privateloader | be3323c3b2bd6ba736703199d528de6bf1396e8a7c6b9b58e4ca31fda43b00e0

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 08:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04079e58020489439890f3d5d0980b8ad79ac8f655923829037345651f2f1b9d.exe
Size

1.1MB
MD5

51bebc9c1c8f8395472baac3355b136e
SHA1

6b04ab59ab7bb5b6c218d5233fd1c1bc64246fb9
SHA256

04079e58020489439890f3d5d0980b8ad79ac8f655923829037345651f2f1b9d
SHA512

b32221f514e8c61901fe485494a2b6effe4b8ab072defaaa560a84fda42d4a45e7a7d82849ade3997b58da2c158e55ff7345d638c3b245f7f939ccce471e64de
SSDEEP

24576:3yhNmGHppy3h6sE+TQL09aMWUKwjfdODbGr57xrp/fn:CGGHpmh6AML39GOH2d/f

Score

10^/10

privateloader redline risepro horda infostealer loader persistence stealer

Malware Config

Extracted

Family

redline

Botnet

horda

194.49.94.152:19053

Extracted

Family

risepro

194.49.94.152

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
RedLine payload 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/2844-7-0x0000000000400000-0x000000000043C000-memory.dmp family_redline
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
Executes dropped EXE 2 IoCs

Processes:

11Zp6153.exe12Ow057.exe

pid process

4532 11Zp6153.exe
2468 12Ow057.exe

resource	yara_rule
behavioral1/memory/2844-7-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline

pid	process
4532	11Zp6153.exe
2468	12Ow057.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

04079e58020489439890f3d5d0980b8ad79ac8f655923829037345651f2f1b9d.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	04079e58020489439890f3d5d0980b8ad79ac8f655923829037345651f2f1b9d.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

11Zp6153.exe12Ow057.exe

description pid process target process

PID 4532 set thread context of 2844 4532 11Zp6153.exe AppLaunch.exe
PID 2468 set thread context of 3116 2468 12Ow057.exe AppLaunch.exe

description	pid	process	target process
PID 4532 set thread context of 2844	4532	11Zp6153.exe	AppLaunch.exe
PID 2468 set thread context of 3116	2468	12Ow057.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

04079e58020489439890f3d5d0980b8ad79ac8f655923829037345651f2f1b9d.exe11Zp6153.exe12Ow057.exe

description	pid	process	target process
PID 1468 wrote to memory of 4532	1468	04079e58020489439890f3d5d0980b8ad79ac8f655923829037345651f2f1b9d.exe	11Zp6153.exe
PID 1468 wrote to memory of 4532	1468	04079e58020489439890f3d5d0980b8ad79ac8f655923829037345651f2f1b9d.exe	11Zp6153.exe
PID 1468 wrote to memory of 4532	1468	04079e58020489439890f3d5d0980b8ad79ac8f655923829037345651f2f1b9d.exe	11Zp6153.exe
PID 4532 wrote to memory of 1192	4532	11Zp6153.exe	AppLaunch.exe
PID 4532 wrote to memory of 1192	4532	11Zp6153.exe	AppLaunch.exe
PID 4532 wrote to memory of 1192	4532	11Zp6153.exe	AppLaunch.exe
PID 4532 wrote to memory of 2844	4532	11Zp6153.exe	AppLaunch.exe
PID 4532 wrote to memory of 2844	4532	11Zp6153.exe	AppLaunch.exe
PID 4532 wrote to memory of 2844	4532	11Zp6153.exe	AppLaunch.exe
PID 4532 wrote to memory of 2844	4532	11Zp6153.exe	AppLaunch.exe
PID 4532 wrote to memory of 2844	4532	11Zp6153.exe	AppLaunch.exe
PID 4532 wrote to memory of 2844	4532	11Zp6153.exe	AppLaunch.exe
PID 4532 wrote to memory of 2844	4532	11Zp6153.exe	AppLaunch.exe
PID 4532 wrote to memory of 2844	4532	11Zp6153.exe	AppLaunch.exe
PID 1468 wrote to memory of 2468	1468	04079e58020489439890f3d5d0980b8ad79ac8f655923829037345651f2f1b9d.exe	12Ow057.exe
PID 1468 wrote to memory of 2468	1468	04079e58020489439890f3d5d0980b8ad79ac8f655923829037345651f2f1b9d.exe	12Ow057.exe
PID 1468 wrote to memory of 2468	1468	04079e58020489439890f3d5d0980b8ad79ac8f655923829037345651f2f1b9d.exe	12Ow057.exe
PID 2468 wrote to memory of 3116	2468	12Ow057.exe	AppLaunch.exe
PID 2468 wrote to memory of 3116	2468	12Ow057.exe	AppLaunch.exe
PID 2468 wrote to memory of 3116	2468	12Ow057.exe	AppLaunch.exe
PID 2468 wrote to memory of 3116	2468	12Ow057.exe	AppLaunch.exe
PID 2468 wrote to memory of 3116	2468	12Ow057.exe	AppLaunch.exe
PID 2468 wrote to memory of 3116	2468	12Ow057.exe	AppLaunch.exe
PID 2468 wrote to memory of 3116	2468	12Ow057.exe	AppLaunch.exe
PID 2468 wrote to memory of 3116	2468	12Ow057.exe	AppLaunch.exe
PID 2468 wrote to memory of 3116	2468	12Ow057.exe	AppLaunch.exe
PID 2468 wrote to memory of 3116	2468	12Ow057.exe	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\04079e58020489439890f3d5d0980b8ad79ac8f655923829037345651f2f1b9d.exe
"C:\Users\Admin\AppData\Local\Temp\04079e58020489439890f3d5d0980b8ad79ac8f655923829037345651f2f1b9d.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1468

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\11Zp6153.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\11Zp6153.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4532

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:1192

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:2844

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\12Ow057.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\12Ow057.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2468

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:3116

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\11Zp6153.exe
Filesize
1.1MB

MD5
0b64f664a3c3f9ec9ef59a3fa9346d28

SHA1
59131fc143ab8044fe7d9391edb04c9785b6898c

SHA256
b76c17d154d40e41d6b7f16808345f3b0e25530446bab98842d70e53dfc532a1

SHA512
6b6542e4ed51c4d00bf420b60f3a85f39281bb1bc3a3b5d892747092e09219cda453bcb1a7fb67fe0e89cb5f5c39d1b52b22731402293e4ec7c843250f174018

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\12Ow057.exe
Filesize
2.4MB

MD5
6a779de5eac6e9abbf795a7516de0410

SHA1
ab62a43fb649affd2ec48efb270ec72a848c01ed

SHA256
d63dd5a18df9d1ee5cb347614e625070c6a3e6c784373224fd77bbb7ae813c64

SHA512
46611e9d2574141f602e575764cf3b3ac1f6285e15230b607e17972852c3eb45d94c156b315ba04dce1bb099adee17c2c724d7b12dbf6024d2e6785f4d5cb072

Download Submit
memory/2844-16-0x00000000082C0000-0x00000000088D8000-memory.dmp

Filesize
6.1MB

Download
memory/2844-19-0x00000000074F0000-0x000000000752C000-memory.dmp

Filesize
240KB

Download
memory/2844-12-0x00000000076F0000-0x0000000007C94000-memory.dmp

Filesize
5.6MB

Download
memory/2844-13-0x0000000007240000-0x00000000072D2000-memory.dmp

Filesize
584KB

Download
memory/2844-14-0x0000000004820000-0x000000000482A000-memory.dmp

Filesize
40KB

Download
memory/2844-15-0x0000000074B00000-0x00000000752B0000-memory.dmp

Filesize
7.7MB

Download
memory/2844-7-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2844-17-0x0000000007580000-0x000000000768A000-memory.dmp

Filesize
1.0MB

Download
memory/2844-18-0x0000000007490000-0x00000000074A2000-memory.dmp

Filesize
72KB

Download
memory/2844-10-0x0000000074B0E000-0x0000000074B0F000-memory.dmp

Filesize
4KB

Download
memory/2844-20-0x0000000007530000-0x000000000757C000-memory.dmp

Filesize
304KB

Download
memory/2844-27-0x0000000074B00000-0x00000000752B0000-memory.dmp

Filesize
7.7MB

Download
memory/2844-26-0x0000000074B0E000-0x0000000074B0F000-memory.dmp

Filesize
4KB

Download
memory/3116-24-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download
memory/3116-22-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download
memory/3116-25-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download
memory/3116-21-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download