privateloader | 16914ad8762def9dc356d2ba9c481c875c3dab7bcf4706a9d418e57b6eca3ae1

General

Target

695c1108e4cf5772d8665466a95bfb60N.exe
Size

1.6MB
MD5

695c1108e4cf5772d8665466a95bfb60
SHA1

4c8e91f9e899f56829d9d602404f49584a2c2804
SHA256

16914ad8762def9dc356d2ba9c481c875c3dab7bcf4706a9d418e57b6eca3ae1
SHA512

a70fa909c8c8f8d1606716e8fd6d8f9c873d76c01eb3b31ea81c072671f0080087b7694602f3b20448c4340d3c8a94ae5ed8f5191d3fbec27f63e0e8c5a35eda
SSDEEP

49152:qWg8wUmZOzqiavjDUJO/WH89ctcO0ljbbQnIQGotBKq48TJCHEGU42sn6:ZiUmZOzqiavjDUM/WH89y8bboGO

Score

10^/10

privateloader risepro discovery loader persistence stealer

Malware Config

Extracted

Family

risepro

C2

193.233.132.51

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Drops startup file 1 IoCs

Processes:

695c1108e4cf5772d8665466a95bfb60N.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk	695c1108e4cf5772d8665466a95bfb60N.exe

Loads dropped DLL 1 IoCs

Processes:

695c1108e4cf5772d8665466a95bfb60N.exe

pid process

2864 695c1108e4cf5772d8665466a95bfb60N.exe

pid	process
2864	695c1108e4cf5772d8665466a95bfb60N.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

695c1108e4cf5772d8665466a95bfb60N.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe"	695c1108e4cf5772d8665466a95bfb60N.exe

Drops file in System32 directory 4 IoCs

Processes:

695c1108e4cf5772d8665466a95bfb60N.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	695c1108e4cf5772d8665466a95bfb60N.exe
File opened for modification	C:\Windows\System32\GroupPolicy	695c1108e4cf5772d8665466a95bfb60N.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	695c1108e4cf5772d8665466a95bfb60N.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	695c1108e4cf5772d8665466a95bfb60N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

695c1108e4cf5772d8665466a95bfb60N.exeschtasks.exeschtasks.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	695c1108e4cf5772d8665466a95bfb60N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

2820 schtasks.exe
2812 schtasks.exe

pid	process
2820	schtasks.exe
2812	schtasks.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

695c1108e4cf5772d8665466a95bfb60N.exe

description	pid	process	target process
PID 2864 wrote to memory of 2820	2864	695c1108e4cf5772d8665466a95bfb60N.exe	schtasks.exe
PID 2864 wrote to memory of 2820	2864	695c1108e4cf5772d8665466a95bfb60N.exe	schtasks.exe
PID 2864 wrote to memory of 2820	2864	695c1108e4cf5772d8665466a95bfb60N.exe	schtasks.exe
PID 2864 wrote to memory of 2820	2864	695c1108e4cf5772d8665466a95bfb60N.exe	schtasks.exe
PID 2864 wrote to memory of 2812	2864	695c1108e4cf5772d8665466a95bfb60N.exe	schtasks.exe
PID 2864 wrote to memory of 2812	2864	695c1108e4cf5772d8665466a95bfb60N.exe	schtasks.exe
PID 2864 wrote to memory of 2812	2864	695c1108e4cf5772d8665466a95bfb60N.exe	schtasks.exe
PID 2864 wrote to memory of 2812	2864	695c1108e4cf5772d8665466a95bfb60N.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\695c1108e4cf5772d8665466a95bfb60N.exe
"C:\Users\Admin\AppData\Local\Temp\695c1108e4cf5772d8665466a95bfb60N.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2820
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\FANBooster131\FANBooster131.exe

Filesize
1.6MB

MD5
695c1108e4cf5772d8665466a95bfb60

SHA1
4c8e91f9e899f56829d9d602404f49584a2c2804

SHA256
16914ad8762def9dc356d2ba9c481c875c3dab7bcf4706a9d418e57b6eca3ae1

SHA512
a70fa909c8c8f8d1606716e8fd6d8f9c873d76c01eb3b31ea81c072671f0080087b7694602f3b20448c4340d3c8a94ae5ed8f5191d3fbec27f63e0e8c5a35eda

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads