privateloader | 3cc30911c3eb32deaf5fb8bc4dfe2ca6abbafa106ab4c16e8ff25a715c1fe7e7

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 08:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f4e5c3b3a8de995cf390c778532164b570dcf1ea9c58ab8797a7cc16a674a2b.exe
Size

811KB
MD5

91d88f49ab29b31c90140453f78f3a17
SHA1

d4fa424afe634eb614ee8f0bbcfadbf766f7f921
SHA256

6f4e5c3b3a8de995cf390c778532164b570dcf1ea9c58ab8797a7cc16a674a2b
SHA512

bb04a4e664f48b7242dcaafc224ab91ec036fa58bc71bdd2a3ed1586b291e38229df844c0ceb666e77645895f95c65b4010d0228ae18beb6f0c82085628486d8
SSDEEP

12288:hMrPy90NL1K7bAhMzYjFnTqZImauCVpXaMZKjRFdH4lUbpvzK8YRIFK:ayAL87bsjZNmavVpK+KtFdH4mBE1

Score

10^/10

privateloader redline risepro horda infostealer loader persistence stealer

Malware Config

Extracted

Family

redline

Botnet

horda

194.49.94.152:19053

Extracted

Family

risepro

194.49.94.152

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral8/memory/1788-7-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
Drops startup file 1 IoCs

Processes:

3MI19nZ.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk 3MI19nZ.exe
Executes dropped EXE 2 IoCs

Processes:

2TN3644.exe3MI19nZ.exe

pid process

1312 2TN3644.exe
3584 3MI19nZ.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk	3MI19nZ.exe

pid	process
1312	2TN3644.exe
3584	3MI19nZ.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

6f4e5c3b3a8de995cf390c778532164b570dcf1ea9c58ab8797a7cc16a674a2b.exe3MI19nZ.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6f4e5c3b3a8de995cf390c778532164b570dcf1ea9c58ab8797a7cc16a674a2b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe"	3MI19nZ.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

2TN3644.exe

description pid process target process

PID 1312 set thread context of 1788 1312 2TN3644.exe AppLaunch.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2348 1312 WerFault.exe 2TN3644.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

3300 schtasks.exe
1520 schtasks.exe

description	pid	process	target process
PID 1312 set thread context of 1788	1312	2TN3644.exe	AppLaunch.exe

pid	pid_target	process	target process
2348	1312	WerFault.exe	2TN3644.exe

pid	process
3300	schtasks.exe
1520	schtasks.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

6f4e5c3b3a8de995cf390c778532164b570dcf1ea9c58ab8797a7cc16a674a2b.exe2TN3644.exe3MI19nZ.exe

description	pid	process	target process
PID 3512 wrote to memory of 1312	3512	6f4e5c3b3a8de995cf390c778532164b570dcf1ea9c58ab8797a7cc16a674a2b.exe	2TN3644.exe
PID 3512 wrote to memory of 1312	3512	6f4e5c3b3a8de995cf390c778532164b570dcf1ea9c58ab8797a7cc16a674a2b.exe	2TN3644.exe
PID 3512 wrote to memory of 1312	3512	6f4e5c3b3a8de995cf390c778532164b570dcf1ea9c58ab8797a7cc16a674a2b.exe	2TN3644.exe
PID 1312 wrote to memory of 776	1312	2TN3644.exe	AppLaunch.exe
PID 1312 wrote to memory of 776	1312	2TN3644.exe	AppLaunch.exe
PID 1312 wrote to memory of 776	1312	2TN3644.exe	AppLaunch.exe
PID 1312 wrote to memory of 1788	1312	2TN3644.exe	AppLaunch.exe
PID 1312 wrote to memory of 1788	1312	2TN3644.exe	AppLaunch.exe
PID 1312 wrote to memory of 1788	1312	2TN3644.exe	AppLaunch.exe
PID 1312 wrote to memory of 1788	1312	2TN3644.exe	AppLaunch.exe
PID 1312 wrote to memory of 1788	1312	2TN3644.exe	AppLaunch.exe
PID 1312 wrote to memory of 1788	1312	2TN3644.exe	AppLaunch.exe
PID 1312 wrote to memory of 1788	1312	2TN3644.exe	AppLaunch.exe
PID 1312 wrote to memory of 1788	1312	2TN3644.exe	AppLaunch.exe
PID 3512 wrote to memory of 3584	3512	6f4e5c3b3a8de995cf390c778532164b570dcf1ea9c58ab8797a7cc16a674a2b.exe	3MI19nZ.exe
PID 3512 wrote to memory of 3584	3512	6f4e5c3b3a8de995cf390c778532164b570dcf1ea9c58ab8797a7cc16a674a2b.exe	3MI19nZ.exe
PID 3512 wrote to memory of 3584	3512	6f4e5c3b3a8de995cf390c778532164b570dcf1ea9c58ab8797a7cc16a674a2b.exe	3MI19nZ.exe
PID 3584 wrote to memory of 3300	3584	3MI19nZ.exe	schtasks.exe
PID 3584 wrote to memory of 3300	3584	3MI19nZ.exe	schtasks.exe
PID 3584 wrote to memory of 3300	3584	3MI19nZ.exe	schtasks.exe
PID 3584 wrote to memory of 1520	3584	3MI19nZ.exe	schtasks.exe
PID 3584 wrote to memory of 1520	3584	3MI19nZ.exe	schtasks.exe
PID 3584 wrote to memory of 1520	3584	3MI19nZ.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\6f4e5c3b3a8de995cf390c778532164b570dcf1ea9c58ab8797a7cc16a674a2b.exe
"C:\Users\Admin\AppData\Local\Temp\6f4e5c3b3a8de995cf390c778532164b570dcf1ea9c58ab8797a7cc16a674a2b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3512

