privateloader | bd5cb5ed04f67f5a6f2f5411e9ad5c457c0c3e3bf3a38e4996624bdfba01d98d

Analysis

max time kernel
133s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 07:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

202040bebe757e0adc39d99b3d7327e79e0354b43f2a6c6fe0d1c1362d3e4198.exe
Size

1.1MB
MD5

2a0c21ee9b17ce0cd8c48c3d0f9d977e
SHA1

d02d327e0e0a891de8f829d00605d537437d3867
SHA256

202040bebe757e0adc39d99b3d7327e79e0354b43f2a6c6fe0d1c1362d3e4198
SHA512

ea40fc8640943ed73e0f1bb93e1e7d8fc36ab4d417ff6a785330b1f5d9632d08a8e45499d1a86fba32979c853ffa80e2eafab786b2a2e822430f563b8185e333
SSDEEP

24576:hyWoAbkIuWxV6pLSGIuIuGqReUE/j+0hjJ3mK2ybqkm6YXUl:UZAbiEV6tLEUE//jkKfeAYk

Score

10^/10

privateloader redline risepro horda infostealer loader persistence stealer

Malware Config

Extracted

Family

redline

Botnet

horda

194.49.94.152:19053

Extracted

Family

risepro

194.49.94.152

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral3/memory/220-7-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Executes dropped EXE 2 IoCs

pid	Process
1360	11nb8854.exe
3948	12rX344.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	202040bebe757e0adc39d99b3d7327e79e0354b43f2a6c6fe0d1c1362d3e4198.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1360 set thread context of 220	1360	11nb8854.exe	87
PID 3948 set thread context of 2000	3948	12rX344.exe	94

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 1360	2632	202040bebe757e0adc39d99b3d7327e79e0354b43f2a6c6fe0d1c1362d3e4198.exe	83
PID 2632 wrote to memory of 1360	2632	202040bebe757e0adc39d99b3d7327e79e0354b43f2a6c6fe0d1c1362d3e4198.exe	83
PID 2632 wrote to memory of 1360	2632	202040bebe757e0adc39d99b3d7327e79e0354b43f2a6c6fe0d1c1362d3e4198.exe	83
PID 1360 wrote to memory of 220	1360	11nb8854.exe	87
PID 1360 wrote to memory of 220	1360	11nb8854.exe	87
PID 1360 wrote to memory of 220	1360	11nb8854.exe	87
PID 1360 wrote to memory of 220	1360	11nb8854.exe	87
PID 1360 wrote to memory of 220	1360	11nb8854.exe	87
PID 1360 wrote to memory of 220	1360	11nb8854.exe	87
PID 1360 wrote to memory of 220	1360	11nb8854.exe	87
PID 1360 wrote to memory of 220	1360	11nb8854.exe	87
PID 2632 wrote to memory of 3948	2632	202040bebe757e0adc39d99b3d7327e79e0354b43f2a6c6fe0d1c1362d3e4198.exe	88
PID 2632 wrote to memory of 3948	2632	202040bebe757e0adc39d99b3d7327e79e0354b43f2a6c6fe0d1c1362d3e4198.exe	88
PID 2632 wrote to memory of 3948	2632	202040bebe757e0adc39d99b3d7327e79e0354b43f2a6c6fe0d1c1362d3e4198.exe	88
PID 3948 wrote to memory of 888	3948	12rX344.exe	90
PID 3948 wrote to memory of 888	3948	12rX344.exe	90
PID 3948 wrote to memory of 888	3948	12rX344.exe	90
PID 3948 wrote to memory of 2372	3948	12rX344.exe	92
PID 3948 wrote to memory of 2372	3948	12rX344.exe	92
PID 3948 wrote to memory of 2372	3948	12rX344.exe	92
PID 3948 wrote to memory of 2000	3948	12rX344.exe	94
PID 3948 wrote to memory of 2000	3948	12rX344.exe	94
PID 3948 wrote to memory of 2000	3948	12rX344.exe	94
PID 3948 wrote to memory of 2000	3948	12rX344.exe	94
PID 3948 wrote to memory of 2000	3948	12rX344.exe	94
PID 3948 wrote to memory of 2000	3948	12rX344.exe	94
PID 3948 wrote to memory of 2000	3948	12rX344.exe	94
PID 3948 wrote to memory of 2000	3948	12rX344.exe	94
PID 3948 wrote to memory of 2000	3948	12rX344.exe	94
PID 3948 wrote to memory of 2000	3948	12rX344.exe	94

C:\Users\Admin\AppData\Local\Temp\202040bebe757e0adc39d99b3d7327e79e0354b43f2a6c6fe0d1c1362d3e4198.exe
"C:\Users\Admin\AppData\Local\Temp\202040bebe757e0adc39d99b3d7327e79e0354b43f2a6c6fe0d1c1362d3e4198.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\11nb8854.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\11nb8854.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1360
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:220
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\12rX344.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\12rX344.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3948
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:888
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:2372
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:2000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\11nb8854.exe

Filesize
1.1MB

MD5
c71786413cdd6112ec165aabfbaffea6

SHA1
b8c57095bf9c59140e84b8cf09688706ecdb5a73

SHA256
37c11459db9bd13ff2d11564eebf9e58bed358301b9a7c79c43fbe1287794abc

SHA512
0d93205361d41af46211e77512d970abfbd961403f9cf8b33034eb86460e0a7d6b4c0d2a457aca685c600a57bf95b57e8b4c564d93835dcd105c821a649f2c9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\12rX344.exe

Filesize
2.4MB

MD5
376dd7069ded89a29d754c1e5d7c0e3e

SHA1
edac7c5f6a3e96baf4c4a8aa851b96bd7307d493

SHA256
bc943e53b329de836583ee13130e24c2325ee6c28a8ef097a1a388b25fe95a8e

SHA512
7e98b113b92ebe654b0fd1531f9edba897852636ab9450264ec5d0ebed7ca97ae63840f45146aa393aac035264bf8729276e73e61eeb1cde634e6ff131a99c1b

Download Submit
memory/220-16-0x0000000008DC0000-0x00000000093D8000-memory.dmp

Filesize
6.1MB

Download
memory/220-19-0x0000000007E00000-0x0000000007E3C000-memory.dmp

Filesize
240KB

Download
memory/220-12-0x00000000081F0000-0x0000000008794000-memory.dmp

Filesize
5.6MB

Download
memory/220-13-0x0000000007CE0000-0x0000000007D72000-memory.dmp

Filesize
584KB

Download
memory/220-14-0x0000000003100000-0x000000000310A000-memory.dmp

Filesize
40KB

Download
memory/220-15-0x0000000073F30000-0x00000000746E0000-memory.dmp

Filesize
7.7MB

Download
memory/220-7-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/220-17-0x00000000087A0000-0x00000000088AA000-memory.dmp

Filesize
1.0MB

Download
memory/220-18-0x0000000007DA0000-0x0000000007DB2000-memory.dmp

Filesize
72KB

Download
memory/220-10-0x0000000073F3E000-0x0000000073F3F000-memory.dmp

Filesize
4KB

Download
memory/220-20-0x0000000007F40000-0x0000000007F8C000-memory.dmp

Filesize
304KB

Download
memory/220-27-0x0000000073F30000-0x00000000746E0000-memory.dmp

Filesize
7.7MB

Download
memory/220-26-0x0000000073F3E000-0x0000000073F3F000-memory.dmp

Filesize
4KB

Download
memory/2000-24-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download
memory/2000-25-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download
memory/2000-23-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download
memory/2000-21-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads