privateloader | 05f8f506a4418735bcbcda961c275ee048d8e5b1110cfc7ae75f11c12486704d | Triage

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
25/11/2023, 11:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Sеtup.exe
Size

1.6MB
MD5

0886591e54c2439ece1541c573f11d35
SHA1

223e96cbbf39e38eb526741bf714c0959356cf93
SHA256

05f8f506a4418735bcbcda961c275ee048d8e5b1110cfc7ae75f11c12486704d
SHA512

d9b202c8bb36844ab6acf9f9f81a8857ea587e10dfc95d6c05fce1004ca7bb8accc3115d6749aed88fd8845a8f91cd39c30af31b760fb10c721e66b7868e4605
SSDEEP

24576:3PD+hc2VyZ2C4grbH1D6/rp7uTFNuU12SOba8OZtkIwxMqFbv:/yhrVO2iP1D6/rJuBNDxvZtXzqF7

Score

10^/10

privateloader risepro loader stealer

Malware Config

Extracted

Family

risepro

C2

46.4.10.254

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2084	1924	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2084	1924	Sеtup.exe	29
PID 1924 wrote to memory of 2084	1924	Sеtup.exe	29
PID 1924 wrote to memory of 2084	1924	Sеtup.exe	29
PID 1924 wrote to memory of 2084	1924	Sеtup.exe	29

C:\Users\Admin\AppData\Local\Temp\Sеtup.exe
"C:\Users\Admin\AppData\Local\Temp\Sеtup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 188
  2⤵
  - Program crash
  PID:2084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1924-1-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/1924-0-0x00000000005A0000-0x0000000000724000-memory.dmp

Filesize
1.5MB

Download