privateloader | 78044ff8f74edccd5579136ba1d670ce4f382444735c3885ab0542dd2b77ce63

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 14:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

52fd0a92cd193f49dd929ce5ff9680fad847ee599a1bcf1b3d85bf92a28149e8.exe
Size

803KB
MD5

5aacc978e30e235a1dce9e840e39af43
SHA1

7f4e4359b1bfe0e961e0f56748349e7305c098a7
SHA256

52fd0a92cd193f49dd929ce5ff9680fad847ee599a1bcf1b3d85bf92a28149e8
SHA512

a6bdd0a1207d27e0f4d1ea6a4f5f8d2f0f991c0793149f7ce89b1474a443c3d17ac178b4142544107df42750be24d9a20a214b241a67d026e2e4c15060728d09
SSDEEP

12288:WMrsy90+EdYGF/dYrO/K3M2552xWH/XypBUBTq0wuZnB3GiNk7RaWI0cC79Yj11C:WylEbF6a/Km+/XypaxwuZnVFN6R0uhd

Score

10^/10

privateloader redline risepro taiga infostealer loader persistence stealer

Malware Config

Extracted

Family

redline

Botnet

taiga

5.42.92.51:19057

Extracted

Family

risepro

5.42.92.51

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral4/memory/1316-7-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Executes dropped EXE 2 IoCs

pid	Process
5036	11JL7015.exe
5256	12sT197.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	52fd0a92cd193f49dd929ce5ff9680fad847ee599a1bcf1b3d85bf92a28149e8.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5036 set thread context of 1316	5036	11JL7015.exe	108

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 5036	3864	52fd0a92cd193f49dd929ce5ff9680fad847ee599a1bcf1b3d85bf92a28149e8.exe	82
PID 3864 wrote to memory of 5036	3864	52fd0a92cd193f49dd929ce5ff9680fad847ee599a1bcf1b3d85bf92a28149e8.exe	82
PID 3864 wrote to memory of 5036	3864	52fd0a92cd193f49dd929ce5ff9680fad847ee599a1bcf1b3d85bf92a28149e8.exe	82
PID 5036 wrote to memory of 1316	5036	11JL7015.exe	108
PID 5036 wrote to memory of 1316	5036	11JL7015.exe	108
PID 5036 wrote to memory of 1316	5036	11JL7015.exe	108
PID 5036 wrote to memory of 1316	5036	11JL7015.exe	108
PID 5036 wrote to memory of 1316	5036	11JL7015.exe	108
PID 5036 wrote to memory of 1316	5036	11JL7015.exe	108
PID 5036 wrote to memory of 1316	5036	11JL7015.exe	108
PID 5036 wrote to memory of 1316	5036	11JL7015.exe	108
PID 3864 wrote to memory of 5256	3864	52fd0a92cd193f49dd929ce5ff9680fad847ee599a1bcf1b3d85bf92a28149e8.exe	109
PID 3864 wrote to memory of 5256	3864	52fd0a92cd193f49dd929ce5ff9680fad847ee599a1bcf1b3d85bf92a28149e8.exe	109
PID 3864 wrote to memory of 5256	3864	52fd0a92cd193f49dd929ce5ff9680fad847ee599a1bcf1b3d85bf92a28149e8.exe	109

C:\Users\Admin\AppData\Local\Temp\52fd0a92cd193f49dd929ce5ff9680fad847ee599a1bcf1b3d85bf92a28149e8.exe
"C:\Users\Admin\AppData\Local\Temp\52fd0a92cd193f49dd929ce5ff9680fad847ee599a1bcf1b3d85bf92a28149e8.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\11JL7015.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\11JL7015.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:1316
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\12sT197.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\12sT197.exe
  2⤵
  - Executes dropped EXE
  PID:5256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\11JL7015.exe

Filesize
414KB

MD5
4458a3b4ea84f6b01c1c2eb130e5dc88

SHA1
4a86f29e61226525b8a3ebe907d9b552c4fc9b3d

SHA256
215160f0b3e658359a8a74e089b70cd8fd2acf7721ccbbfdfc48aff86e8ab527

SHA512
1741ccd7a4f7c2d724ed8b786268e84a340d136aff98260df407bde52d085eb4ecf131e764fafa731781be0832d5ffd77f882f9189a0de85d77c70d99768366d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\12sT197.exe

Filesize
1.3MB

MD5
1445e15ac40600dc3c0f3213caef938e

SHA1
b6e0477e9e331d46bc2769fdacb93f768ce740ab

SHA256
df0d49f0e52e73be0552ad32b50a06ac8f3f8a523fcbe72a9750c686ead1af4b

SHA512
5802c73e29b77b93c641cd2c4a66da228e5a0f3f2e7d10082dca08afc77eeeb57e44ab03c2a84b281457f7262fd4f91d57fe759b96039ba3738e1ba99fc6afda

Download Submit
memory/1316-7-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1316-11-0x000000007408E000-0x000000007408F000-memory.dmp

Filesize
4KB

Download
memory/1316-12-0x0000000007C20000-0x00000000081C4000-memory.dmp

Filesize
5.6MB

Download
memory/1316-13-0x0000000007710000-0x00000000077A2000-memory.dmp

Filesize
584KB

Download
memory/1316-14-0x0000000002B60000-0x0000000002B6A000-memory.dmp

Filesize
40KB

Download
memory/1316-15-0x00000000087F0000-0x0000000008E08000-memory.dmp

Filesize
6.1MB

Download
memory/1316-16-0x0000000007A70000-0x0000000007B7A000-memory.dmp

Filesize
1.0MB

Download
memory/1316-17-0x00000000078F0000-0x0000000007902000-memory.dmp

Filesize
72KB

Download
memory/1316-18-0x00000000079A0000-0x00000000079DC000-memory.dmp

Filesize
240KB

Download
memory/1316-19-0x00000000079E0000-0x0000000007A2C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads