privateloader | bd5cb5ed04f67f5a6f2f5411e9ad5c457c0c3e3bf3a38e4996624bdfba01d98d

Analysis

max time kernel
133s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 07:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
202040bebe757e0adc39d99b3d7327e79e0354b43f2a6c6fe0d1c1362d3e4198.exe
Size 1.1MB
Sample240524-jjsbwsab65
SHA256 202040bebe757e0adc39d99b3d7327e79e0354b43f2a6c6fe0d1c1362d3e4198
MD5 2a0c21ee9b17ce0cd8c48c3d0f9d977e
SHA1 d02d327e0e0a891de8f829d00605d537437d3867
SHA512 ea40fc8640943ed73e0f1bb93e1e7d8fc36ab4d417ff6a785330b1f5d9632d08a8e45499d1a86fba32979c853ffa80e2eafab786b2a2e822430f563b8185e333
SSDEEP 24576:hyWoAbkIuWxV6pLSGIuIuGqReUE/j+0hjJ3mK2ybqkm6YXUl:UZAbiEV6tLEUE//jkKfeAYk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

privateloader redline risepro horda infostealer loader persistence stealer

Malware Config

Extracted

Family

redline

Botnet

horda

194.49.94.152:19053

Extracted

Family

risepro

194.49.94.152

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral3/memory/220-7-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Executes dropped EXE 2 IoCs

pid	Process
1360	11nb8854.exe
3948	12rX344.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	202040bebe757e0adc39d99b3d7327e79e0354b43f2a6c6fe0d1c1362d3e4198.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1360 set thread context of 220	1360	11nb8854.exe	87
PID 3948 set thread context of 2000	3948	12rX344.exe	94

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 1360	2632	202040bebe757e0adc39d99b3d7327e79e0354b43f2a6c6fe0d1c1362d3e4198.exe	83
PID 2632 wrote to memory of 1360	2632	202040bebe757e0adc39d99b3d7327e79e0354b43f2a6c6fe0d1c1362d3e4198.exe	83
PID 2632 wrote to memory of 1360	2632	202040bebe757e0adc39d99b3d7327e79e0354b43f2a6c6fe0d1c1362d3e4198.exe	83
PID 1360 wrote to memory of 220	1360	11nb8854.exe	87
PID 1360 wrote to memory of 220	1360	11nb8854.exe	87
PID 1360 wrote to memory of 220	1360	11nb8854.exe	87
PID 1360 wrote to memory of 220	1360	11nb8854.exe	87
PID 1360 wrote to memory of 220	1360	11nb8854.exe	87
PID 1360 wrote to memory of 220	1360	11nb8854.exe	87
PID 1360 wrote to memory of 220	1360	11nb8854.exe	87
PID 1360 wrote to memory of 220	1360	11nb8854.exe	87
PID 2632 wrote to memory of 3948	2632	202040bebe757e0adc39d99b3d7327e79e0354b43f2a6c6fe0d1c1362d3e4198.exe	88
PID 2632 wrote to memory of 3948	2632	202040bebe757e0adc39d99b3d7327e79e0354b43f2a6c6fe0d1c1362d3e4198.exe	88
PID 2632 wrote to memory of 3948	2632	202040bebe757e0adc39d99b3d7327e79e0354b43f2a6c6fe0d1c1362d3e4198.exe	88
PID 3948 wrote to memory of 888	3948	12rX344.exe	90
PID 3948 wrote to memory of 888	3948	12rX344.exe	90
PID 3948 wrote to memory of 888	3948	12rX344.exe	90
PID 3948 wrote to memory of 2372	3948	12rX344.exe	92
PID 3948 wrote to memory of 2372	3948	12rX344.exe	92
PID 3948 wrote to memory of 2372	3948	12rX344.exe	92
PID 3948 wrote to memory of 2000	3948	12rX344.exe	94
PID 3948 wrote to memory of 2000	3948	12rX344.exe	94
PID 3948 wrote to memory of 2000	3948	12rX344.exe	94
PID 3948 wrote to memory of 2000	3948	12rX344.exe	94
PID 3948 wrote to memory of 2000	3948	12rX344.exe	94
PID 3948 wrote to memory of 2000	3948	12rX344.exe	94
PID 3948 wrote to memory of 2000	3948	12rX344.exe	94
PID 3948 wrote to memory of 2000	3948	12rX344.exe	94
PID 3948 wrote to memory of 2000	3948	12rX344.exe	94
PID 3948 wrote to memory of 2000	3948	12rX344.exe	94

