Analysis

  • max time kernel
    129s
  • max time network
    144s
  • platform
    windows10-1703_x64
  • resource
    win10-20231023-en
  • resource tags

    arch:x64arch:x86image:win10-20231023-enlocale:en-usos:windows10-1703-x64system
  • submitted
    27/11/2023, 07:07

General

  • Target

    21d13e8a77f57deedcd17b396f9f7f126cf5ea3b1b471ee7eaf967d88669073f.exe

  • Size

    1.7MB

  • MD5

    1a892ba96a906182bdea3b5bd458e3fe

  • SHA1

    240981cfbaad71ac428d8b4d63316f919bb5f178

  • SHA256

    21d13e8a77f57deedcd17b396f9f7f126cf5ea3b1b471ee7eaf967d88669073f

  • SHA512

    ad1953e4d64d69ffabce499e11b48e8bebf8dac34ff6862bd57f3847c302a147876884d8bdd2057f073cbd322a13c97d09f9f47a455fe72beb6883a599a8093c

  • SSDEEP

    24576:ly6jqX3ywZY1MUKIDSc5xzOzqmkHqQxgNZHzRW0z+H04H6cDogLU8lAF29J+1Dhq:A8YS199x5FJKQWNZNW0q0UFH0MH+d

Malware Config

Extracted

Family

risepro

C2

194.49.94.152

Signatures

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\21d13e8a77f57deedcd17b396f9f7f126cf5ea3b1b471ee7eaf967d88669073f.exe
    "C:\Users\Admin\AppData\Local\Temp\21d13e8a77f57deedcd17b396f9f7f126cf5ea3b1b471ee7eaf967d88669073f.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1248
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eG5jn38.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eG5jn38.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1756
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KO7hn89.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KO7hn89.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4556
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Px0Fa32.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Px0Fa32.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2488
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hP76Jy1.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hP76Jy1.exe
            5⤵
            • Drops startup file
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:192
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
              6⤵
              • Creates scheduled task(s)
              PID:1412
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
              6⤵
              • Creates scheduled task(s)
              PID:5000

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\FANBooster131\FANBooster131.exe

    Filesize

    1.5MB

    MD5

    0f2eaa1790c228125d3f497446459d2a

    SHA1

    94feef00ec2df292db4f9a6022fc8e3cec9f0ffc

    SHA256

    b93cdd504e8fb463279c11ccd423044e29867a47c51cb814860ac4e595f9b403

    SHA512

    71f29a222a5f1121589d06173a9f29ba4c9faa3a55914e6c4cac896fedfdcb694e994d7405469f909f3442a134faefaa30e9b26815a9a40c67434b3983fb3ade

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eG5jn38.exe

    Filesize

    1.5MB

    MD5

    f0cf726155cb320911c52b4d610a7097

    SHA1

    f9ad365bc3955d704a589ffd7ca5c6eaa2abe8fa

    SHA256

    de2021537520312a49bd215f7e1fe9abac2f2a80e83b3711f5006b62535870cc

    SHA512

    aada06b957c6c1894e1a89a073626471997164ea1480951935598c50f53bbeab2f6685a18ca3d32c6a06a6aa38ede69e5673c4a78bd2bec2f8c838ed9015dcbe

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eG5jn38.exe

    Filesize

    1.5MB

    MD5

    f0cf726155cb320911c52b4d610a7097

    SHA1

    f9ad365bc3955d704a589ffd7ca5c6eaa2abe8fa

    SHA256

    de2021537520312a49bd215f7e1fe9abac2f2a80e83b3711f5006b62535870cc

    SHA512

    aada06b957c6c1894e1a89a073626471997164ea1480951935598c50f53bbeab2f6685a18ca3d32c6a06a6aa38ede69e5673c4a78bd2bec2f8c838ed9015dcbe

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KO7hn89.exe

    Filesize

    1011KB

    MD5

    518654f534e667a7a0e3983bc990a8ef

    SHA1

    a897748fc0835b5be49608bae49dc8066bcfd479

    SHA256

    efa7e0499d7174b8c846c36c85c3e7a35c62ab8325ef0fa000012530cf0caa98

    SHA512

    b43b3cd3294fff4e47086e196873edd8b9c1a8beb28cc01ac5c578edc5c7182d8370d6bed9e9c03e82e444c32f1075d06fddbaeef6fa3da48f890d20d07c69dc

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KO7hn89.exe

    Filesize

    1011KB

    MD5

    518654f534e667a7a0e3983bc990a8ef

    SHA1

    a897748fc0835b5be49608bae49dc8066bcfd479

    SHA256

    efa7e0499d7174b8c846c36c85c3e7a35c62ab8325ef0fa000012530cf0caa98

    SHA512

    b43b3cd3294fff4e47086e196873edd8b9c1a8beb28cc01ac5c578edc5c7182d8370d6bed9e9c03e82e444c32f1075d06fddbaeef6fa3da48f890d20d07c69dc

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Px0Fa32.exe

    Filesize

    888KB

    MD5

    3e602b5c6aaf2430520ea460c2042491

    SHA1

    ce8955dcbc8aecb71d9b5ce49adcda29157a3b65

    SHA256

    b2ea25878f08652bbac82ae248902c2084c3c677d6ea45e2d36be1f72243d365

    SHA512

    a8525e0861a84a1832daf14ec3c8cae83706938bc19ce2494283df5cd72a640c14194dfa507d9bde77bde2819571a03116aa746cd8fa232afa5f170570508e38

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Px0Fa32.exe

    Filesize

    888KB

    MD5

    3e602b5c6aaf2430520ea460c2042491

    SHA1

    ce8955dcbc8aecb71d9b5ce49adcda29157a3b65

    SHA256

    b2ea25878f08652bbac82ae248902c2084c3c677d6ea45e2d36be1f72243d365

    SHA512

    a8525e0861a84a1832daf14ec3c8cae83706938bc19ce2494283df5cd72a640c14194dfa507d9bde77bde2819571a03116aa746cd8fa232afa5f170570508e38

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hP76Jy1.exe

    Filesize

    1.5MB

    MD5

    0f2eaa1790c228125d3f497446459d2a

    SHA1

    94feef00ec2df292db4f9a6022fc8e3cec9f0ffc

    SHA256

    b93cdd504e8fb463279c11ccd423044e29867a47c51cb814860ac4e595f9b403

    SHA512

    71f29a222a5f1121589d06173a9f29ba4c9faa3a55914e6c4cac896fedfdcb694e994d7405469f909f3442a134faefaa30e9b26815a9a40c67434b3983fb3ade

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hP76Jy1.exe

    Filesize

    1.5MB

    MD5

    0f2eaa1790c228125d3f497446459d2a

    SHA1

    94feef00ec2df292db4f9a6022fc8e3cec9f0ffc

    SHA256

    b93cdd504e8fb463279c11ccd423044e29867a47c51cb814860ac4e595f9b403

    SHA512

    71f29a222a5f1121589d06173a9f29ba4c9faa3a55914e6c4cac896fedfdcb694e994d7405469f909f3442a134faefaa30e9b26815a9a40c67434b3983fb3ade