privateloader | 92023f346ccc819d9c52da2af751cda1bc5396b5d745c68d99d1d2ff99db093a

Analysis

max time kernel
133s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 10:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6aec122dba60c94432d6aee116732395d28cda2ecb306d8ab832d137811ceeee.exe
Size

1.4MB
MD5

55f3afd7535f8c22d6d61c062a48613b
SHA1

6320045a41fb22d0125f65b4609d7386d1cf2f4b
SHA256

6aec122dba60c94432d6aee116732395d28cda2ecb306d8ab832d137811ceeee
SHA512

7d7ca3ec7865937d9bd1a6bd139417ba39071dadcd929c6fd7d72108597937a8e24afba26f126a62d798809db831b948b0027a79abf88cff5265ce2a4904969f
SSDEEP

24576:lyERVRikOROI9Dj9w0Lfve7noODwJZXcn96Fs5rNwnddTvMEFF1Bi:AEzMkId9wW0EJZM96FsFMTv/F

Score

10^/10

privateloader redline risepro smokeloader horda backdoor infostealer loader persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

horda

194.49.94.152:19053

Extracted

Family

risepro

194.49.94.152

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral14/memory/2912-21-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

.NET Reactor proctector 2 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral14/memory/4284-46-0x0000000002460000-0x0000000002480000-memory.dmp	net_reactor
behavioral14/memory/4284-47-0x0000000004F50000-0x0000000004F6E000-memory.dmp	net_reactor

Executes dropped EXE 6 IoCs

pid	Process
208	Og3xi85.exe
116	sk7no87.exe
1784	2Wb3505.exe
624	4KL760Ws.exe
3052	5oH5YD9.exe
4284	6Lc6YC0.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6aec122dba60c94432d6aee116732395d28cda2ecb306d8ab832d137811ceeee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Og3xi85.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	sk7no87.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1784 set thread context of 2912	1784	2Wb3505.exe	89
PID 624 set thread context of 3932	624	4KL760Ws.exe	93

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	5oH5YD9.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	5oH5YD9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	5oH5YD9.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4284	6Lc6YC0.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 208	2976	6aec122dba60c94432d6aee116732395d28cda2ecb306d8ab832d137811ceeee.exe	83
PID 2976 wrote to memory of 208	2976	6aec122dba60c94432d6aee116732395d28cda2ecb306d8ab832d137811ceeee.exe	83
PID 2976 wrote to memory of 208	2976	6aec122dba60c94432d6aee116732395d28cda2ecb306d8ab832d137811ceeee.exe	83
PID 208 wrote to memory of 116	208	Og3xi85.exe	84
PID 208 wrote to memory of 116	208	Og3xi85.exe	84
PID 208 wrote to memory of 116	208	Og3xi85.exe	84
PID 116 wrote to memory of 1784	116	sk7no87.exe	87
PID 116 wrote to memory of 1784	116	sk7no87.exe	87
PID 116 wrote to memory of 1784	116	sk7no87.exe	87
PID 1784 wrote to memory of 2912	1784	2Wb3505.exe	89
PID 1784 wrote to memory of 2912	1784	2Wb3505.exe	89
PID 1784 wrote to memory of 2912	1784	2Wb3505.exe	89
PID 1784 wrote to memory of 2912	1784	2Wb3505.exe	89
PID 1784 wrote to memory of 2912	1784	2Wb3505.exe	89
PID 1784 wrote to memory of 2912	1784	2Wb3505.exe	89
PID 1784 wrote to memory of 2912	1784	2Wb3505.exe	89
PID 1784 wrote to memory of 2912	1784	2Wb3505.exe	89
PID 116 wrote to memory of 624	116	sk7no87.exe	91
PID 116 wrote to memory of 624	116	sk7no87.exe	91
PID 116 wrote to memory of 624	116	sk7no87.exe	91
PID 624 wrote to memory of 3932	624	4KL760Ws.exe	93
PID 624 wrote to memory of 3932	624	4KL760Ws.exe	93
PID 624 wrote to memory of 3932	624	4KL760Ws.exe	93
PID 624 wrote to memory of 3932	624	4KL760Ws.exe	93
PID 624 wrote to memory of 3932	624	4KL760Ws.exe	93
PID 624 wrote to memory of 3932	624	4KL760Ws.exe	93
PID 624 wrote to memory of 3932	624	4KL760Ws.exe	93
PID 624 wrote to memory of 3932	624	4KL760Ws.exe	93
PID 624 wrote to memory of 3932	624	4KL760Ws.exe	93
PID 624 wrote to memory of 3932	624	4KL760Ws.exe	93
PID 208 wrote to memory of 3052	208	Og3xi85.exe	95
PID 208 wrote to memory of 3052	208	Og3xi85.exe	95
PID 208 wrote to memory of 3052	208	Og3xi85.exe	95
PID 2976 wrote to memory of 4284	2976	6aec122dba60c94432d6aee116732395d28cda2ecb306d8ab832d137811ceeee.exe	103
PID 2976 wrote to memory of 4284	2976	6aec122dba60c94432d6aee116732395d28cda2ecb306d8ab832d137811ceeee.exe	103
PID 2976 wrote to memory of 4284	2976	6aec122dba60c94432d6aee116732395d28cda2ecb306d8ab832d137811ceeee.exe	103

C:\Users\Admin\AppData\Local\Temp\6aec122dba60c94432d6aee116732395d28cda2ecb306d8ab832d137811ceeee.exe
"C:\Users\Admin\AppData\Local\Temp\6aec122dba60c94432d6aee116732395d28cda2ecb306d8ab832d137811ceeee.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Og3xi85.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Og3xi85.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:208
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sk7no87.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sk7no87.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:116
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Wb3505.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Wb3505.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:1784
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        
        PID:2912
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4KL760Ws.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4KL760Ws.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:624
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        
        PID:3932
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5oH5YD9.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5oH5YD9.exe
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:3052
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Lc6YC0.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Lc6YC0.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Lc6YC0.exe

Filesize
189KB

MD5
f4af3a9bb5b128ea7f4a49016ae8de1f

SHA1
77e47932af41b3af5bfff73d2a4c9773dc224f0d

SHA256
195fa6ff08dd55ff8f112c0323885bc06e1d28ce38edae26cce1e33b23337ff1

SHA512
1067017da68040e8e1eab228773c37cba180731f8792462d94e1e52cc12eb63e5306b3ffbc1fb4f0047a9d29e8a060649b5914bb25ece9c2c37b75e143c50df2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Og3xi85.exe

Filesize
1.2MB

MD5
041a40bd8d925f4800e6a3d91fdc2a7e

SHA1
0271e607673aaf811349ee7a47c206fb107f62e1

SHA256
6990994a997d41eed4f816696e6e8b4d38f0f9f8145135d40d325d1152c955e2

SHA512
44319217df9e61e521814fc2ddca32d6be1d6beea2222a147f2c69bd4d58c4933b47fbea9e05f974d5c9a2e431468b89ead7e5ae80f410491b25bfd8df2fbd4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5oH5YD9.exe

Filesize
37KB

MD5
0347ea57ab6936886c20088c49d651d2

SHA1
8e1cb53b2528b0edd515fd60fe50fde8423af6d2

SHA256
9cd2a65eaad5be25fcf2f3c80070f42d6de27e2296857ad7b65e98be2af217a2

SHA512
55507702a488c9c20c783cc731722ef7b7c5af4a8890fe838f59f79266262304b3515c93e66fc16aa701ddb40233cee58bcc11873a88280b99e4d6876ea4c3db

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sk7no87.exe

Filesize
1.1MB

MD5
224c580b0568032962a8da9d3a389910

SHA1
813f7abf06368de6fee68f9e44d73ce00627b6a0

SHA256
bf931afd2df5b23f8f4b493e313eec865ea394f448d50a6aa410cbdf8d4063b7

SHA512
dd49856972c97ebb3b95571b7d7f7917c7289dabaa1c4f16cd73e322bb1249745d660a7a55c6ff0534613105ef7f51fb47867daaad1d1b19077e08df6250f491

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Wb3505.exe

Filesize
1.1MB

MD5
4d2d66619b13dae57df7d66c5f9565b5

SHA1
8ea0128a499fa9518cfcb9681e7ea7930b16954d

SHA256
9b71fa55acdd6d096cbb32b1fb7116dfe9f2b92d5a27b429d014fd4dd3521cae

SHA512
76cf3f81295a96b09d0f3c30c325f93be7f4617a51c132a6a998314e5487499f06de1039edb9721456910c3af29b86c450dd9f99c3445b729443e700a0beded1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4KL760Ws.exe

Filesize
2.4MB

MD5
efb389a61f71507ca099e941556582bf

SHA1
edeeefca690650127ccbf9bf16352ef20ef929cb

SHA256
a9420416556acce9d5601d190457412ca2a5c548db12ee03921c3460d19334b2

SHA512
5a21547b4a9179a56c49ac080d0c3bf3be0d27eda284e03d0dd652852e59a5389c59116daa0b71117fbfed86dba5feaec2d42be320fec0d5ed3eeffe9d992a6a

Download Submit
memory/2912-31-0x0000000007790000-0x00000000077A2000-memory.dmp

Filesize
72KB

Download
memory/2912-25-0x0000000007BB0000-0x0000000008154000-memory.dmp

Filesize
5.6MB

Download
memory/2912-28-0x0000000008780000-0x0000000008D98000-memory.dmp

Filesize
6.1MB

Download
memory/2912-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2912-26-0x00000000076A0000-0x0000000007732000-memory.dmp

Filesize
584KB

Download
memory/2912-30-0x00000000079E0000-0x0000000007AEA000-memory.dmp

Filesize
1.0MB

Download
memory/2912-32-0x0000000007910000-0x000000000794C000-memory.dmp

Filesize
240KB

Download
memory/2912-33-0x0000000007950000-0x000000000799C000-memory.dmp

Filesize
304KB

Download
memory/2912-27-0x0000000002C70000-0x0000000002C7A000-memory.dmp

Filesize
40KB

Download
memory/3052-42-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3052-41-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3932-34-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download
memory/3932-37-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download
memory/3932-36-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download
memory/3932-29-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download
memory/4284-46-0x0000000002460000-0x0000000002480000-memory.dmp

Filesize
128KB

Download
memory/4284-47-0x0000000004F50000-0x0000000004F6E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads