privateloader | 8f1630bc8eac64cd06bd503a82b737a5f82d3a748f9021ad1d4babb30749eb84

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 14:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

793977371c7b2f0c227ab38879d056d2d4121073f5f9a8204a60ac2f3238a471.exe
Size

2.1MB
MD5

4336fec8e2367a5e8ed47c3d26dd1ecf
SHA1

93b46fb26ae261c5efd54f1d06b8f6c7735ec467
SHA256

793977371c7b2f0c227ab38879d056d2d4121073f5f9a8204a60ac2f3238a471
SHA512

137126e026ddf41cabf315afe2f3816b7818dae25fa835a57b0f91c79f15be438a1cb81cb8be42be392c79a19298aa33b8a2db835befbf89f50c30516aac9d6f
SSDEEP

49152:fxRDQhHZCY16gX7duuUh94uZq7L+CISuSDodh2tJ:PEhHbNZOfZq7yTSkdh2

Score

10^/10

privateloader risepro loader persistence stealer

Malware Config

Extracted

Family

risepro

194.49.94.152

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
Drops startup file 1 IoCs

Processes:

1cP14Fj4.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk 1cP14Fj4.exe
Executes dropped EXE 4 IoCs

Processes:

Gq4vV63.exeju3BB76.exeVb0QK81.exe1cP14Fj4.exe

pid process

3612 Gq4vV63.exe
864 ju3BB76.exe
1560 Vb0QK81.exe
4104 1cP14Fj4.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk	1cP14Fj4.exe

pid	process
3612	Gq4vV63.exe
864	ju3BB76.exe
1560	Vb0QK81.exe
4104	1cP14Fj4.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

793977371c7b2f0c227ab38879d056d2d4121073f5f9a8204a60ac2f3238a471.exeGq4vV63.exeju3BB76.exeVb0QK81.exe1cP14Fj4.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	793977371c7b2f0c227ab38879d056d2d4121073f5f9a8204a60ac2f3238a471.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Gq4vV63.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	ju3BB76.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	Vb0QK81.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe"	1cP14Fj4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2116 schtasks.exe
4260 schtasks.exe

pid	process
2116	schtasks.exe
4260	schtasks.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

793977371c7b2f0c227ab38879d056d2d4121073f5f9a8204a60ac2f3238a471.exeGq4vV63.exeju3BB76.exeVb0QK81.exe1cP14Fj4.exe

description	pid	process	target process
PID 2680 wrote to memory of 3612	2680	793977371c7b2f0c227ab38879d056d2d4121073f5f9a8204a60ac2f3238a471.exe	Gq4vV63.exe
PID 2680 wrote to memory of 3612	2680	793977371c7b2f0c227ab38879d056d2d4121073f5f9a8204a60ac2f3238a471.exe	Gq4vV63.exe
PID 2680 wrote to memory of 3612	2680	793977371c7b2f0c227ab38879d056d2d4121073f5f9a8204a60ac2f3238a471.exe	Gq4vV63.exe
PID 3612 wrote to memory of 864	3612	Gq4vV63.exe	ju3BB76.exe
PID 3612 wrote to memory of 864	3612	Gq4vV63.exe	ju3BB76.exe
PID 3612 wrote to memory of 864	3612	Gq4vV63.exe	ju3BB76.exe
PID 864 wrote to memory of 1560	864	ju3BB76.exe	Vb0QK81.exe
PID 864 wrote to memory of 1560	864	ju3BB76.exe	Vb0QK81.exe
PID 864 wrote to memory of 1560	864	ju3BB76.exe	Vb0QK81.exe
PID 1560 wrote to memory of 4104	1560	Vb0QK81.exe	1cP14Fj4.exe
PID 1560 wrote to memory of 4104	1560	Vb0QK81.exe	1cP14Fj4.exe
PID 1560 wrote to memory of 4104	1560	Vb0QK81.exe	1cP14Fj4.exe
PID 4104 wrote to memory of 2116	4104	1cP14Fj4.exe	schtasks.exe
PID 4104 wrote to memory of 2116	4104	1cP14Fj4.exe	schtasks.exe
PID 4104 wrote to memory of 2116	4104	1cP14Fj4.exe	schtasks.exe
PID 4104 wrote to memory of 4260	4104	1cP14Fj4.exe	schtasks.exe
PID 4104 wrote to memory of 4260	4104	1cP14Fj4.exe	schtasks.exe
PID 4104 wrote to memory of 4260	4104	1cP14Fj4.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\793977371c7b2f0c227ab38879d056d2d4121073f5f9a8204a60ac2f3238a471.exe
"C:\Users\Admin\AppData\Local\Temp\793977371c7b2f0c227ab38879d056d2d4121073f5f9a8204a60ac2f3238a471.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2680

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Gq4vV63.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Gq4vV63.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3612

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ju3BB76.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ju3BB76.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:864

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Vb0QK81.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Vb0QK81.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1560

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1cP14Fj4.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1cP14Fj4.exe
5⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4104

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
6⤵
- Creates scheduled task(s)
PID:2116

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
6⤵
- Creates scheduled task(s)
PID:4260

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Gq4vV63.exe
Filesize
1.6MB

MD5
980c94df72039a945e7398ba0f5909bf

SHA1
32a7c08d57675a9869325f919c172b3a19b2b84c

SHA256
4f3ead5df04651cfa8c3b6b1e40eacccd48933ededec7f051f9d80a8aebcf6f8

SHA512
a951bcdf88070080d2a998e15666cca81e2b702055fa77f6d9206ab30740c5ad6042aa6d26612f62e381d346ca03b6a3b99015b19e53065b9af821eb503dbd0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ju3BB76.exe
Filesize
1.2MB

MD5
c87b7006df390d20b0e6954093df2d1c

SHA1
1e26539651481ebc8639ddb658f4d3af942671be

SHA256
bca7991556ff0081a18d82a3d515137cf5037a9a07fac09c7ad252619310b18d

SHA512
aa0f7984c9b337adb8dcda54c7c6f543980f5c09982c0b4b1c2ef7803bd44b5ebf86aa360f68d0dd4994912c9403a4ca3e2c8fc435c3cbbe18ef019545f4eaf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Vb0QK81.exe
Filesize
1.0MB

MD5
0b00abe64924dc283bb3906006f6d7b6

SHA1
1945fd9d978bc8ea571457c22328953241d1cd02

SHA256
483b3e410f3ee33dbcc7281b592d13d7d9603929675029336e60f259c655063c

SHA512
a2054869fed6f64596f86185920af354956e6326e7753380c0c08140caeea0aea6251dedd3670e772367b662b7f10ef1f633be8846929b8fbf4f086185b28f22

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1cP14Fj4.exe
Filesize
1.3MB

MD5
4565b8afbbc02e2878f2ffdd9d5fcbfa

SHA1
8a61144ea0f6eb75463e26eaf1530e383b7f9986

SHA256
39634ff03a9ec045364ef1bf0c643d76eb3ecc58f571a0d2ea62f8f1c45db5ad

SHA512
df3852b1a4aa6409b4b13afb3bdefea259a69550adab89513e409021129be5c260775687f9fdfa1a1085290bfcdfcabf1c0359b790f4cc5c2312ade6ab93ffb6

Download Submit