privateloader | be3323c3b2bd6ba736703199d528de6bf1396e8a7c6b9b58e4ca31fda43b00e0

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 08:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c1f4eb981ff56766e6798073020add168a1f4134cf43e140302c7cec4a6763b.exe
Size

2.4MB
MD5

4318bdec1083890925ec1993a5bfa5de
SHA1

d121b261673cfd0e47e52f61a4ef837c7352afef
SHA256

1c1f4eb981ff56766e6798073020add168a1f4134cf43e140302c7cec4a6763b
SHA512

22195e6069371a8ffb2e2aca86ed07646a130cb0bf52fab5e2e1a2d869f94a87db42da02da120efa3ce890bbe100e153fde97ee8a676cc355a30472cfa09d531
SSDEEP

49152:0nVWJ5rjsk17x/62quYUDdA5DE46JQPyVSxEVo06LNo:qVWrjD1AmiDE4Es4S1L

Score

10^/10

privateloader risepro loader persistence stealer

Malware Config

Extracted

Family

risepro

193.233.132.51

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk	1ee55Tb3.exe

Executes dropped EXE 4 IoCs

pid	Process
4212	hh0HA79.exe
2464	sf7IJ35.exe
1532	lv4qS31.exe
1132	1ee55Tb3.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	lv4qS31.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe"	1ee55Tb3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	1c1f4eb981ff56766e6798073020add168a1f4134cf43e140302c7cec4a6763b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	hh0HA79.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	sf7IJ35.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	1ee55Tb3.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	1ee55Tb3.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	1ee55Tb3.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	1ee55Tb3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3220	schtasks.exe
1720	schtasks.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1012 wrote to memory of 4212	1012	1c1f4eb981ff56766e6798073020add168a1f4134cf43e140302c7cec4a6763b.exe	82
PID 1012 wrote to memory of 4212	1012	1c1f4eb981ff56766e6798073020add168a1f4134cf43e140302c7cec4a6763b.exe	82
PID 1012 wrote to memory of 4212	1012	1c1f4eb981ff56766e6798073020add168a1f4134cf43e140302c7cec4a6763b.exe	82
PID 4212 wrote to memory of 2464	4212	hh0HA79.exe	83
PID 4212 wrote to memory of 2464	4212	hh0HA79.exe	83
PID 4212 wrote to memory of 2464	4212	hh0HA79.exe	83
PID 2464 wrote to memory of 1532	2464	sf7IJ35.exe	85
PID 2464 wrote to memory of 1532	2464	sf7IJ35.exe	85
PID 2464 wrote to memory of 1532	2464	sf7IJ35.exe	85
PID 1532 wrote to memory of 1132	1532	lv4qS31.exe	86
PID 1532 wrote to memory of 1132	1532	lv4qS31.exe	86
PID 1532 wrote to memory of 1132	1532	lv4qS31.exe	86
PID 1132 wrote to memory of 3220	1132	1ee55Tb3.exe	90
PID 1132 wrote to memory of 3220	1132	1ee55Tb3.exe	90
PID 1132 wrote to memory of 3220	1132	1ee55Tb3.exe	90
PID 1132 wrote to memory of 1720	1132	1ee55Tb3.exe	92
PID 1132 wrote to memory of 1720	1132	1ee55Tb3.exe	92
PID 1132 wrote to memory of 1720	1132	1ee55Tb3.exe	92

C:\Users\Admin\AppData\Local\Temp\1c1f4eb981ff56766e6798073020add168a1f4134cf43e140302c7cec4a6763b.exe
"C:\Users\Admin\AppData\Local\Temp\1c1f4eb981ff56766e6798073020add168a1f4134cf43e140302c7cec4a6763b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1012
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\hh0HA79.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\hh0HA79.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4212
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf7IJ35.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf7IJ35.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2464
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lv4qS31.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lv4qS31.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1532
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ee55Tb3.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ee55Tb3.exe
        5⤵
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1132
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
        6⤵
        Creates scheduled task(s)
        
        PID:3220
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
        6⤵
        Creates scheduled task(s)
        
        PID:1720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:3296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\hh0HA79.exe

Filesize
1.9MB

MD5
ddfd9355f58cba7eb74bdeefbbed03f3

SHA1
c2c9ffff5b2ed29bde6bc90d468979d0274eba99

SHA256
f70eb1957a6ad4d1eb7a95190d4fb211b0ab700e9a7a5c9163c8ca96bdfb44b8

SHA512
69a40b1e2b94155d4df05b763ad601dfe1de72c971f37cae4ea551d471cc757f63fe00e111a7c5bde952d5944aabda61543a5d413e8d36f86fde2f9dcae63dd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf7IJ35.exe

Filesize
1.2MB

MD5
d193e1fe8fd5ac3c8e26621981a02eaf

SHA1
4dfdaee5ccb2d0d2c1b75428fb74a14a0c508827

SHA256
634d06025338c979da47815bc89e6c8715c00714aa31a7d8debf529b3690a940

SHA512
abb70cb2d87ac2b920408c49100598b13e5e0af77c08c6427f31f3dff87ba08078f5560b1513b3fcf25ccabd469c1c1446bcc8f481329a5f0fbf0c99a29455cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lv4qS31.exe

Filesize
1.1MB

MD5
74ffc780c04052381410995371ec758f

SHA1
4a499f1410ce10c1a22004b570e5d43d5fc5d697

SHA256
3d0e97a04dde85bfa821de32de6bc69d854c6d4308a92b69c64d7eda177a73d2

SHA512
7ffa1246573d46709f7488b3cbf7b7447ee8739326acea7bc64d36cc100c479ea152b376c6d98c155979342e3af4d48d24509a2d63f0a2fb710ea2befcb9d8fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ee55Tb3.exe

Filesize
934KB

MD5
f0f802ca0818445069f6c7200e0bfd32

SHA1
e5de83318c9077d158e916d522a51b1469d5922c

SHA256
3e5e8848acf0eff993c64708071d8bf9f52b7e5b85f11471cb9de3ea9abbb474

SHA512
312f924236c21f61a872a335f70b68654b56033701d0ac8ff3e74e69cb73a1aa342830802a020bd90f4d85075865379a193aaf2cfe122f6c91ce2058f340cec2

Download Submit
memory/1132-42-0x0000000000400000-0x000000000090C000-memory.dmp

Filesize
5.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads