Analysis
-
max time kernel
142s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2023 14:31
Static task
static1
Behavioral task
behavioral1
Sample
a465dd9538d1a320f8f022fddfe4c556.exe
Resource
win10v2004-20231127-en
General
-
Target
a465dd9538d1a320f8f022fddfe4c556.exe
-
Size
1.5MB
-
MD5
a465dd9538d1a320f8f022fddfe4c556
-
SHA1
d72d87365bf35a1ae0eeba53d6fdd37509c6e80a
-
SHA256
29b56c8ff017cf879af21388f2bfac638bdf133016db79e41edc06d2089b1682
-
SHA512
4d2d8eb9a4218a684361e5f53cb798b157daada165ab14ac2e1088017a61a884f145d0a1e2071289fed21913dff11e7b9824b776f44d1902fffb7a7636a1a2fa
-
SSDEEP
24576:GyIRhzJDSJNogVkDY6jwx6ebX5RLD+D28WlhDiUUbhEIxgWaxL6Ek7f:VSvcNxKDX8keT5RmDe5iHhs5UE
Malware Config
Extracted
risepro
194.49.94.152
Signatures
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Drops startup file 1 IoCs
Processes:
1JS70pt9.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk 1JS70pt9.exe -
Executes dropped EXE 3 IoCs
Processes:
yQ2SO18.exeUt0Xb98.exe1JS70pt9.exepid process 3848 yQ2SO18.exe 4216 Ut0Xb98.exe 4116 1JS70pt9.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
yQ2SO18.exeUt0Xb98.exe1JS70pt9.exea465dd9538d1a320f8f022fddfe4c556.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" yQ2SO18.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" Ut0Xb98.exe Set value (str) \REGISTRY\USER\S-1-5-21-3028534956-1709433221-1313273668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe" 1JS70pt9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" a465dd9538d1a320f8f022fddfe4c556.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1292 schtasks.exe 4668 schtasks.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
a465dd9538d1a320f8f022fddfe4c556.exeyQ2SO18.exeUt0Xb98.exe1JS70pt9.exedescription pid process target process PID 4616 wrote to memory of 3848 4616 a465dd9538d1a320f8f022fddfe4c556.exe yQ2SO18.exe PID 4616 wrote to memory of 3848 4616 a465dd9538d1a320f8f022fddfe4c556.exe yQ2SO18.exe PID 4616 wrote to memory of 3848 4616 a465dd9538d1a320f8f022fddfe4c556.exe yQ2SO18.exe PID 3848 wrote to memory of 4216 3848 yQ2SO18.exe Ut0Xb98.exe PID 3848 wrote to memory of 4216 3848 yQ2SO18.exe Ut0Xb98.exe PID 3848 wrote to memory of 4216 3848 yQ2SO18.exe Ut0Xb98.exe PID 4216 wrote to memory of 4116 4216 Ut0Xb98.exe 1JS70pt9.exe PID 4216 wrote to memory of 4116 4216 Ut0Xb98.exe 1JS70pt9.exe PID 4216 wrote to memory of 4116 4216 Ut0Xb98.exe 1JS70pt9.exe PID 4116 wrote to memory of 1292 4116 1JS70pt9.exe schtasks.exe PID 4116 wrote to memory of 1292 4116 1JS70pt9.exe schtasks.exe PID 4116 wrote to memory of 1292 4116 1JS70pt9.exe schtasks.exe PID 4116 wrote to memory of 4668 4116 1JS70pt9.exe schtasks.exe PID 4116 wrote to memory of 4668 4116 1JS70pt9.exe schtasks.exe PID 4116 wrote to memory of 4668 4116 1JS70pt9.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a465dd9538d1a320f8f022fddfe4c556.exe"C:\Users\Admin\AppData\Local\Temp\a465dd9538d1a320f8f022fddfe4c556.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yQ2SO18.