privateloader | 78044ff8f74edccd5579136ba1d670ce4f382444735c3885ab0542dd2b77ce63

Analysis

max time kernel
148s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 14:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b093b62b3c10bec126678999d01ec29829b6cd97661fc6492cc56c7a9503c93a.exe
Size

989KB
MD5

4ce53a8b5e242c9786f4e5c93a30e998
SHA1

a4e02da66013d27c523466e8cd5fc1c01a9fe7a5
SHA256

b093b62b3c10bec126678999d01ec29829b6cd97661fc6492cc56c7a9503c93a
SHA512

f6c2ffbf3b1bd4fb783f2745c6b0e551d83ee2143a76f8d7158700ec3ada488e74a5da61d47cb5b852d9668d3b4ff45e51c102b4c43e5cdf113da1953db79192
SSDEEP

24576:OyatlDC2DSBNRzvfyb/7TJkVqbgvvLerBOHvQ2SfuBn:doENlUDVyqEvvGBOHv1G

Score

10^/10

privateloader risepro loader persistence stealer

Malware Config

Extracted

Family

risepro

194.49.94.152

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
Drops startup file 1 IoCs

Processes:

1Le64Mh4.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk 1Le64Mh4.exe
Executes dropped EXE 2 IoCs

Processes:

Ct4aX25.exe1Le64Mh4.exe

pid process

4476 Ct4aX25.exe
1356 1Le64Mh4.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk	1Le64Mh4.exe

pid	process
4476	Ct4aX25.exe
1356	1Le64Mh4.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

b093b62b3c10bec126678999d01ec29829b6cd97661fc6492cc56c7a9503c93a.exeCt4aX25.exe1Le64Mh4.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b093b62b3c10bec126678999d01ec29829b6cd97661fc6492cc56c7a9503c93a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Ct4aX25.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe"	1Le64Mh4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

3788 schtasks.exe
4604 schtasks.exe

pid	process
3788	schtasks.exe
4604	schtasks.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

b093b62b3c10bec126678999d01ec29829b6cd97661fc6492cc56c7a9503c93a.exeCt4aX25.exe1Le64Mh4.exe

description	pid	process	target process
PID 2916 wrote to memory of 4476	2916	b093b62b3c10bec126678999d01ec29829b6cd97661fc6492cc56c7a9503c93a.exe	Ct4aX25.exe
PID 2916 wrote to memory of 4476	2916	b093b62b3c10bec126678999d01ec29829b6cd97661fc6492cc56c7a9503c93a.exe	Ct4aX25.exe
PID 2916 wrote to memory of 4476	2916	b093b62b3c10bec126678999d01ec29829b6cd97661fc6492cc56c7a9503c93a.exe	Ct4aX25.exe
PID 4476 wrote to memory of 1356	4476	Ct4aX25.exe	1Le64Mh4.exe
PID 4476 wrote to memory of 1356	4476	Ct4aX25.exe	1Le64Mh4.exe
PID 4476 wrote to memory of 1356	4476	Ct4aX25.exe	1Le64Mh4.exe
PID 1356 wrote to memory of 3788	1356	1Le64Mh4.exe	schtasks.exe
PID 1356 wrote to memory of 3788	1356	1Le64Mh4.exe	schtasks.exe
PID 1356 wrote to memory of 3788	1356	1Le64Mh4.exe	schtasks.exe
PID 1356 wrote to memory of 4604	1356	1Le64Mh4.exe	schtasks.exe
PID 1356 wrote to memory of 4604	1356	1Le64Mh4.exe	schtasks.exe
PID 1356 wrote to memory of 4604	1356	1Le64Mh4.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\b093b62b3c10bec126678999d01ec29829b6cd97661fc6492cc56c7a9503c93a.exe
"C:\Users\Admin\AppData\Local\Temp\b093b62b3c10bec126678999d01ec29829b6cd97661fc6492cc56c7a9503c93a.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2916

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ct4aX25.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ct4aX25.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4476

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Le64Mh4.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Le64Mh4.exe
3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1356

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
4⤵
- Creates scheduled task(s)
PID:3788

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
4⤵
- Creates scheduled task(s)
PID:4604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3824 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
1⤵
PID:4156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ct4aX25.exe

Filesize
866KB

MD5
72f76c6644a01d1c973d33f19aa41c86

SHA1
fdb377bc5d582bc73a83aa86fd88640fb4d69674

SHA256
1893c7f2af0031bc8be39ecf03fe8c7ffc3029f2dc639596ed2a6a0395015bb6

SHA512
edffdbe765584bd6ba72fc744d9d76c105614dc329b53d6d00f6005470da0a5140560adef79474f65ee7eb8ea73eb426c65eb21230802926efb7b99887c8932f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Le64Mh4.exe

Filesize
1.5MB

MD5
aa2d5de1c8a83d297dad6af8c2a968c9

SHA1
29f8f648eb0eaaf78aec45986644edd5ef18e01b

SHA256
c82d8e029611f09bfa3816cc697122f42b0bb0effc423000bc9c52eb070abf86

SHA512
2c820eece53e39562c76ec57cd3ace8ffd27fcc80691310a895a7b4be2dd783d26a7a95e8f6c6e880df74683ef6bd7c98f840497dffaa02c14077dea38c6676e

Download Submit