Analysis
-
max time kernel
135s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2023 08:50
Static task
static1
Behavioral task
behavioral1
Sample
a2a1aa7c9939633566c1449fd70c8f452ac60ad28f4e17bbd303f952b11ef5ca.exe
Resource
win10v2004-20231127-en
General
-
Target
a2a1aa7c9939633566c1449fd70c8f452ac60ad28f4e17bbd303f952b11ef5ca.exe
-
Size
1.9MB
-
MD5
9dadcb36329348c3632e89418947df14
-
SHA1
a7af32599c5a3bdb838117b6fa6083f495dcfc9c
-
SHA256
a2a1aa7c9939633566c1449fd70c8f452ac60ad28f4e17bbd303f952b11ef5ca
-
SHA512
327355722c6adfe9ee50da10432a96c8291261e779580208be1c246189d79e92805ced326c1c4a5d587fccd01d84b0bead6fb7c9696f75d37a1b081c8fd51373
-
SSDEEP
49152:xiht3UV4R4q3XT8xn+ENcvrUI3qwIRCNyoEn8zIJ2wPD5:8f3UV4RPN5qwf28zg2o
Malware Config
Extracted
risepro
194.49.94.152
Signatures
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Drops startup file 1 IoCs
Processes:
1PJ96IA1.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk 1PJ96IA1.exe -
Executes dropped EXE 4 IoCs
Processes:
Iy8Pb09.exeNr2tr14.exeLF0Lw46.exe1PJ96IA1.exepid process 4472 Iy8Pb09.exe 1408 Nr2tr14.exe 3592 LF0Lw46.exe 3816 1PJ96IA1.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
a2a1aa7c9939633566c1449fd70c8f452ac60ad28f4e17bbd303f952b11ef5ca.exeIy8Pb09.exeNr2tr14.exeLF0Lw46.exe1PJ96IA1.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" a2a1aa7c9939633566c1449fd70c8f452ac60ad28f4e17bbd303f952b11ef5ca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" Iy8Pb09.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" Nr2tr14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" LF0Lw46.exe Set value (str) \REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe" 1PJ96IA1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3392 schtasks.exe 2672 schtasks.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
a2a1aa7c9939633566c1449fd70c8f452ac60ad28f4e17bbd303f952b11ef5ca.exeIy8Pb09.exeNr2tr14.exeLF0Lw46.exe1PJ96IA1.exedescription pid process target process PID 1000 wrote to memory of 4472 1000 a2a1aa7c9939633566c1449fd70c8f452ac60ad28f4e17bbd303f952b11ef5ca.exe Iy8Pb09.exe PID 1000 wrote to memory of 4472 1000 a2a1aa7c9939633566c1449fd70c8f452ac60ad28f4e17bbd303f952b11ef5ca.exe Iy8Pb09.exe PID 1000 wrote to memory of 4472 1000 a2a1aa7c9939633566c1449fd70c8f452ac60ad28f4e17bbd303f952b11ef5ca.exe Iy8Pb09.exe PID 4472 wrote to memory of 1408 4472 Iy8Pb09.exe Nr2tr14.exe PID 4472 wrote to memory of 1408 4472 Iy8Pb09.exe Nr2tr14.exe PID 4472 wrote to memory of 1408 4472 Iy8Pb09.exe Nr2tr14.exe PID 1408 wrote to memory of 3592 1408 Nr2tr14.exe LF0Lw46.exe PID 1408 wrote to memory of 3592 1408 Nr2tr14.exe LF0Lw46.exe PID 1408 wrote to memory of 3592 1408 Nr2tr14.exe LF0Lw46.exe PID 3592 wrote to memory of 3816 3592 LF0Lw46.exe 1PJ96IA1.exe PID 3592 wrote to memory of 3816 3592 LF0Lw46.exe 1PJ96IA1.exe PID 3592 wrote to memory of 3816 3592 LF0Lw46.exe 1PJ96IA1.exe PID 3816 wrote to memory of 3392 3816 1PJ96IA1.exe schtasks.exe PID 3816 wrote to memory of 3392 3816 1PJ96IA1.exe schtasks.exe PID 3816 wrote to memory of 3392 3816 1PJ96IA1.exe schtasks.exe PID 3816 wrote to memory of 2672 3816 1PJ96IA1.exe schtasks.exe PID 3816 wrote to memory of 2672 3816 1PJ96IA1.exe schtasks.exe PID 3816 wrote to memory of 2672 3816 1PJ96IA1.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2a1aa7c9939633566c1449fd70c8f452ac60ad28f4e17bbd303f952b11ef5ca.exe"C:\Users\Admin\AppData\Local\Temp\a2a1aa7c9939633566c1449fd70c8f452ac60ad28f4e17bbd303f952b11ef5ca.