privateloader | 3767bd9b929fb47ae3b158c424044d32b3c87ffb6efc8eb109dc1df9f3d9b053

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 08:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e6003af8259118d585d59c577d4350638e3cbde579b5f4ec0fce9845a97d4f08.exe
Size

828KB
MD5

491026bed4cdc5db8e7d164b5dba20b6
SHA1

510c3096e2dbcab4edfc4b33364eb5aad40ef03f
SHA256

e6003af8259118d585d59c577d4350638e3cbde579b5f4ec0fce9845a97d4f08
SHA512

ad29be3401873ea07d09d404f9ffedd2116f119ef0bbf9229d1badc01f419bfabe54c263db9ce98669c611771fd3c592ea1daa9702d16d9790120a58e432e699
SSDEEP

24576:3y3SrcZsrHSws6TZXv2COI4zlEk2CjTbZo:C3YcWHSwssXeCR4zlqCjTl

Score

10^/10

privateloader redline risepro horda infostealer loader persistence stealer

Malware Config

Extracted

Family

redline

Botnet

horda

194.49.94.152:19053

Extracted

Family

risepro

194.49.94.152

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral17/memory/4512-7-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
Drops startup file 1 IoCs

Processes:

3dM94jC.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk 3dM94jC.exe
Executes dropped EXE 2 IoCs

Processes:

2VQ5981.exe3dM94jC.exe

pid process

2540 2VQ5981.exe
4596 3dM94jC.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk	3dM94jC.exe

pid	process
2540	2VQ5981.exe
4596	3dM94jC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

e6003af8259118d585d59c577d4350638e3cbde579b5f4ec0fce9845a97d4f08.exe3dM94jC.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	e6003af8259118d585d59c577d4350638e3cbde579b5f4ec0fce9845a97d4f08.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe"	3dM94jC.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

2VQ5981.exe

description pid process target process

PID 2540 set thread context of 4512 2540 2VQ5981.exe AppLaunch.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1220 schtasks.exe
1752 schtasks.exe

description	pid	process	target process
PID 2540 set thread context of 4512	2540	2VQ5981.exe	AppLaunch.exe

pid	process
1220	schtasks.exe
1752	schtasks.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

e6003af8259118d585d59c577d4350638e3cbde579b5f4ec0fce9845a97d4f08.exe2VQ5981.exe3dM94jC.exe

description	pid	process	target process
PID 5060 wrote to memory of 2540	5060	e6003af8259118d585d59c577d4350638e3cbde579b5f4ec0fce9845a97d4f08.exe	2VQ5981.exe
PID 5060 wrote to memory of 2540	5060	e6003af8259118d585d59c577d4350638e3cbde579b5f4ec0fce9845a97d4f08.exe	2VQ5981.exe
PID 5060 wrote to memory of 2540	5060	e6003af8259118d585d59c577d4350638e3cbde579b5f4ec0fce9845a97d4f08.exe	2VQ5981.exe
PID 2540 wrote to memory of 2572	2540	2VQ5981.exe	AppLaunch.exe
PID 2540 wrote to memory of 2572	2540	2VQ5981.exe	AppLaunch.exe
PID 2540 wrote to memory of 2572	2540	2VQ5981.exe	AppLaunch.exe
PID 2540 wrote to memory of 4344	2540	2VQ5981.exe	AppLaunch.exe
PID 2540 wrote to memory of 4344	2540	2VQ5981.exe	AppLaunch.exe
PID 2540 wrote to memory of 4344	2540	2VQ5981.exe	AppLaunch.exe
PID 2540 wrote to memory of 4512	2540	2VQ5981.exe	AppLaunch.exe
PID 2540 wrote to memory of 4512	2540	2VQ5981.exe	AppLaunch.exe
PID 2540 wrote to memory of 4512	2540	2VQ5981.exe	AppLaunch.exe
PID 2540 wrote to memory of 4512	2540	2VQ5981.exe	AppLaunch.exe
PID 2540 wrote to memory of 4512	2540	2VQ5981.exe	AppLaunch.exe
PID 2540 wrote to memory of 4512	2540	2VQ5981.exe	AppLaunch.exe
PID 2540 wrote to memory of 4512	2540	2VQ5981.exe	AppLaunch.exe
PID 2540 wrote to memory of 4512	2540	2VQ5981.exe	AppLaunch.exe
PID 5060 wrote to memory of 4596	5060	e6003af8259118d585d59c577d4350638e3cbde579b5f4ec0fce9845a97d4f08.exe	3dM94jC.exe
PID 5060 wrote to memory of 4596	5060	e6003af8259118d585d59c577d4350638e3cbde579b5f4ec0fce9845a97d4f08.exe	3dM94jC.exe
PID 5060 wrote to memory of 4596	5060	e6003af8259118d585d59c577d4350638e3cbde579b5f4ec0fce9845a97d4f08.exe	3dM94jC.exe
PID 4596 wrote to memory of 1752	4596	3dM94jC.exe	schtasks.exe
PID 4596 wrote to memory of 1752	4596	3dM94jC.exe	schtasks.exe
PID 4596 wrote to memory of 1752	4596	3dM94jC.exe	schtasks.exe
PID 4596 wrote to memory of 1220	4596	3dM94jC.exe	schtasks.exe
PID 4596 wrote to memory of 1220	4596	3dM94jC.exe	schtasks.exe
PID 4596 wrote to memory of 1220	4596	3dM94jC.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\e6003af8259118d585d59c577d4350638e3cbde579b5f4ec0fce9845a97d4f08.exe
"C:\Users\Admin\AppData\Local\Temp\e6003af8259118d585d59c577d4350638e3cbde579b5f4ec0fce9845a97d4f08.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5060

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2VQ5981.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2VQ5981.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2540

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:2572

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:4344

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:4512

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3dM94jC.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3dM94jC.exe
2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4596

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
3⤵
- Creates scheduled task(s)
PID:1752

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
3⤵
- Creates scheduled task(s)
PID:1220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4444,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:8
1⤵
PID:1848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2VQ5981.exe

Filesize
493KB

MD5
9348df60e21244f0d54f2424763a421c

SHA1
63355651c9de102988eb1f77ede29c1bae74f1a2

SHA256
417f24ef12fca36e08790d68320cf7fc41e36f71986445dbe3f5fc096955082f

SHA512
5622bf71e14dcbc6b3bf3627633c7b5b8f430538cde042e5ec93bdbdbe6b438394dbc7d71f32659d3e85f2cc19b515587b4d5d3390c5eadbf47743c8484ac22b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3dM94jC.exe

Filesize
1.3MB

MD5
e9ef9a64cdbba70b99b2c05f3f654bf5

SHA1
5b99c798631d50ce7437fdafd13fe8978ce6b9ed

SHA256
a1805d2e3245ff748ec8c6a249f1e3d4234098711b9d2a523c946b5d81bbc43c

SHA512
65c267eb1172ede82ea7c1eb2431e21a926834188da1eac8caed0c2bf291924505ccedc25fa4442ec84dd05425b10a2fe84f4b6622d9b8fccb722e28c718350d

Download Submit
memory/4512-21-0x0000000002CF0000-0x0000000002CFA000-memory.dmp

Filesize
40KB

Download
memory/4512-11-0x000000007437E000-0x000000007437F000-memory.dmp

Filesize
4KB

Download
memory/4512-18-0x0000000007D70000-0x0000000008314000-memory.dmp

Filesize
5.6MB

Download
memory/4512-19-0x00000000078C0000-0x0000000007952000-memory.dmp

Filesize
584KB

Download
memory/4512-7-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4512-22-0x0000000008940000-0x0000000008F58000-memory.dmp

Filesize
6.1MB

Download
memory/4512-23-0x0000000007C10000-0x0000000007D1A000-memory.dmp

Filesize
1.0MB

Download
memory/4512-24-0x0000000007B00000-0x0000000007B12000-memory.dmp

Filesize
72KB

Download
memory/4512-25-0x0000000007B60000-0x0000000007B9C000-memory.dmp

Filesize
240KB

Download
memory/4512-26-0x0000000007BA0000-0x0000000007BEC000-memory.dmp

Filesize
304KB

Download
memory/4512-27-0x000000007437E000-0x000000007437F000-memory.dmp

Filesize
4KB

Download