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2TN3644.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2TN3644.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1312

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:776

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:1788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1312 -s 604
3⤵
- Program crash
PID:2348

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3MI19nZ.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3MI19nZ.exe
2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3584

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
3⤵
- Creates scheduled task(s)
PID:3300

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
3⤵
- Creates scheduled task(s)
PID:1520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1312 -ip 1312
1⤵
PID:3920

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2TN3644.exe
Filesize
432KB

MD5
68ecf8e3eb9d76b29b8a6fc521bb1b4e

SHA1
c9f0936465c21a56da3f75a7e948ce534f2219ab

SHA256
5d3b85e43179cce3809fb43b5bb0d1cd03517c3c31c23464d5df02f773540bb4

SHA512
85317dffd6413adf27fc2fa7b4f5c52be6132b184ecfb768f04031c0b08be86c72594e150e47a3f1da20e9d64233ea266dfa0bae3d3f344efbce4b79013eea02

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3MI19nZ.exe
Filesize
1.3MB

MD5
28ff03e79350e2647520cdc2253c0f11

SHA1
98b59336d0aae28c142cbbc45e5dd83c66ca5e06

SHA256
4291ee973da4fd7b9a7b6a3b1c58793fc079144a2c97fcb71d2157af88f47d81

SHA512
ab162ba24379569e5766d00d29b994872d718f6fe566dfbd1ce06e41fbc7cabdce7e1c5c38971c5fe78e1d121550fafe32ea2c99ba7dfb1177766f23c5f1fe2b

Download Submit
memory/1788-12-0x0000000073FF0000-0x00000000747A0000-memory.dmp

Filesize
7.7MB

Download
memory/1788-9-0x0000000007C20000-0x00000000081C4000-memory.dmp

Filesize
5.6MB

Download
memory/1788-10-0x0000000007750000-0x00000000077E2000-memory.dmp

Filesize
584KB

Download
memory/1788-11-0x0000000004D40000-0x0000000004D4A000-memory.dmp

Filesize
40KB

Download
memory/1788-8-0x0000000073FFE000-0x0000000073FFF000-memory.dmp

Filesize
4KB

Download
memory/1788-7-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1788-16-0x00000000087F0000-0x0000000008E08000-memory.dmp

Filesize
6.1MB

Download
memory/1788-19-0x0000000007A90000-0x0000000007B9A000-memory.dmp

Filesize
1.0MB

Download
memory/1788-20-0x0000000007900000-0x0000000007912000-memory.dmp

Filesize
72KB

Download
memory/1788-21-0x00000000079C0000-0x00000000079FC000-memory.dmp

Filesize
240KB

Download
memory/1788-22-0x0000000007A00000-0x0000000007A4C000-memory.dmp

Filesize
304KB

Download
memory/1788-28-0x0000000073FFE000-0x0000000073FFF000-memory.dmp

Filesize
4KB

Download
memory/1788-29-0x0000000073FF0000-0x00000000747A0000-memory.dmp

Filesize
7.7MB

Download