privateloader | 8f1630bc8eac64cd06bd503a82b737a5f82d3a748f9021ad1d4babb30749eb84

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 14:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f31ea5f4eff3ab14ef031f762f9d4bbea7989361e08a9f023d0687a4139f8b6.exe
Size

789KB
MD5

dde6cfec08e5464e53f006d24d683eae
SHA1

d2896ad8ed43f8543837ce46325977aef906b80a
SHA256

5f31ea5f4eff3ab14ef031f762f9d4bbea7989361e08a9f023d0687a4139f8b6
SHA512

d383ea9a8769c116c3546b4d8426a5c28512a6555dfdc73ea2ec5975dd79e74303806e2b8aed8d9e89a1ea42ea2d5651eb6b70c6fa90f08f6f8debac226062f2
SSDEEP

12288:xMr2y90HN8degBdF/RIqaSVJ3zQFo/DiK+BZhzSLU2qQCNQmhZNy/xUjDKMeT:Xyi8dTBd9baS7QW7lkzSFuCyy/9pT

Score

10^/10

privateloader risepro loader persistence stealer

Malware Config

Extracted

Family

risepro

193.233.132.51

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
Drops startup file 1 IoCs

Processes:

1Pb15hQ2.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk 1Pb15hQ2.exe
Executes dropped EXE 1 IoCs

Processes:

1Pb15hQ2.exe

pid process

4176 1Pb15hQ2.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk	1Pb15hQ2.exe

pid	process
4176	1Pb15hQ2.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

1Pb15hQ2.exe5f31ea5f4eff3ab14ef031f762f9d4bbea7989361e08a9f023d0687a4139f8b6.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe"	1Pb15hQ2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5f31ea5f4eff3ab14ef031f762f9d4bbea7989361e08a9f023d0687a4139f8b6.exe

Drops file in System32 directory 4 IoCs

Processes:

1Pb15hQ2.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	1Pb15hQ2.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	1Pb15hQ2.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	1Pb15hQ2.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	1Pb15hQ2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

3940 schtasks.exe
944 schtasks.exe

pid	process
3940	schtasks.exe
944	schtasks.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

5f31ea5f4eff3ab14ef031f762f9d4bbea7989361e08a9f023d0687a4139f8b6.exe1Pb15hQ2.exe

description	pid	process	target process
PID 4452 wrote to memory of 4176	4452	5f31ea5f4eff3ab14ef031f762f9d4bbea7989361e08a9f023d0687a4139f8b6.exe	1Pb15hQ2.exe
PID 4452 wrote to memory of 4176	4452	5f31ea5f4eff3ab14ef031f762f9d4bbea7989361e08a9f023d0687a4139f8b6.exe	1Pb15hQ2.exe
PID 4452 wrote to memory of 4176	4452	5f31ea5f4eff3ab14ef031f762f9d4bbea7989361e08a9f023d0687a4139f8b6.exe	1Pb15hQ2.exe
PID 4176 wrote to memory of 3940	4176	1Pb15hQ2.exe	schtasks.exe
PID 4176 wrote to memory of 3940	4176	1Pb15hQ2.exe	schtasks.exe
PID 4176 wrote to memory of 3940	4176	1Pb15hQ2.exe	schtasks.exe
PID 4176 wrote to memory of 944	4176	1Pb15hQ2.exe	schtasks.exe
PID 4176 wrote to memory of 944	4176	1Pb15hQ2.exe	schtasks.exe
PID 4176 wrote to memory of 944	4176	1Pb15hQ2.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\5f31ea5f4eff3ab14ef031f762f9d4bbea7989361e08a9f023d0687a4139f8b6.exe
"C:\Users\Admin\AppData\Local\Temp\5f31ea5f4eff3ab14ef031f762f9d4bbea7989361e08a9f023d0687a4139f8b6.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4452

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1Pb15hQ2.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1Pb15hQ2.exe
2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4176

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
3⤵
- Creates scheduled task(s)
PID:3940

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
3⤵
- Creates scheduled task(s)
PID:944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:5084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1Pb15hQ2.exe
Filesize
1.6MB

MD5
44bc9cc3e47ae85fbab5e3b2b1930c54

SHA1
636dcc2fa05abe459a91ff85b7d65bf768b5ed95

SHA256
bd7f79cf43931c93db537e58d8ec7f423a20d1144c67daa7ef4b964e54cf4559

SHA512
ca1a59369019e35870ddfe0aedf8265e9f0a54c0f29bcea00f4615b5e038654a90301f0c37a1f66bcad99b74331a337ae199a5e2109142ede32c6e66caeea5ea

Download Submit