privateloader | 78044ff8f74edccd5579136ba1d670ce4f382444735c3885ab0542dd2b77ce63

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 12:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4da066114fff05c7f108852d67f4151134d789b0b406c964771aa61acdaf28cb.exe
Size

1.1MB
MD5

fe2064125b9df0ddb55feff8a7aa1d56
SHA1

bce38bd767a42f8de5f35963bf5ba5fc1f17e96c
SHA256

4da066114fff05c7f108852d67f4151134d789b0b406c964771aa61acdaf28cb
SHA512

118b9643bc25032ae2b53239deb9b6c23cccbbf72fe07def7514f9d1da78db5afb06d50e7df002880e19ac3698e51914909c082c0898e5422603c25e04250026
SSDEEP

24576:gyb3cYGvxdgfbR6mUOSop/PJIJ6Hw4SFfTV5uvhIN:nb3e3e0nAZJIJb4UfTV5

Score

10^/10

privateloader redline risepro horda infostealer loader persistence stealer

Malware Config

Extracted

Family

redline

Botnet

horda

194.49.94.152:19053

Extracted

Family

risepro

194.49.94.152

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral3/memory/4748-21-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk	3Zo15iM.exe

Executes dropped EXE 4 IoCs

pid	Process
1908	FP1VX57.exe
2588	KF8bt38.exe
4516	2jz3307.exe
3452	3Zo15iM.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	KF8bt38.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe"	3Zo15iM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	4da066114fff05c7f108852d67f4151134d789b0b406c964771aa61acdaf28cb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	FP1VX57.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4516 set thread context of 4748	4516	2jz3307.exe	106

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2412	4516	WerFault.exe	87

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1396	schtasks.exe
556	schtasks.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 888 wrote to memory of 1908	888	4da066114fff05c7f108852d67f4151134d789b0b406c964771aa61acdaf28cb.exe	84
PID 888 wrote to memory of 1908	888	4da066114fff05c7f108852d67f4151134d789b0b406c964771aa61acdaf28cb.exe	84
PID 888 wrote to memory of 1908	888	4da066114fff05c7f108852d67f4151134d789b0b406c964771aa61acdaf28cb.exe	84
PID 1908 wrote to memory of 2588	1908	FP1VX57.exe	86
PID 1908 wrote to memory of 2588	1908	FP1VX57.exe	86
PID 1908 wrote to memory of 2588	1908	FP1VX57.exe	86
PID 2588 wrote to memory of 4516	2588	KF8bt38.exe	87
PID 2588 wrote to memory of 4516	2588	KF8bt38.exe	87
PID 2588 wrote to memory of 4516	2588	KF8bt38.exe	87
PID 4516 wrote to memory of 4748	4516	2jz3307.exe	106
PID 4516 wrote to memory of 4748	4516	2jz3307.exe	106
PID 4516 wrote to memory of 4748	4516	2jz3307.exe	106
PID 4516 wrote to memory of 4748	4516	2jz3307.exe	106
PID 4516 wrote to memory of 4748	4516	2jz3307.exe	106
PID 4516 wrote to memory of 4748	4516	2jz3307.exe	106
PID 4516 wrote to memory of 4748	4516	2jz3307.exe	106
PID 4516 wrote to memory of 4748	4516	2jz3307.exe	106
PID 2588 wrote to memory of 3452	2588	KF8bt38.exe	110
PID 2588 wrote to memory of 3452	2588	KF8bt38.exe	110
PID 2588 wrote to memory of 3452	2588	KF8bt38.exe	110
PID 3452 wrote to memory of 556	3452	3Zo15iM.exe	111
PID 3452 wrote to memory of 556	3452	3Zo15iM.exe	111
PID 3452 wrote to memory of 556	3452	3Zo15iM.exe	111
PID 3452 wrote to memory of 1396	3452	3Zo15iM.exe	113
PID 3452 wrote to memory of 1396	3452	3Zo15iM.exe	113
PID 3452 wrote to memory of 1396	3452	3Zo15iM.exe	113

C:\Users\Admin\AppData\Local\Temp\4da066114fff05c7f108852d67f4151134d789b0b406c964771aa61acdaf28cb.exe
"C:\Users\Admin\AppData\Local\Temp\4da066114fff05c7f108852d67f4151134d789b0b406c964771aa61acdaf28cb.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:888
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FP1VX57.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FP1VX57.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1908
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KF8bt38.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KF8bt38.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2588
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2jz3307.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2jz3307.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:4516
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        
        PID:4748
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 136
        5⤵
        Program crash
        
        PID:2412
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Zo15iM.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Zo15iM.exe
      4⤵
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3452
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
        5⤵
        Creates scheduled task(s)
        
        PID:556
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
        5⤵
        Creates scheduled task(s)
        
        PID:1396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4516 -ip 4516
1⤵
PID:4412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FP1VX57.exe

Filesize
936KB

MD5
ec1a421181176dbbf42ad9d58e465d58

SHA1
05b8d3921d6aaabe7ef1c87a578dcb729f1fd1aa

SHA256
00d2cb4518c405fa49079e955e4d6aed3a01c573d29fc6f73446373d1f93bf25

SHA512
287d0550ddc0f111deb0d42d68bc7610c1c33584ff1689a9794d7e2d9cdc1e43b93b44c0307599eef27d508cd2ae7f3a4f7ad556018ef7516f6e3c64f4895016

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KF8bt38.exe

Filesize
811KB

MD5
853aaeb7be3fe8a431ba81ab7b5140c1

SHA1
c51af52edb940f0bbc6f263bc21f7fed91c1b1ed

SHA256
e224411cbb09ad4549d3f8ada95c5df38474c224ef67f00b529cba4f09595b02

SHA512
8db4f510396bf5075160fe90c0166d96d5ce2f5cbd62105e25236ac2ba879e0f656aaf4401fc0c7d41770e6529f6f08ea5dd5440b075a2f35fdace8bcb815e55

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2jz3307.exe

Filesize
432KB

MD5
4fef45d155972b7bb3987debd751c875

SHA1
f0fabe88efc1c945d73f127251037640e9c6a84e

SHA256
5ebcc6e22c14b95bbfdb0fcbec36cf5db0765f7d2a0a4d43df912e3de13708c0

SHA512
224ef4815b2140ac5edd7d812b063375f346e959e3809622bfd6eed7ea800e892221a4c071874c32d7b035b5ef358693da164b0de3fdd5c8fe755e442c6ec533

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Zo15iM.exe

Filesize
1.3MB

MD5
f38878792bc22f87149a25893dbc8248

SHA1
f6246803d8727d77f8f86ad16d20355ac53ac961

SHA256
b63ca61b48dd1b9d9d34b76d306aca4df831d21480420fe23b95d2b1b5c168c8

SHA512
215bcb459efd4afd2f9a00b994aaab180a66e124f40b7d3d01b5e2ca23524fc2e0e5b334d982823740b8f5d1a888241aa8c4ba338c23f54d9346fb7ba00d69f9

Download Submit
memory/4748-24-0x0000000002E80000-0x0000000002E8A000-memory.dmp

Filesize
40KB

Download
memory/4748-23-0x0000000007AA0000-0x0000000007B32000-memory.dmp

Filesize
584KB

Download
memory/4748-22-0x0000000007FB0000-0x0000000008554000-memory.dmp

Filesize
5.6MB

Download
memory/4748-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4748-30-0x0000000008B80000-0x0000000009198000-memory.dmp

Filesize
6.1MB

Download
memory/4748-31-0x0000000007D70000-0x0000000007E7A000-memory.dmp

Filesize
1.0MB

Download
memory/4748-32-0x0000000007C60000-0x0000000007C72000-memory.dmp

Filesize
72KB

Download
memory/4748-33-0x0000000007CC0000-0x0000000007CFC000-memory.dmp

Filesize
240KB

Download
memory/4748-38-0x0000000007D00000-0x0000000007D4C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads