privateloader | 9874024432d4a4dc4017d0ebf9773eaea78b9aea747dfbe995938af4b572eb38

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 10:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4920924329af964d29e90b0bd3763c20450919411ad6b6ddabfd88061a7555b6.exe
Size

812KB
MD5

ee8b33b784968f37416cc0b7ad45ec89
SHA1

c2981adba90b165a3c7e4c0226415741a5c21b75
SHA256

4920924329af964d29e90b0bd3763c20450919411ad6b6ddabfd88061a7555b6
SHA512

2dd2d92b48fcac58e9ca1e5d03beb031a8c1dcad3566385f3b2525944646efb3a7d118a0e30af45b59b730b25cdff3203f5a3e67d816cc03089df9ec4493c0df
SSDEEP

24576:9yXMN6XoBRXO8uYwG+2bPnIrGxZGCcDUFbPbz:YaaVTG+YIrDCcDUFT

Score

10^/10

privateloader redline risepro horda infostealer loader persistence stealer

Malware Config

Extracted

Family

redline

Botnet

horda

194.49.94.152:19053

Extracted

Family

risepro

194.49.94.152

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral9/memory/3640-7-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
Drops startup file 1 IoCs

Processes:

3Kg06BW.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk 3Kg06BW.exe
Executes dropped EXE 2 IoCs

Processes:

2Aw4820.exe3Kg06BW.exe

pid process

2388 2Aw4820.exe
2084 3Kg06BW.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk	3Kg06BW.exe

pid	process
2388	2Aw4820.exe
2084	3Kg06BW.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

4920924329af964d29e90b0bd3763c20450919411ad6b6ddabfd88061a7555b6.exe3Kg06BW.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	4920924329af964d29e90b0bd3763c20450919411ad6b6ddabfd88061a7555b6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe"	3Kg06BW.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

2Aw4820.exe

description pid process target process

PID 2388 set thread context of 3640 2388 2Aw4820.exe AppLaunch.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2712 2388 WerFault.exe 2Aw4820.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1988 schtasks.exe
2396 schtasks.exe

description	pid	process	target process
PID 2388 set thread context of 3640	2388	2Aw4820.exe	AppLaunch.exe

pid	pid_target	process	target process
2712	2388	WerFault.exe	2Aw4820.exe

pid	process
1988	schtasks.exe
2396	schtasks.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

4920924329af964d29e90b0bd3763c20450919411ad6b6ddabfd88061a7555b6.exe2Aw4820.exe3Kg06BW.exe

