privateloader | 02cacf524527064e447c85bef406a6e5125d06b69bd35e10a813bf4a5659b985

Analysis

max time kernel
136s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 09:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4215d26b6f0c0e1bf7e0f7a14e39744684399db4b301d328c8f7df9ca1c0b74.exe
Size

954KB
MD5

2007fd745de85725bd3c50bc100af3dc
SHA1

be0942dfed4466f4181936016cc020ed72918fb6
SHA256

a4215d26b6f0c0e1bf7e0f7a14e39744684399db4b301d328c8f7df9ca1c0b74
SHA512

ca2e84396e623838f7900a2c73f28d5a5675c179a462878232c618234c7f68f1f3e4eb6003f9c9fdacc0bcb7849d2385e63422aa640d6fe3244db49481cc9973
SSDEEP

24576:Ky0CNEQDcgkWfaKBfZh59btIafN7V9joSiS5nYI:RSqjflZttIaV7V9ESR1

Score

10^/10

privateloader redline risepro horda infostealer loader persistence stealer

Malware Config

Extracted

Family

redline

Botnet

horda

194.49.94.152:19053

Extracted

Family

risepro

194.49.94.152

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral15/memory/3984-14-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk	3PV31YF.exe

Executes dropped EXE 3 IoCs

pid	Process
2840	Sp4ZI53.exe
4804	2VQ2365.exe
4156	3PV31YF.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe"	3PV31YF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a4215d26b6f0c0e1bf7e0f7a14e39744684399db4b301d328c8f7df9ca1c0b74.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Sp4ZI53.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4804 set thread context of 3984	4804	2VQ2365.exe	104

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4492	schtasks.exe
4632	schtasks.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 2840	632	a4215d26b6f0c0e1bf7e0f7a14e39744684399db4b301d328c8f7df9ca1c0b74.exe	92
PID 632 wrote to memory of 2840	632	a4215d26b6f0c0e1bf7e0f7a14e39744684399db4b301d328c8f7df9ca1c0b74.exe	92
PID 632 wrote to memory of 2840	632	a4215d26b6f0c0e1bf7e0f7a14e39744684399db4b301d328c8f7df9ca1c0b74.exe	92
PID 2840 wrote to memory of 4804	2840	Sp4ZI53.exe	93
PID 2840 wrote to memory of 4804	2840	Sp4ZI53.exe	93
PID 2840 wrote to memory of 4804	2840	Sp4ZI53.exe	93
PID 4804 wrote to memory of 3984	4804	2VQ2365.exe	104
PID 4804 wrote to memory of 3984	4804	2VQ2365.exe	104
PID 4804 wrote to memory of 3984	4804	2VQ2365.exe	104
PID 4804 wrote to memory of 3984	4804	2VQ2365.exe	104
PID 4804 wrote to memory of 3984	4804	2VQ2365.exe	104
PID 4804 wrote to memory of 3984	4804	2VQ2365.exe	104
PID 4804 wrote to memory of 3984	4804	2VQ2365.exe	104
PID 4804 wrote to memory of 3984	4804	2VQ2365.exe	104
PID 2840 wrote to memory of 4156	2840	Sp4ZI53.exe	105
PID 2840 wrote to memory of 4156	2840	Sp4ZI53.exe	105
PID 2840 wrote to memory of 4156	2840	Sp4ZI53.exe	105
PID 4156 wrote to memory of 4492	4156	3PV31YF.exe	106
PID 4156 wrote to memory of 4492	4156	3PV31YF.exe	106
PID 4156 wrote to memory of 4492	4156	3PV31YF.exe	106
PID 4156 wrote to memory of 4632	4156	3PV31YF.exe	108
PID 4156 wrote to memory of 4632	4156	3PV31YF.exe	108
PID 4156 wrote to memory of 4632	4156	3PV31YF.exe	108

C:\Users\Admin\AppData\Local\Temp\a4215d26b6f0c0e1bf7e0f7a14e39744684399db4b301d328c8f7df9ca1c0b74.exe
"C:\Users\Admin\AppData\Local\Temp\a4215d26b6f0c0e1bf7e0f7a14e39744684399db4b301d328c8f7df9ca1c0b74.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:632
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Sp4ZI53.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Sp4ZI53.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2VQ2365.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2VQ2365.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4804
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:3984
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3PV31YF.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3PV31YF.exe
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4156
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:4492
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:4632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4064 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Sp4ZI53.exe

Filesize
830KB

MD5
58d5924c8c0acef45b18bf42a994da8b

SHA1
bba62e10bf6adae3505d3b763a7b813d9a667716

SHA256
8537fc97d931d0e62896e54756e1cdd774b1b68e20fd7281a207198467c01e4a

SHA512
2ae7e900f50253e72f8bcd190ad7c106fbae4cc18d23607ffb4dd05115409ebf3faca2a5f433ada5431145457f396d1f254017a6aab22052ccd29d36cbf8d92d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2VQ2365.exe

Filesize
493KB

MD5
7d79538bfe9cdb9fe4e443d8bf18a9c7

SHA1
2a61a55ad50a0d72a5b3d46ea67635dc1baf1c6f

SHA256
56b84e843fbce4f42e562ecc2b617e416847a61fa63c9f6a4263a9af04e457a5

SHA512
9fe34f033c306188a7c3ffe8b3e549722ac09ae31de7ecfe37e9ca24713e07450980821d9bd0136a450b201fa77d9238885dfa1841b940c05ef6f7e8770992a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3PV31YF.exe

Filesize
1.3MB

MD5
a1e76c4ab37080c7e7c2e14b7e865c58

SHA1
d19418b430208cc0a92b3992c0ed7a3840aae9c9

SHA256
fb22f95db8d25b023d81ffcd63ea4b9f0f0d3041a0c8007f9be6dd87e564598b

SHA512
a8587ba394a212902364ef3ff10354f8cc4397f1066a46481518b4be9c8de5f363d763bbe12c7771037599c8b68923ea8a18d1693054d884e7fe2d0796271609

Download Submit
memory/3984-14-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3984-22-0x0000000007C00000-0x00000000081A4000-memory.dmp

Filesize
5.6MB

Download
memory/3984-25-0x00000000076F0000-0x0000000007782000-memory.dmp

Filesize
584KB

Download
memory/3984-27-0x00000000051A0000-0x00000000051AA000-memory.dmp

Filesize
40KB

Download
memory/3984-28-0x00000000087D0000-0x0000000008DE8000-memory.dmp

Filesize
6.1MB

Download
memory/3984-29-0x00000000082C0000-0x00000000083CA000-memory.dmp

Filesize
1.0MB

Download
memory/3984-30-0x00000000078D0000-0x00000000078E2000-memory.dmp

Filesize
72KB

Download
memory/3984-31-0x0000000007A70000-0x0000000007AAC000-memory.dmp

Filesize
240KB

Download
memory/3984-32-0x0000000007900000-0x000000000794C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads