privateloader | 9874024432d4a4dc4017d0ebf9773eaea78b9aea747dfbe995938af4b572eb38

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 10:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1319d8370208b00e5260cfc0b8f145575c62bd43ab6f76605a992afeb6737f15.exe
Size

803KB
MD5

acbc2a373e18ef3c6f7674f0a41a2309
SHA1

f786e204ad0ee7db4c64dbc92dcdcbf0b205f1ac
SHA256

1319d8370208b00e5260cfc0b8f145575c62bd43ab6f76605a992afeb6737f15
SHA512

1341f9e896457ce6f88e2aeb0b2fab8f3949eb29e89ec52ebd65c75166c4a43411a8f969a687f20f69e8179cb3f0a542345dda206620c302a5d3f57c36dabf8e
SSDEEP

12288:PMrXy90nEdYGF/dYrO/K3M2552xWH/XypBUBTq0wuZnB3GiNk7RaWI0cC79Yj11U:My4EbF6a/Km+/XypaxwuZnVFN6R0uhr

Score

10^/10

privateloader redline risepro taiga infostealer loader persistence stealer

Malware Config

Extracted

Family

redline

Botnet

taiga

5.42.92.51:19057

Extracted

Family

risepro

5.42.92.51

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral3/memory/1420-7-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
Executes dropped EXE 2 IoCs

Processes:

2ie3424.exe4vx399Me.exe

pid process

1184 2ie3424.exe
3884 4vx399Me.exe

pid	process
1184	2ie3424.exe
3884	4vx399Me.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

1319d8370208b00e5260cfc0b8f145575c62bd43ab6f76605a992afeb6737f15.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	1319d8370208b00e5260cfc0b8f145575c62bd43ab6f76605a992afeb6737f15.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

2ie3424.exe

description pid process target process

PID 1184 set thread context of 1420 1184 2ie3424.exe AppLaunch.exe

description	pid	process	target process
PID 1184 set thread context of 1420	1184	2ie3424.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

1319d8370208b00e5260cfc0b8f145575c62bd43ab6f76605a992afeb6737f15.exe2ie3424.exe

description	pid	process	target process
PID 4964 wrote to memory of 1184	4964	1319d8370208b00e5260cfc0b8f145575c62bd43ab6f76605a992afeb6737f15.exe	2ie3424.exe
PID 4964 wrote to memory of 1184	4964	1319d8370208b00e5260cfc0b8f145575c62bd43ab6f76605a992afeb6737f15.exe	2ie3424.exe
PID 4964 wrote to memory of 1184	4964	1319d8370208b00e5260cfc0b8f145575c62bd43ab6f76605a992afeb6737f15.exe	2ie3424.exe
PID 1184 wrote to memory of 4920	1184	2ie3424.exe	AppLaunch.exe
PID 1184 wrote to memory of 4920	1184	2ie3424.exe	AppLaunch.exe
PID 1184 wrote to memory of 4920	1184	2ie3424.exe	AppLaunch.exe
PID 1184 wrote to memory of 1420	1184	2ie3424.exe	AppLaunch.exe
PID 1184 wrote to memory of 1420	1184	2ie3424.exe	AppLaunch.exe
PID 1184 wrote to memory of 1420	1184	2ie3424.exe	AppLaunch.exe
PID 1184 wrote to memory of 1420	1184	2ie3424.exe	AppLaunch.exe
PID 1184 wrote to memory of 1420	1184	2ie3424.exe	AppLaunch.exe
PID 1184 wrote to memory of 1420	1184	2ie3424.exe	AppLaunch.exe
PID 1184 wrote to memory of 1420	1184	2ie3424.exe	AppLaunch.exe
PID 1184 wrote to memory of 1420	1184	2ie3424.exe	AppLaunch.exe
PID 4964 wrote to memory of 3884	4964	1319d8370208b00e5260cfc0b8f145575c62bd43ab6f76605a992afeb6737f15.exe	4vx399Me.exe
PID 4964 wrote to memory of 3884	4964	1319d8370208b00e5260cfc0b8f145575c62bd43ab6f76605a992afeb6737f15.exe	4vx399Me.exe
PID 4964 wrote to memory of 3884	4964	1319d8370208b00e5260cfc0b8f145575c62bd43ab6f76605a992afeb6737f15.exe	4vx399Me.exe

C:\Users\Admin\AppData\Local\Temp\1319d8370208b00e5260cfc0b8f145575c62bd43ab6f76605a992afeb6737f15.exe
"C:\Users\Admin\AppData\Local\Temp\1319d8370208b00e5260cfc0b8f145575c62bd43ab6f76605a992afeb6737f15.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4964

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2ie3424.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2ie3424.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1184

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:4920

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:1420

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4vx399Me.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4vx399Me.exe
2⤵
- Executes dropped EXE
PID:3884

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2ie3424.exe
Filesize
414KB

MD5
4458a3b4ea84f6b01c1c2eb130e5dc88

SHA1
4a86f29e61226525b8a3ebe907d9b552c4fc9b3d

SHA256
215160f0b3e658359a8a74e089b70cd8fd2acf7721ccbbfdfc48aff86e8ab527

SHA512
1741ccd7a4f7c2d724ed8b786268e84a340d136aff98260df407bde52d085eb4ecf131e764fafa731781be0832d5ffd77f882f9189a0de85d77c70d99768366d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4vx399Me.exe
Filesize
1.3MB

MD5
1445e15ac40600dc3c0f3213caef938e

SHA1
b6e0477e9e331d46bc2769fdacb93f768ce740ab

SHA256
df0d49f0e52e73be0552ad32b50a06ac8f3f8a523fcbe72a9750c686ead1af4b

SHA512
5802c73e29b77b93c641cd2c4a66da228e5a0f3f2e7d10082dca08afc77eeeb57e44ab03c2a84b281457f7262fd4f91d57fe759b96039ba3738e1ba99fc6afda

Download Submit
memory/1420-7-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1420-11-0x0000000073CCE000-0x0000000073CCF000-memory.dmp

Filesize
4KB

Download
memory/1420-12-0x0000000007900000-0x0000000007EA4000-memory.dmp

Filesize
5.6MB

Download
memory/1420-13-0x00000000073F0000-0x0000000007482000-memory.dmp

Filesize
584KB

Download
memory/1420-14-0x0000000004A20000-0x0000000004A2A000-memory.dmp

Filesize
40KB

Download
memory/1420-15-0x00000000084D0000-0x0000000008AE8000-memory.dmp

Filesize
6.1MB

Download
memory/1420-16-0x0000000007EB0000-0x0000000007FBA000-memory.dmp

Filesize
1.0MB

Download
memory/1420-17-0x0000000007700000-0x0000000007712000-memory.dmp

Filesize
72KB

Download
memory/1420-18-0x0000000007770000-0x00000000077AC000-memory.dmp

Filesize
240KB

Download
memory/1420-19-0x00000000077B0000-0x00000000077FC000-memory.dmp

Filesize
304KB

Download