description	pid	process	target process
PID 3988 wrote to memory of 2388	3988	4920924329af964d29e90b0bd3763c20450919411ad6b6ddabfd88061a7555b6.exe	2Aw4820.exe
PID 3988 wrote to memory of 2388	3988	4920924329af964d29e90b0bd3763c20450919411ad6b6ddabfd88061a7555b6.exe	2Aw4820.exe
PID 3988 wrote to memory of 2388	3988	4920924329af964d29e90b0bd3763c20450919411ad6b6ddabfd88061a7555b6.exe	2Aw4820.exe
PID 2388 wrote to memory of 3640	2388	2Aw4820.exe	AppLaunch.exe
PID 2388 wrote to memory of 3640	2388	2Aw4820.exe	AppLaunch.exe
PID 2388 wrote to memory of 3640	2388	2Aw4820.exe	AppLaunch.exe
PID 2388 wrote to memory of 3640	2388	2Aw4820.exe	AppLaunch.exe
PID 2388 wrote to memory of 3640	2388	2Aw4820.exe	AppLaunch.exe
PID 2388 wrote to memory of 3640	2388	2Aw4820.exe	AppLaunch.exe
PID 2388 wrote to memory of 3640	2388	2Aw4820.exe	AppLaunch.exe
PID 2388 wrote to memory of 3640	2388	2Aw4820.exe	AppLaunch.exe
PID 3988 wrote to memory of 2084	3988	4920924329af964d29e90b0bd3763c20450919411ad6b6ddabfd88061a7555b6.exe	3Kg06BW.exe
PID 3988 wrote to memory of 2084	3988	4920924329af964d29e90b0bd3763c20450919411ad6b6ddabfd88061a7555b6.exe	3Kg06BW.exe
PID 3988 wrote to memory of 2084	3988	4920924329af964d29e90b0bd3763c20450919411ad6b6ddabfd88061a7555b6.exe	3Kg06BW.exe
PID 2084 wrote to memory of 1988	2084	3Kg06BW.exe	schtasks.exe
PID 2084 wrote to memory of 1988	2084	3Kg06BW.exe	schtasks.exe
PID 2084 wrote to memory of 1988	2084	3Kg06BW.exe	schtasks.exe
PID 2084 wrote to memory of 2396	2084	3Kg06BW.exe	schtasks.exe
PID 2084 wrote to memory of 2396	2084	3Kg06BW.exe	schtasks.exe
PID 2084 wrote to memory of 2396	2084	3Kg06BW.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\4920924329af964d29e90b0bd3763c20450919411ad6b6ddabfd88061a7555b6.exe
"C:\Users\Admin\AppData\Local\Temp\4920924329af964d29e90b0bd3763c20450919411ad6b6ddabfd88061a7555b6.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3988
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2Aw4820.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2Aw4820.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:3640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 596
    3⤵
    - Program crash
    PID:2712
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3Kg06BW.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3Kg06BW.exe
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1988
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 2388 -ip 2388
1⤵
PID:1048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2Aw4820.exe

Filesize
432KB

MD5
db67cbefb71b6489b23306084176971f

SHA1
865f6b7636f1a699455f10b865134f8d4da564c2

SHA256
00e1025a1a5b484ad21ad4bac24ddb33299806cbc1197c8f2963d16d356d6d31

SHA512
1f9cb5dcd4c615b901acb456e78357816664ca1ae1043e73b01c058d481bdb89edbfb93673b021304de293a647e2e37da0febcf7f260d5b2eaef2300aa79c5b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3Kg06BW.exe

Filesize
1.3MB

MD5
af40c6a09d8a65c80c33675694edc203

SHA1
b719edd09bd37edf289f65a4b9e0d765eeecb4ff

SHA256
68c4c2686372db614a4b201f006a1e2c4def7b8c2c2ac969beb140162c5ff463

SHA512
2f7d5159523f9d4f8970f21c61efbf75b145d6c6cf89608f782806b131a7908c28c56be24399500bb4a4c453af68877a94ef2adc8281c481c1c51466499ae1af

Download Submit
memory/3640-12-0x00000000740A0000-0x0000000074850000-memory.dmp

Filesize
7.7MB

Download
memory/3640-9-0x00000000079A0000-0x0000000007F44000-memory.dmp

Filesize
5.6MB

Download
memory/3640-10-0x0000000007490000-0x0000000007522000-memory.dmp

Filesize
584KB

Download
memory/3640-11-0x0000000004A90000-0x0000000004A9A000-memory.dmp

Filesize
40KB

Download
memory/3640-8-0x00000000740AE000-0x00000000740AF000-memory.dmp

Filesize
4KB

Download
memory/3640-7-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3640-18-0x0000000008570000-0x0000000008B88000-memory.dmp

Filesize
6.1MB

Download
memory/3640-21-0x0000000007860000-0x000000000796A000-memory.dmp

Filesize
1.0MB

Download
memory/3640-24-0x0000000007580000-0x0000000007592000-memory.dmp

Filesize
72KB

Download
memory/3640-25-0x00000000076E0000-0x000000000771C000-memory.dmp

Filesize
240KB

Download
memory/3640-26-0x0000000007750000-0x000000000779C000-memory.dmp

Filesize
304KB

Download
memory/3640-28-0x00000000740AE000-0x00000000740AF000-memory.dmp

Filesize
4KB

Download
memory/3640-29-0x00000000740A0000-0x0000000074850000-memory.dmp

Filesize
7.7MB

Download