Overview

overview

10

Static

static

10

9011c0326d...b5.exe

windows7-x64

10

9011c0326d...b5.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9011c0326dd65432b565d8e51cf0f550e3afb733df3974d3e362e4b7c3ffa6b5

  • Size

    749KB

  • Sample

    231129-m9vrgsfh3x

  • MD5

    d37a114611a21c551b3f64a5b38384dd

  • SHA1

    d9c65129595ea2d146455a6eb711245dd3fc1bdd

  • SHA256

    5101f0ab9213dbf8ba020e68b6f52337dd6a267315e27727c1651be34b52d2df

  • SHA512

    79e82813a0a208d252099a29041dbf28d6ca92ac91597bc2ac4bd9768b41a4cc37d21933772724e2f093ad584c1b9c527d04398179a196c8bda8a39ff5544846

  • SSDEEP

    12288:ItPFtGfY2o0E2DLHRJPRWWL03wiiZPgwuk4TUYJ4eyuz1VYwpvw4AXex0f+oRa3R:IdHGq0E0R+k03wFPgwuVTPV1Cwpv2QAO

Score
10/10
privateloaderriseproloaderpersistencestealer

Malware Config

Extracted

Family

risepro

C2

194.49.94.152

Targets

    • Target

      9011c0326dd65432b565d8e51cf0f550e3afb733df3974d3e362e4b7c3ffa6b5

    • Size

      1.5MB

    • MD5

      afd057fef80a11d832f853af9ddcfd33

    • SHA1

      d67154c652db05cf7870e5c33d8ca28ef98c04e8

    • SHA256

      9011c0326dd65432b565d8e51cf0f550e3afb733df3974d3e362e4b7c3ffa6b5

    • SHA512

      aa176ed51b00efa61e3d90b1b61869e731b8ffc94da8c176856bb72d0cb9854bcb9ddd3e48a384ae8ec01fb9f8b1a66541d2336c94ecfe5da2705c75759b51f6

    • SSDEEP

      24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WtI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTS

    Score
    10/10
    privateloaderriseproloaderpersistencestealer

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

      loaderprivateloader

    • RisePro

      RisePro stealer is an infostealer distributed by PrivateLoader.

      stealerrisepro

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks