZ7Im67.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KZ7Im67.exe
Size 935KB
SHA256 c1023f59f0494a3c3d54c0a948aa6c8faa75a3d8cf8d54a3f2219f25ead02076
MD5 be6c14829d9b381b994db39d6ca3fb3c
SHA1 b7200115389bd497610d877fdaf5f5f570c2ae0b
SHA512 00acf00381c5bdb9367a3194939e4935810d20cc34f11eea3e13503c24510b2f32c7ab5754e23ef8b8ec124826076219caf3fa8be52c481a57852813a262714f
SSDEEP 12288:TMrry90lUHoYXabCpnwc8khPxtHK2XP3fqJb/5vNKJJoIbMGyL7bO91cfUeWCT01:oy3X8kwc8O/3bJJPb2L7bvUST6
MD5 SHA1 SHA512 SSDEEP

Submit Download

WH8PF76.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\WH8PF76.exe
Size 811KB
SHA256 b5579935c2ad6fa6f7f383aa2f27382e57dc676b17f0a1af99f13205030faa71
MD5 89f597db9d4e0c9c4564d44111beb336
SHA1 8eb30db48f171fdb4a78b9fc712d7cea9493ed92
SHA512 dd95b69f79801986e4d2094820e45440e04e07d60586b5f64021504602bf0377e3dd4987ee56adc1d78d1eccfc4d6ed8611f31b91a965cd268329402fce2030e
SSDEEP 12288:JMrZy90vz7h9kpPx8iK6FP3Kqfz/53Ty5JjIbvGyKybOt1vrEe8YTs:My8R9KFS95J8bxKybCESTs
MD5 SHA1 SHA512 SSDEEP

Submit Download

WH8PF76.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\WH8PF76.exe
Size 811KB
SHA256 b5579935c2ad6fa6f7f383aa2f27382e57dc676b17f0a1af99f13205030faa71
MD5 89f597db9d4e0c9c4564d44111beb336
SHA1 8eb30db48f171fdb4a78b9fc712d7cea9493ed92
SHA512 dd95b69f79801986e4d2094820e45440e04e07d60586b5f64021504602bf0377e3dd4987ee56adc1d78d1eccfc4d6ed8611f31b91a965cd268329402fce2030e
SSDEEP 12288:JMrZy90vz7h9kpPx8iK6FP3Kqfz/53Ty5JjIbvGyKybOt1vrEe8YTs:My8R9KFS95J8bxKybCESTs
MD5 SHA1 SHA512 SSDEEP

Submit Download

2wl0661.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2wl0661.exe
Size 432KB
SHA256 e1d4c2bed0f222977efe8d5e6fa36febdda18eb92d085d01bee9611b3d7aedc1
MD5 5e32cf8061b8ab630c41706453b21ed1
SHA1 67131863a881a17e22b5c3a2c9dc4622343a4848
SHA512 6c02dfb8e888dcc1dc3d413b837b240e6875522f36a8b979bd366a31d210169561458adf8fc48af6b64b2b5abd8207e918f692777e58b8ed31ecf3f17036e213
SSDEEP 6144:UH4zvs6GYdCGO0xS4UfdQ6AOSg+yg8Qm6ys6rRXFROsEipBpXT476S:zvHGCCGR67XFRObi1U6S
MD5 SHA1 SHA512 SSDEEP

Submit Download

2wl0661.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2wl0661.exe
Size 432KB
SHA256 e1d4c2bed0f222977efe8d5e6fa36febdda18eb92d085d01bee9611b3d7aedc1
MD5 5e32cf8061b8ab630c41706453b21ed1
SHA1 67131863a881a17e22b5c3a2c9dc4622343a4848
SHA512 6c02dfb8e888dcc1dc3d413b837b240e6875522f36a8b979bd366a31d210169561458adf8fc48af6b64b2b5abd8207e918f692777e58b8ed31ecf3f17036e213
SSDEEP 6144:UH4zvs6GYdCGO0xS4UfdQ6AOSg+yg8Qm6ys6rRXFROsEipBpXT476S:zvHGCCGR67XFRObi1U6S
MD5 SHA1 SHA512 SSDEEP

Submit Download

3Pd73pG.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Pd73pG.exe
Size 1.3MB
SHA256 a99d586b8dda8dd2cdd47a2d164d31926384e01deda0fd0beef0514716e2dbbd
MD5 03254a77c635ce479cf88d10345385b4
SHA1 20a8f73b0184a2bd57df815acdf5cf7a7bbb911f
SHA512 0a8aa5dde2a61d8da71b27fd30c92c5550d3c26553d3fd80e711dd0f4b881945cd108407a0fa7a0081fb06f76871d683b4dd007743bdeb76c6e9d35bbffa2679
SSDEEP 24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJZrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TRrK5Zln2i6
MD5 SHA1 SHA512 SSDEEP

Submit Download

3Pd73pG.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Pd73pG.exe
Size 1.3MB
SHA256 a99d586b8dda8dd2cdd47a2d164d31926384e01deda0fd0beef0514716e2dbbd
MD5 03254a77c635ce479cf88d10345385b4
SHA1 20a8f73b0184a2bd57df815acdf5cf7a7bbb911f
SHA512 0a8aa5dde2a61d8da71b27fd30c92c5550d3c26553d3fd80e711dd0f4b881945cd108407a0fa7a0081fb06f76871d683b4dd007743bdeb76c6e9d35bbffa2679
SSDEEP 24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJZrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TRrK5Zln2i6
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1756-25-0x0000000007640000-0x0000000007650000-memory.dmp

Download

memory/1756-24-0x0000000007450000-0x00000000074E2000-memory.dmp

Download

memory/1756-26-0x0000000005090000-0x000000000509A000-memory.dmp

Download

memory/1756-23-0x0000000007A00000-0x0000000007FA4000-memory.dmp

Download

memory/1756-22-0x00000000743F0000-0x0000000074BA0000-memory.dmp

Download

memory/1756-21-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1756-32-0x00000000085D0000-0x0000000008BE8000-memory.dmp

Download

memory/1756-33-0x0000000007810000-0x000000000791A000-memory.dmp

Download

memory/1756-34-0x0000000007690000-0x00000000076A2000-memory.dmp

Download

memory/1756-39-0x00000000076F0000-0x000000000772C000-memory.dmp

Download

memory/1756-40-0x0000000007730000-0x000000000777C000-memory.dmp

Download

memory/1756-42-0x00000000743F0000-0x0000000074BA0000-memory.dmp

Download

memory/1756-43-0x0000000007640000-0x0000000007650000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads