privateloader | 02cacf524527064e447c85bef406a6e5125d06b69bd35e10a813bf4a5659b985

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 05:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

367729c84050746eb20cd233e6b8d8cfe0625110da6e43f4b4c486aa19d08103.exe
Size

1.0MB
MD5

b8c8a180572fa9f5d2abc29e8f5225de
SHA1

70b0b356bc4a0bf194d6cc8dc2b000ac7e49c1b7
SHA256

367729c84050746eb20cd233e6b8d8cfe0625110da6e43f4b4c486aa19d08103
SHA512

fd90da55beae0cc7727900aff75d39a03d7986db109beb32ef5f0303cca309768e6ecbe2db25a32a6cb64eb7f3ee7209143a60fbde957182b1ddf5b58aba9162
SSDEEP

24576:Kylv3LOmDlvjAHW7XNs5uCq3bMKgMjUlP6wSCzLw+:Rlv3LOejLNsB5KvUlPyx

Score

10^/10

privateloader redline risepro horda infostealer loader persistence stealer

Malware Config

Extracted

Family

redline

Botnet

horda

194.49.94.152:19053

Extracted

Family

risepro

194.49.94.152

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral7/memory/3400-14-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk	3Jj94vS.exe

Executes dropped EXE 3 IoCs

pid	Process
4852	dw7mh79.exe
4252	2Gz9949.exe
508	3Jj94vS.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	367729c84050746eb20cd233e6b8d8cfe0625110da6e43f4b4c486aa19d08103.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	dw7mh79.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe"	3Jj94vS.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4252 set thread context of 3400	4252	2Gz9949.exe	98

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1640	4252	WerFault.exe	84

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4048	schtasks.exe
3428	schtasks.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3796 wrote to memory of 4852	3796	367729c84050746eb20cd233e6b8d8cfe0625110da6e43f4b4c486aa19d08103.exe	83
PID 3796 wrote to memory of 4852	3796	367729c84050746eb20cd233e6b8d8cfe0625110da6e43f4b4c486aa19d08103.exe	83
PID 3796 wrote to memory of 4852	3796	367729c84050746eb20cd233e6b8d8cfe0625110da6e43f4b4c486aa19d08103.exe	83
PID 4852 wrote to memory of 4252	4852	dw7mh79.exe	84
PID 4852 wrote to memory of 4252	4852	dw7mh79.exe	84
PID 4852 wrote to memory of 4252	4852	dw7mh79.exe	84
PID 4252 wrote to memory of 3400	4252	2Gz9949.exe	98
PID 4252 wrote to memory of 3400	4252	2Gz9949.exe	98
PID 4252 wrote to memory of 3400	4252	2Gz9949.exe	98
PID 4252 wrote to memory of 3400	4252	2Gz9949.exe	98
PID 4252 wrote to memory of 3400	4252	2Gz9949.exe	98
PID 4252 wrote to memory of 3400	4252	2Gz9949.exe	98
PID 4252 wrote to memory of 3400	4252	2Gz9949.exe	98
PID 4252 wrote to memory of 3400	4252	2Gz9949.exe	98
PID 4852 wrote to memory of 508	4852	dw7mh79.exe	102
PID 4852 wrote to memory of 508	4852	dw7mh79.exe	102
PID 4852 wrote to memory of 508	4852	dw7mh79.exe	102
PID 508 wrote to memory of 3428	508	3Jj94vS.exe	103
PID 508 wrote to memory of 3428	508	3Jj94vS.exe	103
PID 508 wrote to memory of 3428	508	3Jj94vS.exe	103
PID 508 wrote to memory of 4048	508	3Jj94vS.exe	105
PID 508 wrote to memory of 4048	508	3Jj94vS.exe	105
PID 508 wrote to memory of 4048	508	3Jj94vS.exe	105

C:\Users\Admin\AppData\Local\Temp\367729c84050746eb20cd233e6b8d8cfe0625110da6e43f4b4c486aa19d08103.exe
"C:\Users\Admin\AppData\Local\Temp\367729c84050746eb20cd233e6b8d8cfe0625110da6e43f4b4c486aa19d08103.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dw7mh79.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dw7mh79.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Gz9949.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Gz9949.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4252
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:3400
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4252 -s 140
      4⤵
      Program crash
      PID:1640
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3Jj94vS.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3Jj94vS.exe
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:508
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:3428
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:4048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4252 -ip 4252
1⤵
PID:4664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dw7mh79.exe

Filesize
948KB

MD5
5ffbfb649f5b887a031efcc31826e254

SHA1
f5d9657b152d73d9ce6c583c70ca3d927073522b

SHA256
aa19512f2ad59b5bed358f92c3760fb88934bea7d410d0855cc93b2b92d9bb8d

SHA512
fb3599d72cfca2c9ad39d86dbded461c93d32f31c89e06d1f36b813b03c52c1dce53c84adeb9e28cd341047e29962ab43913806ac8bbe5d1d2e07f0eb81944dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Gz9949.exe

Filesize
1.1MB

MD5
503996518197b0d5f339f01b2077809b

SHA1
4c49cb3aa48109987dd035ba03c1cbcedda1c8cd

SHA256
94a9d8adfeeeafc2cec74d7801765a8fe19a9627d9aab335f2140c4f66b7cc11

SHA512
b3528d0928ec70cd8018f301252dc1daa60144cb2c42695a0e800d8e5205f0b00521132536d57d9a4feedd5d76ee68c22b03273b9cf456b46b212e9ed535ed20

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3Jj94vS.exe

Filesize
1.3MB

MD5
224c5e3fb94f0bedb563ed316fe20519

SHA1
2f133eb786c582a623f4d8295602427346e34e3e

SHA256
0e406fe86d88d7d0f95febd7e0a0bb67f1a1310270230eaa808da4caf36ad6d7

SHA512
acb0099855e080b98164abdb71d83eb913f5ac6613da8e9ea6a0799dc3994ef4f538c7db3789e86bf8097d9e63cd7d1b9aa4efebc604a45c2cb58cf5b6046c7e

Download Submit
memory/3400-18-0x0000000004B50000-0x0000000004B5A000-memory.dmp

Filesize
40KB

Download
memory/3400-16-0x0000000007A70000-0x0000000008014000-memory.dmp

Filesize
5.6MB

Download
memory/3400-17-0x0000000007560000-0x00000000075F2000-memory.dmp

Filesize
584KB

Download
memory/3400-15-0x000000007448E000-0x000000007448F000-memory.dmp

Filesize
4KB

Download
memory/3400-14-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3400-24-0x0000000008640000-0x0000000008C58000-memory.dmp

Filesize
6.1MB

Download
memory/3400-25-0x00000000078B0000-0x00000000079BA000-memory.dmp

Filesize
1.0MB

Download
memory/3400-26-0x00000000076F0000-0x0000000007702000-memory.dmp

Filesize
72KB

Download
memory/3400-27-0x0000000007760000-0x000000000779C000-memory.dmp

Filesize
240KB

Download
memory/3400-32-0x00000000077A0000-0x00000000077EC000-memory.dmp

Filesize
304KB

Download
memory/3400-34-0x000000007448E000-0x000000007448F000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads