privateloader | d4bdf03f7b41b556f113e73b07e7975837e8e78ca12292ec6d17cc8b3aac7f92

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
28/11/2023, 23:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
29997e3bf84ad60b1417ff44658f11e4.exe
Size 1.2MB
Sample231128-2zh29sdc39
SHA256 d4bdf03f7b41b556f113e73b07e7975837e8e78ca12292ec6d17cc8b3aac7f92
MD5 29997e3bf84ad60b1417ff44658f11e4
SHA1 a0ce49a73dcd106a33a90dbd7a7d486a577634e8
SHA512 b2df1ad9aded0478d52a1356e226dff7ba60a9b9ad3c44844a1893471b34bf95873670fba7af79bf0b232ac84b6a232811ef1e144c0c0cdb47fa3c76ff7107ee
SSDEEP 24576:pyJ/rCIF7/Z1R3WojIW1yXBkALmR+0/gyh7nvuOpEDn:cJ/l/Eojz2BkOAP6OpED
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

privateloader redline risepro horda infostealer loader persistence stealer

Malware Config

Extracted

Family

redline

Botnet

horda

194.49.94.152:19053

Extracted

Family

risepro

194.49.94.152

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/1116-14-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk	3BC89qL.exe

Executes dropped EXE 3 IoCs

pid	Process
4132	QP1oJ47.exe
4972	2Vj8001.exe
380	3BC89qL.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe"	3BC89qL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	29997e3bf84ad60b1417ff44658f11e4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	QP1oJ47.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4972 set thread context of 1116	4972	2Vj8001.exe	95

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1464	schtasks.exe
480	schtasks.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 4132	752	29997e3bf84ad60b1417ff44658f11e4.exe	88
PID 752 wrote to memory of 4132	752	29997e3bf84ad60b1417ff44658f11e4.exe	88
PID 752 wrote to memory of 4132	752	29997e3bf84ad60b1417ff44658f11e4.exe	88
PID 4132 wrote to memory of 4972	4132	QP1oJ47.exe	90
PID 4132 wrote to memory of 4972	4132	QP1oJ47.exe	90
PID 4132 wrote to memory of 4972	4132	QP1oJ47.exe	90
PID 4972 wrote to memory of 1116	4972	2Vj8001.exe	95
PID 4972 wrote to memory of 1116	4972	2Vj8001.exe	95
PID 4972 wrote to memory of 1116	4972	2Vj8001.exe	95
PID 4972 wrote to memory of 1116	4972	2Vj8001.exe	95
PID 4972 wrote to memory of 1116	4972	2Vj8001.exe	95
PID 4972 wrote to memory of 1116	4972	2Vj8001.exe	95
PID 4972 wrote to memory of 1116	4972	2Vj8001.exe	95
PID 4972 wrote to memory of 1116	4972	2Vj8001.exe	95
PID 4132 wrote to memory of 380	4132	QP1oJ47.exe	96
PID 4132 wrote to memory of 380	4132	QP1oJ47.exe	96
PID 4132 wrote to memory of 380	4132	QP1oJ47.exe	96
PID 380 wrote to memory of 480	380	3BC89qL.exe	97
PID 380 wrote to memory of 480	380	3BC89qL.exe	97
PID 380 wrote to memory of 480	380	3BC89qL.exe	97
PID 380 wrote to memory of 1464	380	3BC89qL.exe	99
PID 380 wrote to memory of 1464	380	3BC89qL.exe	99
PID 380 wrote to memory of 1464	380	3BC89qL.exe	99

C:\Users\Admin\AppData\Local\Temp\29997e3bf84ad60b1417ff44658f11e4.exe
"C:\Users\Admin\AppData\Local\Temp\29997e3bf84ad60b1417ff44658f11e4.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:752
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\QP1oJ47.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\QP1oJ47.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4132
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Vj8001.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Vj8001.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4972
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:1116
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3BC89qL.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3BC89qL.exe
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:380
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:480
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:1464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FANBooster131.exe

Path C:\Users\Admin\AppData\Local\Temp\FANBooster131\FANBooster131.exe
Size 1.3MB
SHA256 93915b70bf82106bd5a1e64159a7649da043e2b5360d50a945b7684a9e776290
MD5 dcafd49b95b148eb505488d6e7d8fb59
SHA1 a164ec29603a68e34de44dab232fc8a081c26fbd
SHA512 0bd113bc60277b6c0a0c47e9c8fcd44d02db33d23b4646aef25f01bfba3c39c9357853a20aee1ac8ea2dfe217f608a99606f5a5ec40224fd5f87adee017c350f
SSDEEP 24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJZrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TRrK5Zln2i6
MD5 SHA1 SHA512 SSDEEP

Submit Download

QP1oJ47.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\QP1oJ47.exe
Size 1.1MB
SHA256 cee8163406661ae2d44ee6b351c60e253b675e048ce37c4ed39ec498331b05be
MD5 4921dafc972374d73dd9dccd626507ec
SHA1 aa5ac1ceeea428e3b93ab78a1f7fc445d381dfb1
SHA512 8f6ce154b6fb3cde56aac654cdfa31b695f76865ee2dedc9a79772952f6e62ee70ecda90128eb7895843ff9157a3905c3d40552e517bab9e044bb34db3662d66
SSDEEP 24576:EypDU7Jc2gojcsUrWZFUuYxVTDX8v1OLpa:TNUOojQCZIjiOLp
MD5 SHA1 SHA512 SSDEEP