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Iy8Pb09.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Iy8Pb09.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Nr2tr14.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Nr2tr14.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\LF0Lw46.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\LF0Lw46.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1PJ96IA1.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1PJ96IA1.exe5⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST6⤵
- Creates scheduled task(s)
PID:3392 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST6⤵
- Creates scheduled task(s)
PID:2672
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD5daf9efd5972f056fb2240233be2995fb
SHA14a12dd380583504c8ee9f73c868370dbc0f132d0
SHA256a36f16473b379fc85d7e67e1d4b87de129045e18af4488feede66d1fb363b7fd
SHA5128d2adcd95c55f9cc3fc4e474bac4e978ba26f366a8b5e50a049f954141d56214df40f9ccf86c17a4653b614cf8aad27ad4fccaef1b9555867ed8a36f4f25a1ed
-
Filesize
1.6MB
MD5decf95dbc4d2893779d4670e83b2d790
SHA126006a141792996e5c71e5e9b6894fd3776f84b7
SHA256d765ed37f364f975a3225f221d62b1a750db6ec2875a5cf59c84ff1b87dd144f
SHA512ce14bb24a59dc520d60dfef695ad509e5bbcf64ad1d7d12a195b2b3f573a7153277b3180bd87e921cc2e3a3646224fad86cbfd59f94f990b517c1580fee51043
-
Filesize
1.6MB
MD5decf95dbc4d2893779d4670e83b2d790
SHA126006a141792996e5c71e5e9b6894fd3776f84b7
SHA256d765ed37f364f975a3225f221d62b1a750db6ec2875a5cf59c84ff1b87dd144f
SHA512ce14bb24a59dc520d60dfef695ad509e5bbcf64ad1d7d12a195b2b3f573a7153277b3180bd87e921cc2e3a3646224fad86cbfd59f94f990b517c1580fee51043
-
Filesize
1.1MB
MD58c65fdd10f66aa83dd8254bd16ec1ff3
SHA1ee882e92f781cadf6fbecf35e846313533e9e078
SHA2563932f1aa29471372dded847203b95856e12dfed64d47deee79e4405bfb26b0a5
SHA512b1bc1ed1c79bbc082864ea3fc497d3569a5166e9847da0df1c80eaffbbdbbdf680ed3b135073e698da826e52c5fd84e1e19074cdca25247aa9af7cb1cadea4e3
-
Filesize
1.1MB
MD58c65fdd10f66aa83dd8254bd16ec1ff3
SHA1ee882e92f781cadf6fbecf35e846313533e9e078
SHA2563932f1aa29471372dded847203b95856e12dfed64d47deee79e4405bfb26b0a5
SHA512b1bc1ed1c79bbc082864ea3fc497d3569a5166e9847da0df1c80eaffbbdbbdf680ed3b135073e698da826e52c5fd84e1e19074cdca25247aa9af7cb1cadea4e3
-
Filesize
1005KB
MD521567ed28114c44a7bbf5eed6eb5c003
SHA169e28fdb5e371e04324adbe9c1348582906dbf97
SHA256323e5fb932e323d3672cfe2bcc3b0d3c23cb8a50cad3eadb684735fceec90dde
SHA51284b227e32cd7996908549bde5b0e7d5e296beb03eb6c6cf5b74a922a0ca6d8d27839ab2d2f7f9c9781737dc9e2864d35fc4ef951a85b9ad98fd83ce9346ab955
-
Filesize
1005KB
MD521567ed28114c44a7bbf5eed6eb5c003
SHA169e28fdb5e371e04324adbe9c1348582906dbf97
SHA256323e5fb932e323d3672cfe2bcc3b0d3c23cb8a50cad3eadb684735fceec90dde
SHA51284b227e32cd7996908549bde5b0e7d5e296beb03eb6c6cf5b74a922a0ca6d8d27839ab2d2f7f9c9781737dc9e2864d35fc4ef951a85b9ad98fd83ce9346ab955
-
Filesize
1.5MB
MD5daf9efd5972f056fb2240233be2995fb
SHA14a12dd380583504c8ee9f73c868370dbc0f132d0
SHA256a36f16473b379fc85d7e67e1d4b87de129045e18af4488feede66d1fb363b7fd
SHA5128d2adcd95c55f9cc3fc4e474bac4e978ba26f366a8b5e50a049f954141d56214df40f9ccf86c17a4653b614cf8aad27ad4fccaef1b9555867ed8a36f4f25a1ed
-
Filesize
1.5MB
MD5daf9efd5972f056fb2240233be2995fb
SHA14a12dd380583504c8ee9f73c868370dbc0f132d0
SHA256a36f16473b379fc85d7e67e1d4b87de129045e18af4488feede66d1fb363b7fd
SHA5128d2adcd95c55f9cc3fc4e474bac4e978ba26f366a8b5e50a049f954141d56214df40f9ccf86c17a4653b614cf8aad27ad4fccaef1b9555867ed8a36f4f25a1ed