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yQ2SO18.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ut0Xb98.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ut0Xb98.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1JS70pt9.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1JS70pt9.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST5⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\FANBooster131\FANBooster131.exeFilesize
1.5MB
MD57159297216600f25958e8a3f6f9a2dd0
SHA1be92fa38a9c7bdf47f3a79bef3298d24aff0df8a
SHA256e3ec357f54b7b501e56039e3b7e1de872d2bad5391ec52f4c49858b20482d650
SHA5128826f98ea6bd2ecfc32dd95970ba16cc4e03cd688eb308078ccf533828308cec06a2b3b2e579e0cb4fc14fef8d2c0ff73a3352e723f38c64a8e55d72ad981197
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yQ2SO18.exeFilesize
1012KB
MD5991b69f5d680e1363fd8162bfbd95700
SHA1eadde07686d8ddc3dc79b5c24d0bb3664f6f1f88
SHA256d98c95b90ede33b1b5c2543fab1630438afd5c59f93fccfb7509fc6a0b7cf4f0
SHA512f46eba07cebbff29a9c3ba583d0869f615e530b61c02f5c4893bb62987881a0a2e7f5494c37ebcd569323ccaabac70ab2bc6c20c6052d0dda368ae6b4247a164
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yQ2SO18.exeFilesize
1012KB
MD5991b69f5d680e1363fd8162bfbd95700
SHA1eadde07686d8ddc3dc79b5c24d0bb3664f6f1f88
SHA256d98c95b90ede33b1b5c2543fab1630438afd5c59f93fccfb7509fc6a0b7cf4f0
SHA512f46eba07cebbff29a9c3ba583d0869f615e530b61c02f5c4893bb62987881a0a2e7f5494c37ebcd569323ccaabac70ab2bc6c20c6052d0dda368ae6b4247a164
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ut0Xb98.exeFilesize
888KB
MD54b4b100049d0225c2c653cf89f776b6e
SHA18fd001ffe89def9f7ff3ab6b09f1150ab7c5fa50
SHA256278eddb11a1189c796fd65d129fc628b7eede71eb49580f075cc6e8a878a54d3
SHA5124f45154d86851ee149ea79053b6d7b6aa9dd28c57724c28ba166e347d6679c748a1352e41e3ff799d81cbb7f9fbe47fb04b866e6708323f9f119bdb2a3a883e7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ut0Xb98.exeFilesize
888KB
MD54b4b100049d0225c2c653cf89f776b6e
SHA18fd001ffe89def9f7ff3ab6b09f1150ab7c5fa50
SHA256278eddb11a1189c796fd65d129fc628b7eede71eb49580f075cc6e8a878a54d3
SHA5124f45154d86851ee149ea79053b6d7b6aa9dd28c57724c28ba166e347d6679c748a1352e41e3ff799d81cbb7f9fbe47fb04b866e6708323f9f119bdb2a3a883e7
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1JS70pt9.exeFilesize
1.5MB
MD57159297216600f25958e8a3f6f9a2dd0
SHA1be92fa38a9c7bdf47f3a79bef3298d24aff0df8a
SHA256e3ec357f54b7b501e56039e3b7e1de872d2bad5391ec52f4c49858b20482d650
SHA5128826f98ea6bd2ecfc32dd95970ba16cc4e03cd688eb308078ccf533828308cec06a2b3b2e579e0cb4fc14fef8d2c0ff73a3352e723f38c64a8e55d72ad981197
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1JS70pt9.exeFilesize
1.5MB
MD57159297216600f25958e8a3f6f9a2dd0
SHA1be92fa38a9c7bdf47f3a79bef3298d24aff0df8a
SHA256e3ec357f54b7b501e56039e3b7e1de872d2bad5391ec52f4c49858b20482d650
SHA5128826f98ea6bd2ecfc32dd95970ba16cc4e03cd688eb308078ccf533828308cec06a2b3b2e579e0cb4fc14fef8d2c0ff73a3352e723f38c64a8e55d72ad981197