PrivateLoader

These secondary PrivateLoaders are tasked with sending environment information back to the C2 and loading additional payloads suitable for the environment (T1588: Obtain Capabilities).

PrivateLoader was seen being distributed through SEO-optimized websites that claim to provide cracked software. Victims download a password-protected zip file (the password is in the file name) which contains an NSIS installer that executes many malicious payloads, including PrivateLoader.

Att&ck IDs: T1053 - Scheduled Task/Job

The service module takes care of persistence by creating a scheduled task

The query “ida pro crack download” was searched... Clicking on the “Download” button will download “release.rar”... Double-clicking on “setup.exe” will execute the application.

This last option is no longer available, at least through official channels, likely due to increased abuse of campaigns to mass-install PEER2PROFIT via PPI (Pay-Per-Install) botnets such as PRIVATELOADER.

Att&ck IDs: T1053 - Scheduled Task/Job

The service module takes care of persistence by creating a scheduled task

The “vRNddZqIkwaYVpHLFkGcr1Tk.exe” (process 5088) was seen modifying files in the Chrome extension folder. Browser extensions can be abused to establish persistent access to systems (T1176 – Browser Extensions).

Att&ck IDs: T1547 - Boot or Logon Autostart Execution

Att&ck IDs: T1053 - Scheduled Task/Job

The service module takes care of persistence by creating a scheduled task

This file is responsible for setting up the persistence and injecting the proxy bot in memory.

Att&ck IDs: T1547 - Boot or Logon Autostart Execution

Some samples are not being detected because they are packed and this rule will only work on unpacked samples or in memory dumps, for the more recent versions.

being hosted on websites that claim to provide cracked software

This file is responsible for setting up the persistence and injecting the proxy bot in memory.

Att&ck IDs: T1070 - Indicator Removal on Host

The script basically searches for those string decryption instruction sequences and then goes back in the code to find the XOR key... the actual encrypted string on the MOV* instructions

the malware has additional capabilities, such as disabling Windows Defender, the discovery of user-sensitive data, and many anti-analysis techniques

Att&ck IDs: T1012 - Query Registry

System checks before starting the malware symphony ... T1016: System Network Configuration Discovery

the customers of the service are able to selectively deliver malware to victims based on location, financial activity, environment, and specific software installed

the malware has additional capabilities, such as disabling Windows Defender, the discovery of user-sensitive data, and many anti-analysis techniques

Att&ck IDs: T1518 - Software Discovery

the malware has additional capabilities, such as disabling Windows Defender, the discovery of user-sensitive data, and many anti-analysis techniques

TTPs Table 3. MITRE ATT&CK TTPs for RisePro Stealer Tactic Technique Collection T1213 – Data from Information Repositories

Victims download a password-protected zip file (the password is in the file name) which contains an NSIS installer

Process 4440 is also seen communicating with its C2 server, 185[.]216.70.235 and 195.20.16[.]45 via port 80 (T1071 – Application Layer Protocol).

it will output most of the encrypted strings, more than 1500, including the current PrivateLoader C2 IP addresses at the time of writing of this blog post

These domains are simply proxies but behind them sits a massive operation performing millions of loads for various customers.

In the first stage, the loader is executed, which downloads and executes the second stage, the core module. The core module's primary purpose is to download and execute more malware, including another PrivateLoader module named service.

PrivateLoader then arranges the entry of other malware. It prepares a Base64-encoded encrypted string (T1132: Data Encoding and T1573: Encrypted Channel)

Att&ck IDs: T1571 - Non-Standard Port

PrivateLoader then arranges the entry of other malware. It prepares a Base64-encoded encrypted string (T1132: Data Encoding and T1573: Encrypted Channel)

Att&ck IDs: T1562 - Impair Defenses

the malware has additional capabilities, such as disabling Windows Defender