Submit Download

QP1oJ47.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\QP1oJ47.exe
Size 1.1MB
SHA256 cee8163406661ae2d44ee6b351c60e253b675e048ce37c4ed39ec498331b05be
MD5 4921dafc972374d73dd9dccd626507ec
SHA1 aa5ac1ceeea428e3b93ab78a1f7fc445d381dfb1
SHA512 8f6ce154b6fb3cde56aac654cdfa31b695f76865ee2dedc9a79772952f6e62ee70ecda90128eb7895843ff9157a3905c3d40552e517bab9e044bb34db3662d66
SSDEEP 24576:EypDU7Jc2gojcsUrWZFUuYxVTDX8v1OLpa:TNUOojQCZIjiOLp
MD5 SHA1 SHA512 SSDEEP

Submit Download

2Vj8001.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Vj8001.exe
Size 1.9MB
SHA256 923370ecda495ace6f7ed12f810e9681255527f148723f51afacc04a7e2897ac
MD5 d24fe378dfa84864c8b59eaa2f0e77ad
SHA1 272b88290b0bb6cd43269ab5ee755cfce5b4b796
SHA512 81cbb89f1d411253bba2889b12a73a19ff6deb2d2e97493d2660445372d64aa1e9c0107092b5ad8ceae50f96c10b426ae923ac1a153114ec63370124ee2e768f
SSDEEP 24576:5KiPPJIRH4mD7GkbnUK0247e2N6a9DhvhKThNKulnhuR:5KiP64mD7GkbnU72i6a3vg9NKulnhE
MD5 SHA1 SHA512 SSDEEP

Submit Download

2Vj8001.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Vj8001.exe
Size 1.9MB
SHA256 923370ecda495ace6f7ed12f810e9681255527f148723f51afacc04a7e2897ac
MD5 d24fe378dfa84864c8b59eaa2f0e77ad
SHA1 272b88290b0bb6cd43269ab5ee755cfce5b4b796
SHA512 81cbb89f1d411253bba2889b12a73a19ff6deb2d2e97493d2660445372d64aa1e9c0107092b5ad8ceae50f96c10b426ae923ac1a153114ec63370124ee2e768f
SSDEEP 24576:5KiPPJIRH4mD7GkbnUK0247e2N6a9DhvhKThNKulnhuR:5KiP64mD7GkbnU72i6a3vg9NKulnhE
MD5 SHA1 SHA512 SSDEEP

Submit Download

3BC89qL.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3BC89qL.exe
Size 1.3MB
SHA256 93915b70bf82106bd5a1e64159a7649da043e2b5360d50a945b7684a9e776290
MD5 dcafd49b95b148eb505488d6e7d8fb59
SHA1 a164ec29603a68e34de44dab232fc8a081c26fbd
SHA512 0bd113bc60277b6c0a0c47e9c8fcd44d02db33d23b4646aef25f01bfba3c39c9357853a20aee1ac8ea2dfe217f608a99606f5a5ec40224fd5f87adee017c350f
SSDEEP 24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJZrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TRrK5Zln2i6
MD5 SHA1 SHA512 SSDEEP

Submit Download

3BC89qL.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3BC89qL.exe
Size 1.3MB
SHA256 93915b70bf82106bd5a1e64159a7649da043e2b5360d50a945b7684a9e776290
MD5 dcafd49b95b148eb505488d6e7d8fb59
SHA1 a164ec29603a68e34de44dab232fc8a081c26fbd
SHA512 0bd113bc60277b6c0a0c47e9c8fcd44d02db33d23b4646aef25f01bfba3c39c9357853a20aee1ac8ea2dfe217f608a99606f5a5ec40224fd5f87adee017c350f
SSDEEP 24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJZrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TRrK5Zln2i6
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1116-20-0x00000000081D0000-0x0000000008774000-memory.dmp

Download

memory/1116-14-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1116-21-0x0000000074020000-0x00000000747D0000-memory.dmp

Download

memory/1116-25-0x0000000007D00000-0x0000000007D92000-memory.dmp

Download

memory/1116-27-0x0000000007EE0000-0x0000000007EF0000-memory.dmp

Download

memory/1116-28-0x0000000007EF0000-0x0000000007EFA000-memory.dmp

Download

memory/1116-30-0x0000000008DA0000-0x00000000093B8000-memory.dmp

Download

memory/1116-31-0x0000000008780000-0x000000000888A000-memory.dmp

Download

memory/1116-32-0x0000000007FC0000-0x0000000007FD2000-memory.dmp

Download

memory/1116-33-0x0000000008040000-0x000000000807C000-memory.dmp

Download

memory/1116-34-0x0000000008080000-0x00000000080CC000-memory.dmp

Download

memory/1116-35-0x0000000074020000-0x00000000747D0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads