privateloader | 8f1630bc8eac64cd06bd503a82b737a5f82d3a748f9021ad1d4babb30749eb84

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 14:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad2c12e934ce4a8c4fdd4abf52a21352a8456bc150312c8642d1528f0b44ebbe.exe
Size

2.1MB
MD5

9403aebfcf8861cf7aa95d5f4fe0742c
SHA1

9b43a3afca6601d0b37896d1e9df0d82862ecbcf
SHA256

ad2c12e934ce4a8c4fdd4abf52a21352a8456bc150312c8642d1528f0b44ebbe
SHA512

d50f92534d58566353ba1986f79fa39c922f682a1f7846523327fe97400cd80bdd34920a8ccfb336237875743c2a3f0a0782184a76c3c12613826d4d64483787
SSDEEP

49152:kEVelgb2QALKLgGvYUuP0qINJA+GxZITESaTGq:Ogbq9jMLzA+GLITESa5

Score

10^/10

privateloader risepro loader persistence stealer

Malware Config

Extracted

Family

risepro

194.49.94.152

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
Drops startup file 1 IoCs

Processes:

1IV00pd6.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk 1IV00pd6.exe
Executes dropped EXE 4 IoCs

Processes:

GY3Ro86.exeqX4zw77.exenH7Nq17.exe1IV00pd6.exe

pid process

4916 GY3Ro86.exe
1848 qX4zw77.exe
1712 nH7Nq17.exe
3972 1IV00pd6.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk	1IV00pd6.exe

pid	process
4916	GY3Ro86.exe
1848	qX4zw77.exe
1712	nH7Nq17.exe
3972	1IV00pd6.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

nH7Nq17.exe1IV00pd6.exead2c12e934ce4a8c4fdd4abf52a21352a8456bc150312c8642d1528f0b44ebbe.exeGY3Ro86.exeqX4zw77.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	nH7Nq17.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe"	1IV00pd6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ad2c12e934ce4a8c4fdd4abf52a21352a8456bc150312c8642d1528f0b44ebbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	GY3Ro86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	qX4zw77.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4784 schtasks.exe
4988 schtasks.exe

pid	process
4784	schtasks.exe
4988	schtasks.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

ad2c12e934ce4a8c4fdd4abf52a21352a8456bc150312c8642d1528f0b44ebbe.exeGY3Ro86.exeqX4zw77.exenH7Nq17.exe1IV00pd6.exe

description	pid	process	target process
PID 4972 wrote to memory of 4916	4972	ad2c12e934ce4a8c4fdd4abf52a21352a8456bc150312c8642d1528f0b44ebbe.exe	GY3Ro86.exe
PID 4972 wrote to memory of 4916	4972	ad2c12e934ce4a8c4fdd4abf52a21352a8456bc150312c8642d1528f0b44ebbe.exe	GY3Ro86.exe
PID 4972 wrote to memory of 4916	4972	ad2c12e934ce4a8c4fdd4abf52a21352a8456bc150312c8642d1528f0b44ebbe.exe	GY3Ro86.exe
PID 4916 wrote to memory of 1848	4916	GY3Ro86.exe	qX4zw77.exe
PID 4916 wrote to memory of 1848	4916	GY3Ro86.exe	qX4zw77.exe
PID 4916 wrote to memory of 1848	4916	GY3Ro86.exe	qX4zw77.exe
PID 1848 wrote to memory of 1712	1848	qX4zw77.exe	nH7Nq17.exe
PID 1848 wrote to memory of 1712	1848	qX4zw77.exe	nH7Nq17.exe
PID 1848 wrote to memory of 1712	1848	qX4zw77.exe	nH7Nq17.exe
PID 1712 wrote to memory of 3972	1712	nH7Nq17.exe	1IV00pd6.exe
PID 1712 wrote to memory of 3972	1712	nH7Nq17.exe	1IV00pd6.exe
PID 1712 wrote to memory of 3972	1712	nH7Nq17.exe	1IV00pd6.exe
PID 3972 wrote to memory of 4784	3972	1IV00pd6.exe	schtasks.exe
PID 3972 wrote to memory of 4784	3972	1IV00pd6.exe	schtasks.exe
PID 3972 wrote to memory of 4784	3972	1IV00pd6.exe	schtasks.exe
PID 3972 wrote to memory of 4988	3972	1IV00pd6.exe	schtasks.exe
PID 3972 wrote to memory of 4988	3972	1IV00pd6.exe	schtasks.exe
PID 3972 wrote to memory of 4988	3972	1IV00pd6.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\ad2c12e934ce4a8c4fdd4abf52a21352a8456bc150312c8642d1528f0b44ebbe.exe
"C:\Users\Admin\AppData\Local\Temp\ad2c12e934ce4a8c4fdd4abf52a21352a8456bc150312c8642d1528f0b44ebbe.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4972

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\GY3Ro86.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\GY3Ro86.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4916

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qX4zw77.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qX4zw77.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1848

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nH7Nq17.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nH7Nq17.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1712

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1IV00pd6.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1IV00pd6.exe
5⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3972

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
6⤵
- Creates scheduled task(s)
PID:4784

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
6⤵
- Creates scheduled task(s)
PID:4988

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\GY3Ro86.exe
Filesize
1.6MB

MD5
912d24a9082f93cbdf3d4785431d46e3

SHA1
210a0be7bb92456746cbabb0b96538641897fed8

SHA256
09f8eb6b3cfd310f2a5e99f22150c8d3a2930459953b61899b82b5eeca5124f4

SHA512
3ce680141ace5d7652a219191a905578f831ea4b4d990c1a7665daa209ebd1701affdd8ee1ff9815f05664e7f62807855159cbb7f56befb3409ea7344dd96c78

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qX4zw77.exe
Filesize
1.2MB

MD5
779c9bd17a5fa084ba4768e27b3f2283

SHA1
bdc1500ada30be3252bfa72921bd2740da3eb851

SHA256
a8bd8ac67945dc8416e4104381cf31a7512c1110495873f928dc24237aa2470b

SHA512
cfeed6c470dd97e0b74e201d520d0554585275e1c574a22e7368d087c8a8d5ca10196f22d522376fd910f616ff5631d4298e94480320dbe94f5ca9a6bd629cb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nH7Nq17.exe
Filesize
1.0MB

MD5
adb9cdcfeb198e9b3797b47b3144543a

SHA1
c8a47f7bc2a3773e958f92a54b53b1b249b52de1

SHA256
328fd0e267e3c3732ded7b4343f3aa0d9299a7be1acebd0f081f26a7efff919f

SHA512
2a30f922f7e2ab2158b15e2a601b37f1a2dae9320cb5276da660ddf7eb219efe033da33a85e59d5bd3659ef07d08e3362e4870c686f8f45b3ac7dc6339ab23d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1IV00pd6.exe
Filesize
1.3MB

MD5
9cf5577245e2206879157db5a9dda799

SHA1
98fd6288bd7703f686d85b3d6beabc85767e133b

SHA256
fc21d8ca5504de54794a8112030c2ef41b485cd2a1ac8b74429ae67acac8a6a9

SHA512
10215d1182dfec913f9fed6f20c830b85ca8e48ee9f0f5bdc337f013e60a766ad11471dacdca7522e620f1b51519cfb91aa74334e91dea1c7fc7efe302c8b4e5

Download Submit