C:\Users\Admin\AppData\Local\Temp\202040bebe757e0adc39d99b3d7327e79e0354b43f2a6c6fe0d1c1362d3e4198.exe
"C:\Users\Admin\AppData\Local\Temp\202040bebe757e0adc39d99b3d7327e79e0354b43f2a6c6fe0d1c1362d3e4198.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\11nb8854.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\11nb8854.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1360
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:220
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\12rX344.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\12rX344.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3948
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:888
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:2372
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:2000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

11nb8854.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\11nb8854.exe
Size 1.1MB
SHA256 37c11459db9bd13ff2d11564eebf9e58bed358301b9a7c79c43fbe1287794abc
MD5 c71786413cdd6112ec165aabfbaffea6
SHA1 b8c57095bf9c59140e84b8cf09688706ecdb5a73
SHA512 0d93205361d41af46211e77512d970abfbd961403f9cf8b33034eb86460e0a7d6b4c0d2a457aca685c600a57bf95b57e8b4c564d93835dcd105c821a649f2c9d
SSDEEP 12288:EsSzartxSD/6+s8RPJsw9/r59yJUGaH881u4bTFnZyy25LCE++KYsE:EzartxSD/6+sXsF9ygvqLCN+KRE
MD5 SHA1 SHA512 SSDEEP

Submit Download

12rX344.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\12rX344.exe
Size 2.4MB
SHA256 bc943e53b329de836583ee13130e24c2325ee6c28a8ef097a1a388b25fe95a8e
MD5 376dd7069ded89a29d754c1e5d7c0e3e
SHA1 edac7c5f6a3e96baf4c4a8aa851b96bd7307d493
SHA512 7e98b113b92ebe654b0fd1531f9edba897852636ab9450264ec5d0ebed7ca97ae63840f45146aa393aac035264bf8729276e73e61eeb1cde634e6ff131a99c1b
SSDEEP 24576:ZzarJ9SD/6+s/UF9yMTbZg3VzCl38YDFdHHcx1fNnXg6yOB/61Y5wHb+LboNz/h1:ySD/6+s/UBl3pbH8x1f0zO1ELzPOI
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/220-16-0x0000000008DC0000-0x00000000093D8000-memory.dmp

Download

memory/220-19-0x0000000007E00000-0x0000000007E3C000-memory.dmp

Download

memory/220-12-0x00000000081F0000-0x0000000008794000-memory.dmp

Download

memory/220-13-0x0000000007CE0000-0x0000000007D72000-memory.dmp

Download

memory/220-14-0x0000000003100000-0x000000000310A000-memory.dmp

Download

memory/220-15-0x0000000073F30000-0x00000000746E0000-memory.dmp

Download

memory/220-7-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/220-17-0x00000000087A0000-0x00000000088AA000-memory.dmp

Download

memory/220-18-0x0000000007DA0000-0x0000000007DB2000-memory.dmp

Download

memory/220-10-0x0000000073F3E000-0x0000000073F3F000-memory.dmp

Download

memory/220-20-0x0000000007F40000-0x0000000007F8C000-memory.dmp

Download

memory/220-27-0x0000000073F30000-0x00000000746E0000-memory.dmp

Download

memory/220-26-0x0000000073F3E000-0x0000000073F3F000-memory.dmp

Download

memory/2000-24-0x0000000000400000-0x0000000000547000-memory.dmp

Download

memory/2000-25-0x0000000000400000-0x0000000000547000-memory.dmp

Download

memory/2000-23-0x0000000000400000-0x0000000000547000-memory.dmp

Download

memory/2000-21-0x0000000000400000-0x0000000000547000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads