privateloader | d210b038c83af1db1e65d2531b094451830722acaacbecce0048b62a4aa68c25

Analysis

max time kernel
296s
max time network
301s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
02/05/2024, 06:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d210b038c83af1db1e65d2531b094451830722acaacbecce0048b62a4aa68c25.exe
Size

3.0MB
MD5

9244c9152a1da8e7b2d5760c7312b65e
SHA1

fd5ee2bd38f508872ba2f1c32092713153aff99d
SHA256

d210b038c83af1db1e65d2531b094451830722acaacbecce0048b62a4aa68c25
SHA512

3126e3782408af44bc4598670cb43e65cdc6b1a7a7a84c2974aaaef590c396c39a6ed533adbf2aedac0568c1d7a729c916d9362e76cd666eaa64f392d13c430b
SSDEEP

49152:odQJdpyT6EmAWwOwTQdni6e/JKmdsFv/7nXTF5aXNVaBoqT24Ni/VM8apcTpe:odMdpIfWwITEKmWRLTF8/X/CIo

Score

10^/10

privateloader risepro loader persistence stealer vmprotect

Malware Config

Extracted

Family

risepro

194.169.175.128

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster1.lnk	d210b038c83af1db1e65d2531b094451830722acaacbecce0048b62a4aa68c25.exe

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/2540-1-0x0000000000DC0000-0x0000000001326000-memory.dmp	vmprotect
behavioral2/files/0x000700000001abef-8.dat	vmprotect

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest1 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest1\\MaxLoonaFest1.exe"	d210b038c83af1db1e65d2531b094451830722acaacbecce0048b62a4aa68c25.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2896	schtasks.exe
4532	schtasks.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2896	2540	d210b038c83af1db1e65d2531b094451830722acaacbecce0048b62a4aa68c25.exe	73
PID 2540 wrote to memory of 2896	2540	d210b038c83af1db1e65d2531b094451830722acaacbecce0048b62a4aa68c25.exe	73
PID 2540 wrote to memory of 2896	2540	d210b038c83af1db1e65d2531b094451830722acaacbecce0048b62a4aa68c25.exe	73
PID 2540 wrote to memory of 4532	2540	d210b038c83af1db1e65d2531b094451830722acaacbecce0048b62a4aa68c25.exe	75
PID 2540 wrote to memory of 4532	2540	d210b038c83af1db1e65d2531b094451830722acaacbecce0048b62a4aa68c25.exe	75
PID 2540 wrote to memory of 4532	2540	d210b038c83af1db1e65d2531b094451830722acaacbecce0048b62a4aa68c25.exe	75

C:\Users\Admin\AppData\Local\Temp\d210b038c83af1db1e65d2531b094451830722acaacbecce0048b62a4aa68c25.exe
"C:\Users\Admin\AppData\Local\Temp\d210b038c83af1db1e65d2531b094451830722acaacbecce0048b62a4aa68c25.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP1\OfficeTrackerNMP1.exe" /tn "OfficeTrackerNMP1 HR" /sc HOURLY /rl HIGHEST
  2⤵
  - Creates scheduled task(s)
  PID:2896
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP1\OfficeTrackerNMP1.exe" /tn "OfficeTrackerNMP1 LG" /sc ONLOGON /rl HIGHEST
  2⤵
  - Creates scheduled task(s)
  PID:4532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\OfficeTrackerNMP1\OfficeTrackerNMP1.exe

Filesize
3.0MB

MD5
9244c9152a1da8e7b2d5760c7312b65e

SHA1
fd5ee2bd38f508872ba2f1c32092713153aff99d

SHA256
d210b038c83af1db1e65d2531b094451830722acaacbecce0048b62a4aa68c25

SHA512
3126e3782408af44bc4598670cb43e65cdc6b1a7a7a84c2974aaaef590c396c39a6ed533adbf2aedac0568c1d7a729c916d9362e76cd666eaa64f392d13c430b

Download Submit
memory/2540-1-0x0000000000DC0000-0x0000000001326000-memory.dmp

Filesize
5.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads