Analysis

  • max time kernel
    146s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/11/2023, 10:55

General

  • Target

    file.exe

  • Size

    6.5MB

  • MD5

    4c6d722386fc028e9813c9434c81840e

  • SHA1

    b63b394e5bf0f832ad175186037c4a1eafedd55b

  • SHA256

    a763709cacb29bab169bea58709364f138c92fa4fa86bae2bc2524cff4637f50

  • SHA512

    730edde4aeadff0b71fb399567abbf90e89a8093489ee0fc9923a14c40fd68bac9a46b74c112e8e779f1cf1ddef96240d1cb24b484a4b187c864560f1d579936

  • SSDEEP

    196608:Qft/3UMOoqLlQL+fT3OMdzBiI5Kik1DjEBX1isu:QftP2pQ8DOMdzOxmX1iJ

Malware Config

Extracted

Family

risepro

C2

194.169.175.128

Signatures

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 27 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Drops startup file
    • Accesses Microsoft Outlook profiles
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • outlook_office_path
    • outlook_win_path
    PID:5044
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP1\OfficeTrackerNMP1.exe" /tn "OfficeTrackerNMP1 HR" /sc HOURLY /rl HIGHEST
      2⤵
      • Creates scheduled task(s)
      PID:1140
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP1\OfficeTrackerNMP1.exe" /tn "OfficeTrackerNMP1 LG" /sc ONLOGON /rl HIGHEST
      2⤵
      • Creates scheduled task(s)
      PID:4004
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /RU "Admin" /tr "C:\ProgramData\IEUpdater1\IEUpdater1.exe" /tn "IEUpdater1 HR" /sc HOURLY /rl HIGHEST
      2⤵
      • Creates scheduled task(s)
      PID:1016
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /RU "Admin" /tr "C:\ProgramData\IEUpdater1\IEUpdater1.exe" /tn "IEUpdater1 LG" /sc ONLOGON /rl HIGHEST
      2⤵
      • Creates scheduled task(s)
      PID:2592
    • C:\ProgramData\IEUpdater1\IEUpdater1.exe
      "C:\ProgramData\IEUpdater1\IEUpdater1.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:4300
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 1968
      2⤵
      • Program crash
      PID:2156
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5044 -ip 5044
    1⤵
      PID:4148

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\IEUpdater1\IEUpdater1.exe

      Filesize

      6.5MB

      MD5

      4c6d722386fc028e9813c9434c81840e

      SHA1

      b63b394e5bf0f832ad175186037c4a1eafedd55b

      SHA256

      a763709cacb29bab169bea58709364f138c92fa4fa86bae2bc2524cff4637f50

      SHA512

      730edde4aeadff0b71fb399567abbf90e89a8093489ee0fc9923a14c40fd68bac9a46b74c112e8e779f1cf1ddef96240d1cb24b484a4b187c864560f1d579936

    • C:\ProgramData\IEUpdater1\IEUpdater1.exe

      Filesize

      6.5MB

      MD5

      4c6d722386fc028e9813c9434c81840e

      SHA1

      b63b394e5bf0f832ad175186037c4a1eafedd55b

      SHA256

      a763709cacb29bab169bea58709364f138c92fa4fa86bae2bc2524cff4637f50

      SHA512

      730edde4aeadff0b71fb399567abbf90e89a8093489ee0fc9923a14c40fd68bac9a46b74c112e8e779f1cf1ddef96240d1cb24b484a4b187c864560f1d579936

    • C:\ProgramData\OfficeTrackerNMP1\OfficeTrackerNMP1.exe

      Filesize

      6.5MB

      MD5

      4c6d722386fc028e9813c9434c81840e

      SHA1

      b63b394e5bf0f832ad175186037c4a1eafedd55b

      SHA256

      a763709cacb29bab169bea58709364f138c92fa4fa86bae2bc2524cff4637f50

      SHA512

      730edde4aeadff0b71fb399567abbf90e89a8093489ee0fc9923a14c40fd68bac9a46b74c112e8e779f1cf1ddef96240d1cb24b484a4b187c864560f1d579936

    • C:\ProgramData\OfficeTrackerNMP1\OfficeTrackerNMP1.exe

      Filesize

      6.5MB

      MD5

      4c6d722386fc028e9813c9434c81840e

      SHA1

      b63b394e5bf0f832ad175186037c4a1eafedd55b

      SHA256

      a763709cacb29bab169bea58709364f138c92fa4fa86bae2bc2524cff4637f50

      SHA512

      730edde4aeadff0b71fb399567abbf90e89a8093489ee0fc9923a14c40fd68bac9a46b74c112e8e779f1cf1ddef96240d1cb24b484a4b187c864560f1d579936

    • C:\Users\Admin\AppData\Local\MaxLoonaFest1\MaxLoonaFest1.exe

      Filesize

      6.5MB

      MD5

      4c6d722386fc028e9813c9434c81840e

      SHA1

      b63b394e5bf0f832ad175186037c4a1eafedd55b

      SHA256

      a763709cacb29bab169bea58709364f138c92fa4fa86bae2bc2524cff4637f50

      SHA512

      730edde4aeadff0b71fb399567abbf90e89a8093489ee0fc9923a14c40fd68bac9a46b74c112e8e779f1cf1ddef96240d1cb24b484a4b187c864560f1d579936

    • C:\Users\Admin\AppData\Local\Temp\FANBooster1\FANBooster1.exe

      Filesize

      6.5MB

      MD5

      4c6d722386fc028e9813c9434c81840e

      SHA1

      b63b394e5bf0f832ad175186037c4a1eafedd55b

      SHA256

      a763709cacb29bab169bea58709364f138c92fa4fa86bae2bc2524cff4637f50

      SHA512

      730edde4aeadff0b71fb399567abbf90e89a8093489ee0fc9923a14c40fd68bac9a46b74c112e8e779f1cf1ddef96240d1cb24b484a4b187c864560f1d579936

    • C:\Users\Admin\AppData\Local\Temp\grandUIAKrcKttW4h1nje\information.txt

      Filesize

      3KB

      MD5

      05d260df5401598146c4d60d6744b30a

      SHA1

      76499c48ac7ed943eda964debf0d68f131a97ced

      SHA256

      c1516c51aecb903c5e3b47f4d95256b7fd2ace9214821920f4c9a3870808ce02

      SHA512

      70dff0f63c9bbfaaca76738891fa282862fc75869d07c4e73bbd54a11c425dd0aea17f30a228ddbffc2891a428626f824731c95327194fa01715f42a3f894c65

    • C:\Users\Admin\AppData\Local\Temp\rise1M9Asphalt.tmp

      Filesize

      13B

      MD5

      7db38b11ddf74374e4d3cc149b4fd801

      SHA1

      2858b0a38e7fe0ec664a92ec1cd88eb8c6ce1eac

      SHA256

      3322fc96664e59a066ab5b0d956f297221b0ca572d1f926702d5cad63750e048

      SHA512

      6bbcd476463417c2377f976d771a4b52645f3cbc8dc4dd84ed64620c1946d47d147afd72cce6cc48bc9eacaf4cadfa0343a6f2da6824b697d34be937434f49ce

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster1.lnk

      Filesize

      1KB

      MD5

      41691862134e1ebcee8fe061c9d181d0

      SHA1

      23493ee446f1aeeefb8bf357d67fd3c13697a623

      SHA256

      9d69098b35548496d53958bb762fa4a8d4fe99f6f25ee34586d6682a7bddb1af

      SHA512

      d51eb8a38adfc58ab60e5876f91a72a814df0976e0334a4cc177e3aebcbdd3114cd74b0126e2bf22c273f048778e08b5777fc466d935881d102cd8d016963463

    • memory/4300-137-0x00000000001B0000-0x00000000013E3000-memory.dmp

      Filesize

      18.2MB

    • memory/4300-138-0x00000000001B0000-0x00000000013E3000-memory.dmp

      Filesize

      18.2MB

    • memory/4300-157-0x0000000003AF0000-0x0000000003B62000-memory.dmp

      Filesize

      456KB

    • memory/4300-154-0x0000000077910000-0x0000000077A00000-memory.dmp

      Filesize

      960KB

    • memory/4300-153-0x0000000077910000-0x0000000077A00000-memory.dmp

      Filesize

      960KB

    • memory/4300-152-0x0000000077910000-0x0000000077A00000-memory.dmp

      Filesize

      960KB

    • memory/4300-151-0x00000000001B0000-0x00000000013E3000-memory.dmp

      Filesize

      18.2MB

    • memory/4300-150-0x0000000003AF0000-0x0000000003B62000-memory.dmp

      Filesize

      456KB

    • memory/4300-149-0x00000000001B0000-0x00000000013E3000-memory.dmp

      Filesize

      18.2MB

    • memory/4300-146-0x0000000003AF0000-0x0000000003B62000-memory.dmp

      Filesize

      456KB

    • memory/4300-145-0x0000000003B70000-0x0000000003B71000-memory.dmp

      Filesize

      4KB

    • memory/4300-131-0x00000000001B0000-0x00000000013E3000-memory.dmp

      Filesize

      18.2MB

    • memory/4300-136-0x00000000001B0000-0x00000000013E3000-memory.dmp

      Filesize

      18.2MB

    • memory/4300-115-0x00000000001B0000-0x00000000013E3000-memory.dmp

      Filesize

      18.2MB

    • memory/4300-116-0x00000000001B0000-0x00000000013E3000-memory.dmp

      Filesize

      18.2MB

    • memory/4300-135-0x00000000001B0000-0x00000000013E3000-memory.dmp

      Filesize

      18.2MB

    • memory/4300-123-0x0000000077910000-0x0000000077A00000-memory.dmp

      Filesize

      960KB

    • memory/4300-134-0x00000000001B0000-0x00000000013E3000-memory.dmp

      Filesize

      18.2MB

    • memory/4300-125-0x0000000077910000-0x0000000077A00000-memory.dmp

      Filesize

      960KB

    • memory/4300-133-0x0000000077910000-0x0000000077A00000-memory.dmp

      Filesize

      960KB

    • memory/4300-132-0x0000000077910000-0x0000000077A00000-memory.dmp

      Filesize

      960KB

    • memory/4300-128-0x0000000077910000-0x0000000077A00000-memory.dmp

      Filesize

      960KB

    • memory/4300-129-0x0000000077910000-0x0000000077A00000-memory.dmp

      Filesize

      960KB

    • memory/4300-130-0x0000000077910000-0x0000000077A00000-memory.dmp

      Filesize

      960KB

    • memory/5044-114-0x0000000077910000-0x0000000077A00000-memory.dmp

      Filesize

      960KB

    • memory/5044-127-0x0000000077910000-0x0000000077A00000-memory.dmp

      Filesize

      960KB

    • memory/5044-126-0x0000000000EF0000-0x0000000002123000-memory.dmp

      Filesize

      18.2MB

    • memory/5044-124-0x0000000077910000-0x0000000077A00000-memory.dmp

      Filesize

      960KB

    • memory/5044-122-0x0000000077910000-0x0000000077A00000-memory.dmp

      Filesize

      960KB

    • memory/5044-15-0x0000000000EF0000-0x0000000002123000-memory.dmp

      Filesize

      18.2MB

    • memory/5044-0-0x0000000000EF0000-0x0000000002123000-memory.dmp

      Filesize

      18.2MB

    • memory/5044-11-0x0000000077910000-0x0000000077A00000-memory.dmp

      Filesize

      960KB

    • memory/5044-10-0x0000000077910000-0x0000000077A00000-memory.dmp

      Filesize

      960KB

    • memory/5044-9-0x0000000077910000-0x0000000077A00000-memory.dmp

      Filesize

      960KB

    • memory/5044-8-0x0000000077910000-0x0000000077A00000-memory.dmp

      Filesize

      960KB

    • memory/5044-7-0x0000000077910000-0x0000000077A00000-memory.dmp

      Filesize

      960KB

    • memory/5044-1-0x0000000000EF0000-0x0000000002123000-memory.dmp

      Filesize

      18.2MB

    • memory/5044-113-0x0000000077910000-0x0000000077A00000-memory.dmp

      Filesize

      960KB

    • memory/5044-12-0x0000000077EB4000-0x0000000077EB6000-memory.dmp

      Filesize

      8KB

    • memory/5044-98-0x0000000000EF0000-0x0000000002123000-memory.dmp

      Filesize

      18.2MB

    • memory/5044-13-0x0000000000EF0000-0x0000000002123000-memory.dmp

      Filesize

      18.2MB

    • memory/5044-26-0x0000000000EF0000-0x0000000002123000-memory.dmp

      Filesize

      18.2MB

    • memory/5044-25-0x0000000000EF0000-0x0000000002123000-memory.dmp

      Filesize

      18.2MB

    • memory/5044-14-0x0000000000EF0000-0x0000000002123000-memory.dmp

      Filesize

      18.2MB

    • memory/5044-17-0x0000000000EF0000-0x0000000002123000-memory.dmp

      Filesize

      18.2MB

    • memory/5044-16-0x0000000000EF0000-0x0000000002123000-memory.dmp

      Filesize

      18.2MB