privateloader | 2dae798f2fcb49ad5f375700dcbe54c08e9cc5c25fe542ebd7939aa5f5f023aa

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 18:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16688c383c392aa6325c78d89165cf92d6a9aa6243e19fe6c19d73fb522546d0.exe
Size

1.4MB
MD5

c2b04fbeb2611c15bdb5a55b47bb6675
SHA1

2c21a5848c237d1fd171cd788e5c4a0bf9b990fc
SHA256

16688c383c392aa6325c78d89165cf92d6a9aa6243e19fe6c19d73fb522546d0
SHA512

1769369ad7a8d445ba23da9c1aadb065101bca1656329eb454f64414eab873be895df470fd571e8777fc5836a3e4cc82a0e7798f85321efe8de2a003243d1e26
SSDEEP

24576:XyJ+jSTeTLVcPbco+tQAx69bZfkYzP89dkQHnCAys50R8IH:iJ+jSTeTL+PbUnExU3CAsR8

Score

10^/10

privateloader redline risepro horda infostealer loader persistence stealer

Malware Config

Extracted

Family

redline

Botnet

horda

194.49.94.152:19053

Extracted

Family

risepro

194.49.94.152

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral4/memory/1468-21-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
Drops startup file 1 IoCs

Processes:

3RJ81vb.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk 3RJ81vb.exe
Executes dropped EXE 4 IoCs

Processes:

hq2OZ35.exeSx8Ym41.exe2gy7268.exe3RJ81vb.exe

pid process

4504 hq2OZ35.exe
2412 Sx8Ym41.exe
1064 2gy7268.exe
2904 3RJ81vb.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk	3RJ81vb.exe

pid	process
4504	hq2OZ35.exe
2412	Sx8Ym41.exe
1064	2gy7268.exe
2904	3RJ81vb.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

16688c383c392aa6325c78d89165cf92d6a9aa6243e19fe6c19d73fb522546d0.exehq2OZ35.exeSx8Ym41.exe3RJ81vb.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	16688c383c392aa6325c78d89165cf92d6a9aa6243e19fe6c19d73fb522546d0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	hq2OZ35.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	Sx8Ym41.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe"	3RJ81vb.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

2gy7268.exe

description pid process target process

PID 1064 set thread context of 1468 1064 2gy7268.exe AppLaunch.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

5000 schtasks.exe
2576 schtasks.exe

description	pid	process	target process
PID 1064 set thread context of 1468	1064	2gy7268.exe	AppLaunch.exe

pid	process
5000	schtasks.exe
2576	schtasks.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

16688c383c392aa6325c78d89165cf92d6a9aa6243e19fe6c19d73fb522546d0.exehq2OZ35.exeSx8Ym41.exe2gy7268.exe3RJ81vb.exe

description	pid	process	target process
PID 4716 wrote to memory of 4504	4716	16688c383c392aa6325c78d89165cf92d6a9aa6243e19fe6c19d73fb522546d0.exe	hq2OZ35.exe
PID 4716 wrote to memory of 4504	4716	16688c383c392aa6325c78d89165cf92d6a9aa6243e19fe6c19d73fb522546d0.exe	hq2OZ35.exe
PID 4716 wrote to memory of 4504	4716	16688c383c392aa6325c78d89165cf92d6a9aa6243e19fe6c19d73fb522546d0.exe	hq2OZ35.exe
PID 4504 wrote to memory of 2412	4504	hq2OZ35.exe	Sx8Ym41.exe
PID 4504 wrote to memory of 2412	4504	hq2OZ35.exe	Sx8Ym41.exe
PID 4504 wrote to memory of 2412	4504	hq2OZ35.exe	Sx8Ym41.exe
PID 2412 wrote to memory of 1064	2412	Sx8Ym41.exe	2gy7268.exe
PID 2412 wrote to memory of 1064	2412	Sx8Ym41.exe	2gy7268.exe
PID 2412 wrote to memory of 1064	2412	Sx8Ym41.exe	2gy7268.exe
PID 1064 wrote to memory of 1468	1064	2gy7268.exe	AppLaunch.exe
PID 1064 wrote to memory of 1468	1064	2gy7268.exe	AppLaunch.exe
PID 1064 wrote to memory of 1468	1064	2gy7268.exe	AppLaunch.exe
PID 1064 wrote to memory of 1468	1064	2gy7268.exe	AppLaunch.exe
PID 1064 wrote to memory of 1468	1064	2gy7268.exe	AppLaunch.exe
PID 1064 wrote to memory of 1468	1064	2gy7268.exe	AppLaunch.exe
PID 1064 wrote to memory of 1468	1064	2gy7268.exe	AppLaunch.exe
PID 1064 wrote to memory of 1468	1064	2gy7268.exe	AppLaunch.exe
PID 2412 wrote to memory of 2904	2412	Sx8Ym41.exe	3RJ81vb.exe
PID 2412 wrote to memory of 2904	2412	Sx8Ym41.exe	3RJ81vb.exe
PID 2412 wrote to memory of 2904	2412	Sx8Ym41.exe	3RJ81vb.exe
PID 2904 wrote to memory of 5000	2904	3RJ81vb.exe	schtasks.exe
PID 2904 wrote to memory of 5000	2904	3RJ81vb.exe	schtasks.exe
PID 2904 wrote to memory of 5000	2904	3RJ81vb.exe	schtasks.exe
PID 2904 wrote to memory of 2576	2904	3RJ81vb.exe	schtasks.exe
PID 2904 wrote to memory of 2576	2904	3RJ81vb.exe	schtasks.exe
PID 2904 wrote to memory of 2576	2904	3RJ81vb.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\16688c383c392aa6325c78d89165cf92d6a9aa6243e19fe6c19d73fb522546d0.exe
"C:\Users\Admin\AppData\Local\Temp\16688c383c392aa6325c78d89165cf92d6a9aa6243e19fe6c19d73fb522546d0.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4716

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\hq2OZ35.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\hq2OZ35.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4504

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Sx8Ym41.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Sx8Ym41.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2412

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2gy7268.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2gy7268.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1064

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
5⤵
PID:1468

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3RJ81vb.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3RJ81vb.exe
4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2904

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
5⤵
- Creates scheduled task(s)
PID:5000

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
5⤵
- Creates scheduled task(s)
PID:2576

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\hq2OZ35.exe
Filesize
1.2MB

MD5
2d0c662657f8e4e86cda4ffebac880e2

SHA1
030ea4f01ca68d3757ba218e37f982ef76d09ebf

SHA256
6387fb65c79f680dd09397ad45b4d9fc54e6c09ae8aea107c3d9425716eb7fba

SHA512
fbbb6086022fccaa144190b750b3188fd943c6b000961eed72b9dce25b06ac8dbd7828e969ecbf9852fe5bbf68ffda80069dc4742c2abe188807986dfe96d6c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Sx8Ym41.exe
Filesize
1.1MB

MD5
1d27bd571049766515c6475c2ca57fb4

SHA1
830b8cf6ab988cc1f965a9240fc1baf93186129b

SHA256
15b01fe0740b07587b34c40b152e381dc29f5eedf4e7cb9b0307fda2177f87b0

SHA512
abf0d6788940080d880116bf7f211e8b0140b3386fcd011b31a7e47378e1b43dc491eddd0291330b4039174b00031b09706b9d3012c339f78ed13fc9c16a507a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2gy7268.exe
Filesize
1.9MB

MD5
cb2fc4892530b25677483b972cccd2b6

SHA1
ee981f7c87e3a4123fc1797194d39f2a82adf8e8

SHA256
da434dfcb3b21fd5fd49eccf066013e9732d7ca9aba22eaf611b01f98c053a6a

SHA512
8dbf73c9e1337b15acf6d9fc916221d25db161db812430d9a424a36743f6535a547625113aa42000211865548c1c7fee70a70703f2593e26471f9efd9966fe02

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3RJ81vb.exe
Filesize
1.3MB

MD5
7bab316954f445b2018f3bc00afd8fe0

SHA1
3a32272024261cbe0c1a091204bcf0248fb370d8

SHA256
2524b087f03d3de46ae1350d9edf881af5c8c2f92bffa1ed709b72e86bdde1d8

SHA512
b09ff12bc2bc00c5672b919221865113d285c5d4b586c798c9697f0d7fd358e897bd684eaf7b39a7cae091761598d0b1ced6d8dec37ccffa39881b27e3945953

Download Submit
memory/1468-32-0x0000000007630000-0x00000000076C2000-memory.dmp

Filesize
584KB

Download
memory/1468-31-0x0000000007B40000-0x00000000080E4000-memory.dmp

Filesize
5.6MB

Download
memory/1468-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1468-34-0x0000000002B50000-0x0000000002B5A000-memory.dmp

Filesize
40KB

Download
memory/1468-35-0x0000000008710000-0x0000000008D28000-memory.dmp

Filesize
6.1MB

Download
memory/1468-36-0x00000000079A0000-0x0000000007AAA000-memory.dmp

Filesize
1.0MB

Download
memory/1468-37-0x00000000076F0000-0x0000000007702000-memory.dmp

Filesize
72KB

Download
memory/1468-38-0x0000000007750000-0x000000000778C000-memory.dmp

Filesize
240KB

Download
memory/1468-39-0x0000000007890000-0x00000000078DC000-memory.dmp

Filesize
304KB

Download