privateloader | dcf4e78aa4f4a43375e6c66a708f11e84986bd1f7bacc1564324e028fcba76f4

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 10:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81efe73b978b0562c9e65634dc76439053942720aa56e6ff1e4cfc01f3ec0c49.exe
Size

1.1MB
MD5

68bc4e67bc272c0efd4dc2ae3c71bdec
SHA1

210e2c7dd26a28f613b0159d07ef6c2bdbf05f3b
SHA256

81efe73b978b0562c9e65634dc76439053942720aa56e6ff1e4cfc01f3ec0c49
SHA512

3b954a625c5d92f8903108df8af5758f093357831089488f436a06f32c04329bac6711f710cfb67e641394de6e53ea0273618a8c8463d92ebc5cea80b0930832
SSDEEP

24576:byUaBtMhoZZpzkSeSKEBGzsrGS6wiAYivOM0vG+MHD:OUaB1eS5GzcGn5ED0a

Score

10^/10

privateloader redline risepro horda infostealer loader persistence stealer

Malware Config

Extracted

Family

redline

Botnet

horda

194.49.94.152:19053

Extracted

Family

risepro

194.49.94.152

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral4/memory/3416-7-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Executes dropped EXE 2 IoCs

pid	Process
3244	11Tr2528.exe
1324	12Nj159.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	81efe73b978b0562c9e65634dc76439053942720aa56e6ff1e4cfc01f3ec0c49.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3244 set thread context of 3416	3244	11Tr2528.exe	85
PID 1324 set thread context of 1348	1324	12Nj159.exe	91

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 3244	1388	81efe73b978b0562c9e65634dc76439053942720aa56e6ff1e4cfc01f3ec0c49.exe	83
PID 1388 wrote to memory of 3244	1388	81efe73b978b0562c9e65634dc76439053942720aa56e6ff1e4cfc01f3ec0c49.exe	83
PID 1388 wrote to memory of 3244	1388	81efe73b978b0562c9e65634dc76439053942720aa56e6ff1e4cfc01f3ec0c49.exe	83
PID 3244 wrote to memory of 3416	3244	11Tr2528.exe	85
PID 3244 wrote to memory of 3416	3244	11Tr2528.exe	85
PID 3244 wrote to memory of 3416	3244	11Tr2528.exe	85
PID 3244 wrote to memory of 3416	3244	11Tr2528.exe	85
PID 3244 wrote to memory of 3416	3244	11Tr2528.exe	85
PID 3244 wrote to memory of 3416	3244	11Tr2528.exe	85
PID 3244 wrote to memory of 3416	3244	11Tr2528.exe	85
PID 3244 wrote to memory of 3416	3244	11Tr2528.exe	85
PID 1388 wrote to memory of 1324	1388	81efe73b978b0562c9e65634dc76439053942720aa56e6ff1e4cfc01f3ec0c49.exe	89
PID 1388 wrote to memory of 1324	1388	81efe73b978b0562c9e65634dc76439053942720aa56e6ff1e4cfc01f3ec0c49.exe	89
PID 1388 wrote to memory of 1324	1388	81efe73b978b0562c9e65634dc76439053942720aa56e6ff1e4cfc01f3ec0c49.exe	89
PID 1324 wrote to memory of 1348	1324	12Nj159.exe	91
PID 1324 wrote to memory of 1348	1324	12Nj159.exe	91
PID 1324 wrote to memory of 1348	1324	12Nj159.exe	91
PID 1324 wrote to memory of 1348	1324	12Nj159.exe	91
PID 1324 wrote to memory of 1348	1324	12Nj159.exe	91
PID 1324 wrote to memory of 1348	1324	12Nj159.exe	91
PID 1324 wrote to memory of 1348	1324	12Nj159.exe	91
PID 1324 wrote to memory of 1348	1324	12Nj159.exe	91
PID 1324 wrote to memory of 1348	1324	12Nj159.exe	91
PID 1324 wrote to memory of 1348	1324	12Nj159.exe	91

C:\Users\Admin\AppData\Local\Temp\81efe73b978b0562c9e65634dc76439053942720aa56e6ff1e4cfc01f3ec0c49.exe
"C:\Users\Admin\AppData\Local\Temp\81efe73b978b0562c9e65634dc76439053942720aa56e6ff1e4cfc01f3ec0c49.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\11Tr2528.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\11Tr2528.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3244
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:3416
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\12Nj159.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\12Nj159.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1324
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:1348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\11Tr2528.exe

Filesize
1.1MB

MD5
10fc2067fb7ed2e46e2ee8d8421b0483

SHA1
0325cf4101ecee6681dbf51da2aa570baa9869a7

SHA256
f41140902ec30a726bbcb7f38530831a55670aaa20f97bd176fa7a0f8e73af7d

SHA512
142796d8c48ee617fee23e036fbffff4da73edf22276143dd1a09a11bed96f375ebb9ba0c140317df4afa4d1af6fe79f0374c8af10907357ca3a7b4f95f6339f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\12Nj159.exe

Filesize
2.4MB

MD5
f50d72c6b323d221abc1ca69905fbee9

SHA1
4a023abed02118821994f769a8a1db370b86c3dc

SHA256
f1ba3227c61e59cc2a711a73845cd432e9edac91431683c1d262d4e5e2d1eb79

SHA512
3de9b5ad25289d8a9c7347f6d4c41418645b69495097884b01416598c8be160bd5582cf74a43a86adad31802da690092e310b62e7c1c1a89cbff994f76a77e70

Download Submit
memory/1348-25-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download
memory/1348-22-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download
memory/1348-24-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download
memory/1348-21-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download
memory/3416-16-0x00000000089A0000-0x0000000008FB8000-memory.dmp

Filesize
6.1MB

Download
memory/3416-15-0x0000000074410000-0x0000000074BC0000-memory.dmp

Filesize
7.7MB

Download
memory/3416-14-0x0000000004E60000-0x0000000004E6A000-memory.dmp

Filesize
40KB

Download
memory/3416-17-0x0000000007C80000-0x0000000007D8A000-memory.dmp

Filesize
1.0MB

Download
memory/3416-18-0x00000000079C0000-0x00000000079D2000-memory.dmp

Filesize
72KB

Download
memory/3416-19-0x0000000007B70000-0x0000000007BAC000-memory.dmp

Filesize
240KB

Download
memory/3416-20-0x00000000079F0000-0x0000000007A3C000-memory.dmp

Filesize
304KB

Download
memory/3416-13-0x00000000078D0000-0x0000000007962000-memory.dmp

Filesize
584KB

Download
memory/3416-12-0x0000000007DD0000-0x0000000008374000-memory.dmp

Filesize
5.6MB

Download
memory/3416-8-0x000000007441E000-0x000000007441F000-memory.dmp

Filesize
4KB

Download
memory/3416-7-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3416-26-0x000000007441E000-0x000000007441F000-memory.dmp

Filesize
4KB

Download
memory/3416-27-0x0000000074410000-0x0000000074BC0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads