privateloader | 78044ff8f74edccd5579136ba1d670ce4f382444735c3885ab0542dd2b77ce63

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 12:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b093b62b3c10bec126678999d01ec29829b6cd97661fc6492cc56c7a9503c93a.exe
Size

989KB
MD5

4ce53a8b5e242c9786f4e5c93a30e998
SHA1

a4e02da66013d27c523466e8cd5fc1c01a9fe7a5
SHA256

b093b62b3c10bec126678999d01ec29829b6cd97661fc6492cc56c7a9503c93a
SHA512

f6c2ffbf3b1bd4fb783f2745c6b0e551d83ee2143a76f8d7158700ec3ada488e74a5da61d47cb5b852d9668d3b4ff45e51c102b4c43e5cdf113da1953db79192
SSDEEP

24576:OyatlDC2DSBNRzvfyb/7TJkVqbgvvLerBOHvQ2SfuBn:doENlUDVyqEvvGBOHv1G

Score

10^/10

privateloader risepro loader persistence stealer

Malware Config

Extracted

Family

risepro

194.49.94.152

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk	1Le64Mh4.exe

Executes dropped EXE 2 IoCs

pid	Process
3300	Ct4aX25.exe
824	1Le64Mh4.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b093b62b3c10bec126678999d01ec29829b6cd97661fc6492cc56c7a9503c93a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Ct4aX25.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe"	1Le64Mh4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1712	schtasks.exe
4500	schtasks.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 3300	1148	b093b62b3c10bec126678999d01ec29829b6cd97661fc6492cc56c7a9503c93a.exe	81
PID 1148 wrote to memory of 3300	1148	b093b62b3c10bec126678999d01ec29829b6cd97661fc6492cc56c7a9503c93a.exe	81
PID 1148 wrote to memory of 3300	1148	b093b62b3c10bec126678999d01ec29829b6cd97661fc6492cc56c7a9503c93a.exe	81
PID 3300 wrote to memory of 824	3300	Ct4aX25.exe	82
PID 3300 wrote to memory of 824	3300	Ct4aX25.exe	82
PID 3300 wrote to memory of 824	3300	Ct4aX25.exe	82
PID 824 wrote to memory of 1712	824	1Le64Mh4.exe	83
PID 824 wrote to memory of 1712	824	1Le64Mh4.exe	83
PID 824 wrote to memory of 1712	824	1Le64Mh4.exe	83
PID 824 wrote to memory of 4500	824	1Le64Mh4.exe	85
PID 824 wrote to memory of 4500	824	1Le64Mh4.exe	85
PID 824 wrote to memory of 4500	824	1Le64Mh4.exe	85

C:\Users\Admin\AppData\Local\Temp\b093b62b3c10bec126678999d01ec29829b6cd97661fc6492cc56c7a9503c93a.exe
"C:\Users\Admin\AppData\Local\Temp\b093b62b3c10bec126678999d01ec29829b6cd97661fc6492cc56c7a9503c93a.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ct4aX25.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ct4aX25.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3300
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Le64Mh4.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Le64Mh4.exe
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:824
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:1712
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:4500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ct4aX25.exe

Filesize
866KB

MD5
72f76c6644a01d1c973d33f19aa41c86

SHA1
fdb377bc5d582bc73a83aa86fd88640fb4d69674

SHA256
1893c7f2af0031bc8be39ecf03fe8c7ffc3029f2dc639596ed2a6a0395015bb6

SHA512
edffdbe765584bd6ba72fc744d9d76c105614dc329b53d6d00f6005470da0a5140560adef79474f65ee7eb8ea73eb426c65eb21230802926efb7b99887c8932f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Le64Mh4.exe

Filesize
1.5MB

MD5
aa2d5de1c8a83d297dad6af8c2a968c9

SHA1
29f8f648eb0eaaf78aec45986644edd5ef18e01b

SHA256
c82d8e029611f09bfa3816cc697122f42b0bb0effc423000bc9c52eb070abf86

SHA512
2c820eece53e39562c76ec57cd3ace8ffd27fcc80691310a895a7b4be2dd783d26a7a95e8f6c6e880df74683ef6bd7c98f840497dffaa02c14077dea38c6676e

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads