privateloader | 8f1630bc8eac64cd06bd503a82b737a5f82d3a748f9021ad1d4babb30749eb84

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 14:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a50f05cf835b0751cd1bf42e4980ad9f9e3c83a3629331a0cdf1ed1240874e5.exe
Size

1.7MB
MD5

5b7449e75139f9cc7488a0afc4c7e728
SHA1

a0c711b8e770060cf6ca185d70e7d6e4e6fc8c85
SHA256

3a50f05cf835b0751cd1bf42e4980ad9f9e3c83a3629331a0cdf1ed1240874e5
SHA512

7e3fe39782e1f1404aa4bcbf0ca3d5ba21a399c8045a61243a67eab538358c618262cb161eb9bde8bf8d9033b9e3c21b70d119b547f5f3bcabdfa16ee940a90a
SSDEEP

24576:0yaSTabSBeDdUlTbIQWIUezGVD7oy49pSrU0RCdSEWYBwa674GhsXnc1x9GhBayw:DxeiGsHBWIUezGVvHg00SdXOGetfayj

Score

10^/10

privateloader risepro loader persistence stealer

Malware Config

Extracted

Family

risepro

193.233.132.51

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
Drops startup file 1 IoCs

Processes:

1Vn87oI8.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk 1Vn87oI8.exe
Executes dropped EXE 2 IoCs

Processes:

WY8bP41.exe1Vn87oI8.exe

pid process

4204 WY8bP41.exe
1756 1Vn87oI8.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk	1Vn87oI8.exe

pid	process
4204	WY8bP41.exe
1756	1Vn87oI8.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

3a50f05cf835b0751cd1bf42e4980ad9f9e3c83a3629331a0cdf1ed1240874e5.exeWY8bP41.exe1Vn87oI8.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	3a50f05cf835b0751cd1bf42e4980ad9f9e3c83a3629331a0cdf1ed1240874e5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	WY8bP41.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe"	1Vn87oI8.exe

Drops file in System32 directory 4 IoCs

Processes:

1Vn87oI8.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	1Vn87oI8.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	1Vn87oI8.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	1Vn87oI8.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	1Vn87oI8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4912 schtasks.exe
2376 schtasks.exe

pid	process
4912	schtasks.exe
2376	schtasks.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

3a50f05cf835b0751cd1bf42e4980ad9f9e3c83a3629331a0cdf1ed1240874e5.exeWY8bP41.exe1Vn87oI8.exe

description	pid	process	target process
PID 4452 wrote to memory of 4204	4452	3a50f05cf835b0751cd1bf42e4980ad9f9e3c83a3629331a0cdf1ed1240874e5.exe	WY8bP41.exe
PID 4452 wrote to memory of 4204	4452	3a50f05cf835b0751cd1bf42e4980ad9f9e3c83a3629331a0cdf1ed1240874e5.exe	WY8bP41.exe
PID 4452 wrote to memory of 4204	4452	3a50f05cf835b0751cd1bf42e4980ad9f9e3c83a3629331a0cdf1ed1240874e5.exe	WY8bP41.exe
PID 4204 wrote to memory of 1756	4204	WY8bP41.exe	1Vn87oI8.exe
PID 4204 wrote to memory of 1756	4204	WY8bP41.exe	1Vn87oI8.exe
PID 4204 wrote to memory of 1756	4204	WY8bP41.exe	1Vn87oI8.exe
PID 1756 wrote to memory of 4912	1756	1Vn87oI8.exe	schtasks.exe
PID 1756 wrote to memory of 4912	1756	1Vn87oI8.exe	schtasks.exe
PID 1756 wrote to memory of 4912	1756	1Vn87oI8.exe	schtasks.exe
PID 1756 wrote to memory of 2376	1756	1Vn87oI8.exe	schtasks.exe
PID 1756 wrote to memory of 2376	1756	1Vn87oI8.exe	schtasks.exe
PID 1756 wrote to memory of 2376	1756	1Vn87oI8.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\3a50f05cf835b0751cd1bf42e4980ad9f9e3c83a3629331a0cdf1ed1240874e5.exe
"C:\Users\Admin\AppData\Local\Temp\3a50f05cf835b0751cd1bf42e4980ad9f9e3c83a3629331a0cdf1ed1240874e5.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4452

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WY8bP41.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WY8bP41.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4204

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Vn87oI8.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Vn87oI8.exe
3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
4⤵
- Creates scheduled task(s)
PID:4912

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
4⤵
- Creates scheduled task(s)
PID:2376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:3928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4728

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WY8bP41.exe
Filesize
789KB

MD5
2b207a9c7a79b6332ffd88cf6bfc389d

SHA1
37bac6bff910644f0ec79feed7f6d11cec5dd9e6

SHA256
ef29fd8cc7c7090f622b2dcd4445a014d256be4ea4a52bec8cf72eb2699610bd

SHA512
9b2c91fa84fc18a2dfb590565a1dd11c64c5c96d9214ad866940dd781ad6edd00e021d76cb0ad457b61566b69625cc273a1a4090890fd74ccaef834bb2810a22

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Vn87oI8.exe
Filesize
1.6MB

MD5
72b49daf91cf0e3f1dc7816eda4ac30b

SHA1
c3d6bdb5a97902a99fde709c797e8ba6428ee6c4

SHA256
8b8f5d72612c9d66b5d87cf43741e9b8b84304af2a8a883b04885381776046fa

SHA512
c53711f4cc5a7d214272b9258d96b1c66c2436b2bf5fd874094c325d90ebf97c864eab7aa8600434ef97eab8f7660eec2426a2d0e29196c9b744fa77a84b12ac

Download Submit