privateloader | fb68898fc1ee1968d2f438649408cbb8854551c7efa6458a5175c462f02fda63

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 18:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd0d56c5cef765fb6cc44988f16cfea540a6eacff2349df1adde54d8bdf0ac15.exe
Size

1.1MB
MD5

27af7a4c719af0f00736750684474c33
SHA1

03e8e393f661280826fbc7e7576e584d0f3a9113
SHA256

cd0d56c5cef765fb6cc44988f16cfea540a6eacff2349df1adde54d8bdf0ac15
SHA512

17daa6adef43ef520e97df98ce819c87bdc5a0c093233a6bfab264a16d7ba6fe6ba9fa5a9e00506de4b1fb0aa937efe388943bfdfe67c47c06cbaf31fabc53a6
SSDEEP

24576:ry5DLDF4WsVdsl323tNupeEC4MI7WkuOUgyYKT57AZ5FG:eJLZObx3fIe6fykuN37APF

Score

10^/10

privateloader redline risepro horda infostealer loader persistence stealer

Malware Config

Extracted

Family

redline

Botnet

horda

194.49.94.152:19053

Extracted

Family

risepro

194.49.94.152

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral17/memory/3556-7-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
Executes dropped EXE 2 IoCs

Processes:

11iC1627.exe12vI527.exe

pid process

4332 11iC1627.exe
4072 12vI527.exe

pid	process
4332	11iC1627.exe
4072	12vI527.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

cd0d56c5cef765fb6cc44988f16cfea540a6eacff2349df1adde54d8bdf0ac15.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	cd0d56c5cef765fb6cc44988f16cfea540a6eacff2349df1adde54d8bdf0ac15.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

11iC1627.exe12vI527.exe

description	pid	process	target process
PID 4332 set thread context of 3556	4332	11iC1627.exe	AppLaunch.exe
PID 4072 set thread context of 4960	4072	12vI527.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

cd0d56c5cef765fb6cc44988f16cfea540a6eacff2349df1adde54d8bdf0ac15.exe11iC1627.exe12vI527.exe

description	pid	process	target process
PID 2728 wrote to memory of 4332	2728	cd0d56c5cef765fb6cc44988f16cfea540a6eacff2349df1adde54d8bdf0ac15.exe	11iC1627.exe
PID 2728 wrote to memory of 4332	2728	cd0d56c5cef765fb6cc44988f16cfea540a6eacff2349df1adde54d8bdf0ac15.exe	11iC1627.exe
PID 2728 wrote to memory of 4332	2728	cd0d56c5cef765fb6cc44988f16cfea540a6eacff2349df1adde54d8bdf0ac15.exe	11iC1627.exe
PID 4332 wrote to memory of 3556	4332	11iC1627.exe	AppLaunch.exe
PID 4332 wrote to memory of 3556	4332	11iC1627.exe	AppLaunch.exe
PID 4332 wrote to memory of 3556	4332	11iC1627.exe	AppLaunch.exe
PID 4332 wrote to memory of 3556	4332	11iC1627.exe	AppLaunch.exe
PID 4332 wrote to memory of 3556	4332	11iC1627.exe	AppLaunch.exe
PID 4332 wrote to memory of 3556	4332	11iC1627.exe	AppLaunch.exe
PID 4332 wrote to memory of 3556	4332	11iC1627.exe	AppLaunch.exe
PID 4332 wrote to memory of 3556	4332	11iC1627.exe	AppLaunch.exe
PID 2728 wrote to memory of 4072	2728	cd0d56c5cef765fb6cc44988f16cfea540a6eacff2349df1adde54d8bdf0ac15.exe	12vI527.exe
PID 2728 wrote to memory of 4072	2728	cd0d56c5cef765fb6cc44988f16cfea540a6eacff2349df1adde54d8bdf0ac15.exe	12vI527.exe
PID 2728 wrote to memory of 4072	2728	cd0d56c5cef765fb6cc44988f16cfea540a6eacff2349df1adde54d8bdf0ac15.exe	12vI527.exe
PID 4072 wrote to memory of 3012	4072	12vI527.exe	AppLaunch.exe
PID 4072 wrote to memory of 3012	4072	12vI527.exe	AppLaunch.exe
PID 4072 wrote to memory of 3012	4072	12vI527.exe	AppLaunch.exe
PID 4072 wrote to memory of 4960	4072	12vI527.exe	AppLaunch.exe
PID 4072 wrote to memory of 4960	4072	12vI527.exe	AppLaunch.exe
PID 4072 wrote to memory of 4960	4072	12vI527.exe	AppLaunch.exe
PID 4072 wrote to memory of 4960	4072	12vI527.exe	AppLaunch.exe
PID 4072 wrote to memory of 4960	4072	12vI527.exe	AppLaunch.exe
PID 4072 wrote to memory of 4960	4072	12vI527.exe	AppLaunch.exe
PID 4072 wrote to memory of 4960	4072	12vI527.exe	AppLaunch.exe
PID 4072 wrote to memory of 4960	4072	12vI527.exe	AppLaunch.exe
PID 4072 wrote to memory of 4960	4072	12vI527.exe	AppLaunch.exe
PID 4072 wrote to memory of 4960	4072	12vI527.exe	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\cd0d56c5cef765fb6cc44988f16cfea540a6eacff2349df1adde54d8bdf0ac15.exe
"C:\Users\Admin\AppData\Local\Temp\cd0d56c5cef765fb6cc44988f16cfea540a6eacff2349df1adde54d8bdf0ac15.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2728

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\11iC1627.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\11iC1627.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4332

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:3556

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\12vI527.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\12vI527.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4072

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:3012

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:4960

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\11iC1627.exe
Filesize
1.1MB

MD5
7bdc43eea5f420847643a5c6d7d8148f

SHA1
9a4ea91e124b65b65dc6b0f32f36e9d4030dd804

SHA256
556e681890f8ba42150bf026f78e08085279272654482f3015a1539e66146f08

SHA512
929979bc9756769a4c499f06aec1c67fd206cb9ae21b003217184be7bc3448e16c80a7c19cfdf470c06aebe7d17543ad7226cc9ffd423897a02b276fffe51ffb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\12vI527.exe
Filesize
2.4MB

MD5
617786f39d137442de90b81305e9f574

SHA1
72018811e58497bbe227f7af11441c2da0c9cf8e

SHA256
fc74737972cb37aa2577b8f08a0f0f53a628f743e7acce98451ff89a36ef51d7

SHA512
4306ae40325ab11733103c8665a0576efe470fb0cd2ac2c9449b902bd33508909db2e96143e8487bf1a7cef916ce56c50837415595edffaa9e6085c4d997126e

Download Submit
memory/3556-16-0x0000000008B80000-0x0000000009198000-memory.dmp

Filesize
6.1MB

Download
memory/3556-17-0x0000000007DA0000-0x0000000007EAA000-memory.dmp

Filesize
1.0MB

Download
memory/3556-12-0x0000000007FB0000-0x0000000008554000-memory.dmp

Filesize
5.6MB

Download
memory/3556-13-0x0000000007AA0000-0x0000000007B32000-memory.dmp

Filesize
584KB

Download
memory/3556-14-0x0000000002EE0000-0x0000000002EEA000-memory.dmp

Filesize
40KB

Download
memory/3556-15-0x0000000074000000-0x00000000747B0000-memory.dmp

Filesize
7.7MB

Download
memory/3556-7-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3556-18-0x0000000007C60000-0x0000000007C72000-memory.dmp

Filesize
72KB

Download
memory/3556-19-0x0000000007CD0000-0x0000000007D0C000-memory.dmp

Filesize
240KB

Download
memory/3556-10-0x000000007400E000-0x000000007400F000-memory.dmp

Filesize
4KB

Download
memory/3556-20-0x0000000007D10000-0x0000000007D5C000-memory.dmp

Filesize
304KB

Download
memory/3556-27-0x0000000074000000-0x00000000747B0000-memory.dmp

Filesize
7.7MB

Download
memory/3556-26-0x000000007400E000-0x000000007400F000-memory.dmp

Filesize
4KB

Download
memory/4960-24-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download
memory/4960-25-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download
memory/4960-23-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download
memory/4960-21-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download