privateloader | 78044ff8f74edccd5579136ba1d670ce4f382444735c3885ab0542dd2b77ce63

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 12:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba66c3ba45ca9b8976288e133180837ff25f0e016b2c79dc3945bba768329c93.exe
Size

2.1MB
MD5

be615072e8646d8e499b85fee33b60cd
SHA1

fd7a4137aa4f1beab319b97d9feb4d40492a633e
SHA256

ba66c3ba45ca9b8976288e133180837ff25f0e016b2c79dc3945bba768329c93
SHA512

03840c6b6089b0d217239de77cb05f900c03308e160313661fad5e06d77af61a70830a855bdbbd34830894ff2d3a1ba0ca921874552a911476670662cd4f3124
SSDEEP

49152:l/NVoswjCaT3wOgdJrRuzs9bKouNd4EzJSGNma65i/yMQ2NvO:dj36r8jtlKouNVNNma+L2Q

Score

10^/10

privateloader risepro loader persistence stealer

Malware Config

Extracted

Family

risepro

194.49.94.152

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk	1Lu53zV9.exe

Executes dropped EXE 4 IoCs

pid	Process
2396	bp9ir47.exe
408	HW6KR06.exe
4940	rz1GQ66.exe
1912	1Lu53zV9.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ba66c3ba45ca9b8976288e133180837ff25f0e016b2c79dc3945bba768329c93.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	bp9ir47.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	HW6KR06.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	rz1GQ66.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe"	1Lu53zV9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
116	schtasks.exe
1536	schtasks.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 2396	3992	ba66c3ba45ca9b8976288e133180837ff25f0e016b2c79dc3945bba768329c93.exe	83
PID 3992 wrote to memory of 2396	3992	ba66c3ba45ca9b8976288e133180837ff25f0e016b2c79dc3945bba768329c93.exe	83
PID 3992 wrote to memory of 2396	3992	ba66c3ba45ca9b8976288e133180837ff25f0e016b2c79dc3945bba768329c93.exe	83
PID 2396 wrote to memory of 408	2396	bp9ir47.exe	84
PID 2396 wrote to memory of 408	2396	bp9ir47.exe	84
PID 2396 wrote to memory of 408	2396	bp9ir47.exe	84
PID 408 wrote to memory of 4940	408	HW6KR06.exe	85
PID 408 wrote to memory of 4940	408	HW6KR06.exe	85
PID 408 wrote to memory of 4940	408	HW6KR06.exe	85
PID 4940 wrote to memory of 1912	4940	rz1GQ66.exe	86
PID 4940 wrote to memory of 1912	4940	rz1GQ66.exe	86
PID 4940 wrote to memory of 1912	4940	rz1GQ66.exe	86
PID 1912 wrote to memory of 116	1912	1Lu53zV9.exe	87
PID 1912 wrote to memory of 116	1912	1Lu53zV9.exe	87
PID 1912 wrote to memory of 116	1912	1Lu53zV9.exe	87
PID 1912 wrote to memory of 1536	1912	1Lu53zV9.exe	89
PID 1912 wrote to memory of 1536	1912	1Lu53zV9.exe	89
PID 1912 wrote to memory of 1536	1912	1Lu53zV9.exe	89

C:\Users\Admin\AppData\Local\Temp\ba66c3ba45ca9b8976288e133180837ff25f0e016b2c79dc3945bba768329c93.exe
"C:\Users\Admin\AppData\Local\Temp\ba66c3ba45ca9b8976288e133180837ff25f0e016b2c79dc3945bba768329c93.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bp9ir47.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bp9ir47.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\HW6KR06.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\HW6KR06.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:408
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\rz1GQ66.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\rz1GQ66.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Lu53zV9.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Lu53zV9.exe
        5⤵
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:1912
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
        6⤵
        Creates scheduled task(s)
        
        PID:116
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
        6⤵
        Creates scheduled task(s)
        
        PID:1536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bp9ir47.exe

Filesize
1.6MB

MD5
baecba35a03f73fd4ee978f4b410d81d

SHA1
8ba6a60e1e78c3ed4239b7da45b45846114ed20b

SHA256
7dd2938e019b895660ec2ccab08c77b74bbfb00c68ca9071a79634f578ba6d60

SHA512
e09bcdcf470e19cf439c36cc72bec477a2c8bfb7d55524b1efcd7b322ac451eeb3f9c830e9cbeb805603f45ee463c7ebb3d8d1a6101d3458914fd1b28b33b701

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\HW6KR06.exe

Filesize
1.2MB

MD5
d4318ec995918ac49d26670c129ae67d

SHA1
35b384bffe753c4031664883dd6f1dc5e7f4ef59

SHA256
e2153907efa0da9e8d7c338f76b7f7d07188c5552f1393f7798507fa77158045

SHA512
49d42da318c36edd528acd9de7f7f818a4ca6a11bff927c24d6cdc66a4d3cd3d022f9f0b5c424ab373dc229245376e9be07a5dbc1173fe5f789101ac1241e576

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\rz1GQ66.exe

Filesize
1.0MB

MD5
b5085e5fa210063f13ec0d2524f79b1e

SHA1
0354493de1c555dc96f099a23159a1b7ce9bbc5b

SHA256
cc2c91992a27d919025ec0198efcbc32229f6dd609587891d88f95a78ea0d6f2

SHA512
a94e0b38a2786825d64168399bd1b041a4d583de6f3b8bbc552a4e5a482770960538b9279b667e32edf998e137c85682aaa5cd3890a16225250374d0b8e164c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Lu53zV9.exe

Filesize
1.3MB

MD5
22f22b6ca68f2771588bbdf4043e166a

SHA1
f81ee3fe5b23207ecaeb7e2506e85e63a6d63f86

SHA256
56e7f306eb472ae69cdf6f65a17b268ca398c8703e9a7aa602ab2c0c8da996cc

SHA512
6ccd1875c06112373117d9b9c4915c5838f9fda801e6bd85a8c0268e51c2cf57f93227a77b068a55823ccab8ef13758427e859b6f22ad2adae69950f0fc822ec

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads