privateloader | 8f1630bc8eac64cd06bd503a82b737a5f82d3a748f9021ad1d4babb30749eb84

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 12:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

793977371c7b2f0c227ab38879d056d2d4121073f5f9a8204a60ac2f3238a471.exe
Size

2.1MB
MD5

4336fec8e2367a5e8ed47c3d26dd1ecf
SHA1

93b46fb26ae261c5efd54f1d06b8f6c7735ec467
SHA256

793977371c7b2f0c227ab38879d056d2d4121073f5f9a8204a60ac2f3238a471
SHA512

137126e026ddf41cabf315afe2f3816b7818dae25fa835a57b0f91c79f15be438a1cb81cb8be42be392c79a19298aa33b8a2db835befbf89f50c30516aac9d6f
SSDEEP

49152:fxRDQhHZCY16gX7duuUh94uZq7L+CISuSDodh2tJ:PEhHbNZOfZq7yTSkdh2

Score

10^/10

privateloader risepro loader persistence stealer

Malware Config

Extracted

Family

risepro

194.49.94.152

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
Drops startup file 1 IoCs

Processes:

1cP14Fj4.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk 1cP14Fj4.exe
Executes dropped EXE 4 IoCs

Processes:

Gq4vV63.exeju3BB76.exeVb0QK81.exe1cP14Fj4.exe

pid process

2920 Gq4vV63.exe
5036 ju3BB76.exe
544 Vb0QK81.exe
3984 1cP14Fj4.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk	1cP14Fj4.exe

pid	process
2920	Gq4vV63.exe
5036	ju3BB76.exe
544	Vb0QK81.exe
3984	1cP14Fj4.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ju3BB76.exeVb0QK81.exe1cP14Fj4.exe793977371c7b2f0c227ab38879d056d2d4121073f5f9a8204a60ac2f3238a471.exeGq4vV63.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	ju3BB76.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	Vb0QK81.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe"	1cP14Fj4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	793977371c7b2f0c227ab38879d056d2d4121073f5f9a8204a60ac2f3238a471.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Gq4vV63.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1864 schtasks.exe
4904 schtasks.exe

pid	process
1864	schtasks.exe
4904	schtasks.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

793977371c7b2f0c227ab38879d056d2d4121073f5f9a8204a60ac2f3238a471.exeGq4vV63.exeju3BB76.exeVb0QK81.exe1cP14Fj4.exe

description	pid	process	target process
PID 596 wrote to memory of 2920	596	793977371c7b2f0c227ab38879d056d2d4121073f5f9a8204a60ac2f3238a471.exe	Gq4vV63.exe
PID 596 wrote to memory of 2920	596	793977371c7b2f0c227ab38879d056d2d4121073f5f9a8204a60ac2f3238a471.exe	Gq4vV63.exe
PID 596 wrote to memory of 2920	596	793977371c7b2f0c227ab38879d056d2d4121073f5f9a8204a60ac2f3238a471.exe	Gq4vV63.exe
PID 2920 wrote to memory of 5036	2920	Gq4vV63.exe	ju3BB76.exe
PID 2920 wrote to memory of 5036	2920	Gq4vV63.exe	ju3BB76.exe
PID 2920 wrote to memory of 5036	2920	Gq4vV63.exe	ju3BB76.exe
PID 5036 wrote to memory of 544	5036	ju3BB76.exe	Vb0QK81.exe
PID 5036 wrote to memory of 544	5036	ju3BB76.exe	Vb0QK81.exe
PID 5036 wrote to memory of 544	5036	ju3BB76.exe	Vb0QK81.exe
PID 544 wrote to memory of 3984	544	Vb0QK81.exe	1cP14Fj4.exe
PID 544 wrote to memory of 3984	544	Vb0QK81.exe	1cP14Fj4.exe
PID 544 wrote to memory of 3984	544	Vb0QK81.exe	1cP14Fj4.exe
PID 3984 wrote to memory of 1864	3984	1cP14Fj4.exe	schtasks.exe
PID 3984 wrote to memory of 1864	3984	1cP14Fj4.exe	schtasks.exe
PID 3984 wrote to memory of 1864	3984	1cP14Fj4.exe	schtasks.exe
PID 3984 wrote to memory of 4904	3984	1cP14Fj4.exe	schtasks.exe
PID 3984 wrote to memory of 4904	3984	1cP14Fj4.exe	schtasks.exe
PID 3984 wrote to memory of 4904	3984	1cP14Fj4.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\793977371c7b2f0c227ab38879d056d2d4121073f5f9a8204a60ac2f3238a471.exe
"C:\Users\Admin\AppData\Local\Temp\793977371c7b2f0c227ab38879d056d2d4121073f5f9a8204a60ac2f3238a471.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:596

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Gq4vV63.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Gq4vV63.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2920

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ju3BB76.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ju3BB76.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5036

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Vb0QK81.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Vb0QK81.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:544

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1cP14Fj4.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1cP14Fj4.exe
5⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3984

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
6⤵
- Creates scheduled task(s)
PID:1864

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
6⤵
- Creates scheduled task(s)
PID:4904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4200,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:8
1⤵
PID:2020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Gq4vV63.exe

Filesize
1.6MB

MD5
980c94df72039a945e7398ba0f5909bf

SHA1
32a7c08d57675a9869325f919c172b3a19b2b84c

SHA256
4f3ead5df04651cfa8c3b6b1e40eacccd48933ededec7f051f9d80a8aebcf6f8

SHA512
a951bcdf88070080d2a998e15666cca81e2b702055fa77f6d9206ab30740c5ad6042aa6d26612f62e381d346ca03b6a3b99015b19e53065b9af821eb503dbd0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ju3BB76.exe

Filesize
1.2MB

MD5
c87b7006df390d20b0e6954093df2d1c

SHA1
1e26539651481ebc8639ddb658f4d3af942671be

SHA256
bca7991556ff0081a18d82a3d515137cf5037a9a07fac09c7ad252619310b18d

SHA512
aa0f7984c9b337adb8dcda54c7c6f543980f5c09982c0b4b1c2ef7803bd44b5ebf86aa360f68d0dd4994912c9403a4ca3e2c8fc435c3cbbe18ef019545f4eaf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Vb0QK81.exe

Filesize
1.0MB

MD5
0b00abe64924dc283bb3906006f6d7b6

SHA1
1945fd9d978bc8ea571457c22328953241d1cd02

SHA256
483b3e410f3ee33dbcc7281b592d13d7d9603929675029336e60f259c655063c

SHA512
a2054869fed6f64596f86185920af354956e6326e7753380c0c08140caeea0aea6251dedd3670e772367b662b7f10ef1f633be8846929b8fbf4f086185b28f22

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1cP14Fj4.exe

Filesize
1.3MB

MD5
4565b8afbbc02e2878f2ffdd9d5fcbfa

SHA1
8a61144ea0f6eb75463e26eaf1530e383b7f9986

SHA256
39634ff03a9ec045364ef1bf0c643d76eb3ecc58f571a0d2ea62f8f1c45db5ad

SHA512
df3852b1a4aa6409b4b13afb3bdefea259a69550adab89513e409021129be5c260775687f9fdfa1a1085290bfcdfcabf1c0359b790f4cc5c2312ade6ab93ffb6

Download Submit