privateloader | 3cc30911c3eb32deaf5fb8bc4dfe2ca6abbafa106ab4c16e8ff25a715c1fe7e7

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 08:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f4e5c3b3a8de995cf390c778532164b570dcf1ea9c58ab8797a7cc16a674a2b.exe
Size

811KB
MD5

91d88f49ab29b31c90140453f78f3a17
SHA1

d4fa424afe634eb614ee8f0bbcfadbf766f7f921
SHA256

6f4e5c3b3a8de995cf390c778532164b570dcf1ea9c58ab8797a7cc16a674a2b
SHA512

bb04a4e664f48b7242dcaafc224ab91ec036fa58bc71bdd2a3ed1586b291e38229df844c0ceb666e77645895f95c65b4010d0228ae18beb6f0c82085628486d8
SSDEEP

12288:hMrPy90NL1K7bAhMzYjFnTqZImauCVpXaMZKjRFdH4lUbpvzK8YRIFK:ayAL87bsjZNmavVpK+KtFdH4mBE1

Score

10^/10

privateloader redline risepro horda infostealer loader persistence stealer

Malware Config

Extracted

Family

redline

Botnet

horda

194.49.94.152:19053

Extracted

Family

risepro

194.49.94.152

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral8/memory/1788-7-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk	3MI19nZ.exe

Executes dropped EXE 2 IoCs

pid	Process
1312	2TN3644.exe
3584	3MI19nZ.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6f4e5c3b3a8de995cf390c778532164b570dcf1ea9c58ab8797a7cc16a674a2b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe"	3MI19nZ.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1312 set thread context of 1788	1312	2TN3644.exe	97

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2348	1312	WerFault.exe	82

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3300	schtasks.exe
1520	schtasks.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3512 wrote to memory of 1312	3512	6f4e5c3b3a8de995cf390c778532164b570dcf1ea9c58ab8797a7cc16a674a2b.exe	82
PID 3512 wrote to memory of 1312	3512	6f4e5c3b3a8de995cf390c778532164b570dcf1ea9c58ab8797a7cc16a674a2b.exe	82
PID 3512 wrote to memory of 1312	3512	6f4e5c3b3a8de995cf390c778532164b570dcf1ea9c58ab8797a7cc16a674a2b.exe	82
PID 1312 wrote to memory of 776	1312	2TN3644.exe	96
PID 1312 wrote to memory of 776	1312	2TN3644.exe	96
PID 1312 wrote to memory of 776	1312	2TN3644.exe	96
PID 1312 wrote to memory of 1788	1312	2TN3644.exe	97
PID 1312 wrote to memory of 1788	1312	2TN3644.exe	97
PID 1312 wrote to memory of 1788	1312	2TN3644.exe	97
PID 1312 wrote to memory of 1788	1312	2TN3644.exe	97
PID 1312 wrote to memory of 1788	1312	2TN3644.exe	97
PID 1312 wrote to memory of 1788	1312	2TN3644.exe	97
PID 1312 wrote to memory of 1788	1312	2TN3644.exe	97
PID 1312 wrote to memory of 1788	1312	2TN3644.exe	97
PID 3512 wrote to memory of 3584	3512	6f4e5c3b3a8de995cf390c778532164b570dcf1ea9c58ab8797a7cc16a674a2b.exe	101
PID 3512 wrote to memory of 3584	3512	6f4e5c3b3a8de995cf390c778532164b570dcf1ea9c58ab8797a7cc16a674a2b.exe	101
PID 3512 wrote to memory of 3584	3512	6f4e5c3b3a8de995cf390c778532164b570dcf1ea9c58ab8797a7cc16a674a2b.exe	101
PID 3584 wrote to memory of 3300	3584	3MI19nZ.exe	102
PID 3584 wrote to memory of 3300	3584	3MI19nZ.exe	102
PID 3584 wrote to memory of 3300	3584	3MI19nZ.exe	102
PID 3584 wrote to memory of 1520	3584	3MI19nZ.exe	104
PID 3584 wrote to memory of 1520	3584	3MI19nZ.exe	104
PID 3584 wrote to memory of 1520	3584	3MI19nZ.exe	104

C:\Users\Admin\AppData\Local\Temp\6f4e5c3b3a8de995cf390c778532164b570dcf1ea9c58ab8797a7cc16a674a2b.exe
"C:\Users\Admin\AppData\Local\Temp\6f4e5c3b3a8de995cf390c778532164b570dcf1ea9c58ab8797a7cc16a674a2b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2TN3644.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2TN3644.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1312
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:776
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:1788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1312 -s 604
    3⤵
    - Program crash
    PID:2348
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3MI19nZ.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3MI19nZ.exe
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3584
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3300
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1312 -ip 1312
1⤵
PID:3920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2TN3644.exe

Filesize
432KB

MD5
68ecf8e3eb9d76b29b8a6fc521bb1b4e

SHA1
c9f0936465c21a56da3f75a7e948ce534f2219ab

SHA256
5d3b85e43179cce3809fb43b5bb0d1cd03517c3c31c23464d5df02f773540bb4

SHA512
85317dffd6413adf27fc2fa7b4f5c52be6132b184ecfb768f04031c0b08be86c72594e150e47a3f1da20e9d64233ea266dfa0bae3d3f344efbce4b79013eea02

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3MI19nZ.exe

Filesize
1.3MB

MD5
28ff03e79350e2647520cdc2253c0f11

SHA1
98b59336d0aae28c142cbbc45e5dd83c66ca5e06

SHA256
4291ee973da4fd7b9a7b6a3b1c58793fc079144a2c97fcb71d2157af88f47d81

SHA512
ab162ba24379569e5766d00d29b994872d718f6fe566dfbd1ce06e41fbc7cabdce7e1c5c38971c5fe78e1d121550fafe32ea2c99ba7dfb1177766f23c5f1fe2b

Download Submit
memory/1788-12-0x0000000073FF0000-0x00000000747A0000-memory.dmp

Filesize
7.7MB

Download
memory/1788-9-0x0000000007C20000-0x00000000081C4000-memory.dmp

Filesize
5.6MB

Download
memory/1788-10-0x0000000007750000-0x00000000077E2000-memory.dmp

Filesize
584KB

Download
memory/1788-11-0x0000000004D40000-0x0000000004D4A000-memory.dmp

Filesize
40KB

Download
memory/1788-8-0x0000000073FFE000-0x0000000073FFF000-memory.dmp

Filesize
4KB

Download
memory/1788-7-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1788-16-0x00000000087F0000-0x0000000008E08000-memory.dmp

Filesize
6.1MB

Download
memory/1788-19-0x0000000007A90000-0x0000000007B9A000-memory.dmp

Filesize
1.0MB

Download
memory/1788-20-0x0000000007900000-0x0000000007912000-memory.dmp

Filesize
72KB

Download
memory/1788-21-0x00000000079C0000-0x00000000079FC000-memory.dmp

Filesize
240KB

Download
memory/1788-22-0x0000000007A00000-0x0000000007A4C000-memory.dmp

Filesize
304KB

Download
memory/1788-28-0x0000000073FFE000-0x0000000073FFF000-memory.dmp

Filesize
4KB

Download
memory/1788-29-0x0000000073FF0000-0x00000000747A0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads