privateloader | 02cacf524527064e447c85bef406a6e5125d06b69bd35e10a813bf4a5659b985

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 05:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4157cda3159c7d2c99d18138d2e023dd1d821d09ae77e78901a80b26492981a6.exe
Size

935KB
MD5

7f171f4b73978e234b3e114830d4b2f2
SHA1

2ea3e0030d87fb10bbd138f3ae220b2413d9820a
SHA256

4157cda3159c7d2c99d18138d2e023dd1d821d09ae77e78901a80b26492981a6
SHA512

b363282cdf599dd82accd283b3a10acc97108588c16696cfb7c361a02a29cb4b7c65366836bb897cb00881b3d75b4d7fa575befd19eb1009bab7130cd798e2af
SSDEEP

12288:TMrby90gdqx5IqPURHad0qOH81g42fAhjMQFzlzqUagnaioMpkQFU/i+VGq7af9C:Qy3qxVXhv1XhxVagnbpkRxVGyafKZMo

Score

10^/10

privateloader redline risepro horda infostealer loader persistence stealer

Malware Config

Extracted

Family

redline

Botnet

horda

194.49.94.152:19053

Extracted

Family

risepro

194.49.94.152

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral10/memory/4932-14-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk	3aG16Cx.exe

Executes dropped EXE 3 IoCs

pid	Process
1124	RO9En93.exe
4980	2xj7036.exe
2384	3aG16Cx.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	4157cda3159c7d2c99d18138d2e023dd1d821d09ae77e78901a80b26492981a6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	RO9En93.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe"	3aG16Cx.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4980 set thread context of 4932	4980	2xj7036.exe	97

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4384	4980	WerFault.exe	85

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3580	schtasks.exe
4136	schtasks.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 1124	2160	4157cda3159c7d2c99d18138d2e023dd1d821d09ae77e78901a80b26492981a6.exe	84
PID 2160 wrote to memory of 1124	2160	4157cda3159c7d2c99d18138d2e023dd1d821d09ae77e78901a80b26492981a6.exe	84
PID 2160 wrote to memory of 1124	2160	4157cda3159c7d2c99d18138d2e023dd1d821d09ae77e78901a80b26492981a6.exe	84
PID 1124 wrote to memory of 4980	1124	RO9En93.exe	85
PID 1124 wrote to memory of 4980	1124	RO9En93.exe	85
PID 1124 wrote to memory of 4980	1124	RO9En93.exe	85
PID 4980 wrote to memory of 4932	4980	2xj7036.exe	97
PID 4980 wrote to memory of 4932	4980	2xj7036.exe	97
PID 4980 wrote to memory of 4932	4980	2xj7036.exe	97
PID 4980 wrote to memory of 4932	4980	2xj7036.exe	97
PID 4980 wrote to memory of 4932	4980	2xj7036.exe	97
PID 4980 wrote to memory of 4932	4980	2xj7036.exe	97
PID 4980 wrote to memory of 4932	4980	2xj7036.exe	97
PID 4980 wrote to memory of 4932	4980	2xj7036.exe	97
PID 1124 wrote to memory of 2384	1124	RO9En93.exe	101
PID 1124 wrote to memory of 2384	1124	RO9En93.exe	101
PID 1124 wrote to memory of 2384	1124	RO9En93.exe	101
PID 2384 wrote to memory of 3580	2384	3aG16Cx.exe	102
PID 2384 wrote to memory of 3580	2384	3aG16Cx.exe	102
PID 2384 wrote to memory of 3580	2384	3aG16Cx.exe	102
PID 2384 wrote to memory of 4136	2384	3aG16Cx.exe	104
PID 2384 wrote to memory of 4136	2384	3aG16Cx.exe	104
PID 2384 wrote to memory of 4136	2384	3aG16Cx.exe	104

C:\Users\Admin\AppData\Local\Temp\4157cda3159c7d2c99d18138d2e023dd1d821d09ae77e78901a80b26492981a6.exe
"C:\Users\Admin\AppData\Local\Temp\4157cda3159c7d2c99d18138d2e023dd1d821d09ae77e78901a80b26492981a6.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RO9En93.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RO9En93.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2xj7036.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2xj7036.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4980
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:4932
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 592
      4⤵
      Program crash
      PID:4384
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3aG16Cx.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3aG16Cx.exe
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2384
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:3580
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:4136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4980 -ip 4980
1⤵
PID:4296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RO9En93.exe

Filesize
811KB

MD5
21767d51ff86555a50e94159c4d1a806

SHA1
9800e4e5e76220f692c12154e079f46bfcfc68b9

SHA256
6347b1d9d28b5f711767046a33d95b4f8da89c6becd194cd523eaa85f2e8d5cd

SHA512
6807123af2d22c8fa24a1c9afcd9db1c6b41ab2c1a8d653793f8c4ed74db01b6bb2c94017f15771d527497923fd555e94daf8855da8c8de99708351a233959e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2xj7036.exe

Filesize
432KB

MD5
6321edfc539dd3c43272fb9a85b34b32

SHA1
8949f412f84cf94a8b2823748cd3652e4ccdbfe1

SHA256
f3d1a51d877390053ebe8c23e99370eab3ccce3f59b2cf365c65064824d39c77

SHA512
4ad0122c952a92bcf9266b1444af9c28abe4712e33cf76f67228c32f279cf991a97538d2d601ddbc2b98ff7b87e515b47f9b0b6491188f3a3e04c9b9311f2887

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3aG16Cx.exe

Filesize
1.3MB

MD5
d9789a0830c87d8d411ba8ec03878788

SHA1
52a334fde33464f4d08592ae5eadfe26f6d9e095

SHA256
c120db6b8b17c48b81899a2716b8cd2b3bb3641bfa0f980ebc50bd8ecc5d8a83

SHA512
e677bfb55fab6bc1bb7c43626ea78d78cc6ad491680d770c08fc14c50ce0368a18f7fd040cc0abc66cc8f87f4f86d1102743475934f2ceed3f68e8f4b6627739

Download Submit
memory/4932-18-0x0000000002580000-0x000000000258A000-memory.dmp

Filesize
40KB

Download
memory/4932-16-0x0000000007590000-0x0000000007B34000-memory.dmp

Filesize
5.6MB

Download
memory/4932-17-0x0000000007080000-0x0000000007112000-memory.dmp

Filesize
584KB

Download
memory/4932-15-0x00000000746AE000-0x00000000746AF000-memory.dmp

Filesize
4KB

Download
memory/4932-14-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4932-24-0x0000000008160000-0x0000000008778000-memory.dmp

Filesize
6.1MB

Download
memory/4932-25-0x0000000007420000-0x000000000752A000-memory.dmp

Filesize
1.0MB

Download
memory/4932-26-0x0000000007210000-0x0000000007222000-memory.dmp

Filesize
72KB

Download
memory/4932-28-0x0000000007270000-0x00000000072AC000-memory.dmp

Filesize
240KB

Download
memory/4932-32-0x0000000007310000-0x000000000735C000-memory.dmp

Filesize
304KB

Download
memory/4932-34-0x00000000746AE000-0x00000000746AF000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads