General

  • Target

    2e66ff2866f789dc6a3a8aadf7ce8c44bce8ef5b1703385554df3d720012c448

  • Size

    1.6MB

  • Sample

    231213-3y2zesbfh7

  • MD5

    6caa2fafb3daa1da81c7f1fcac3956a8

  • SHA1

    be0a4610e12455c4807604bbd41646bbc5d7cb7d

  • SHA256

    2e66ff2866f789dc6a3a8aadf7ce8c44bce8ef5b1703385554df3d720012c448

  • SHA512

    9876339d21ee82b8c34dc6fbb0cd5415f00384143d2bab79c8cbf8f8f1d962a1687e664d7f52f9262a1fc5b889747916dc4d49fa7e83354f8ad77fc52a48e3cf

  • SSDEEP

    49152:80ceOGgUYYEmluRKYoFh4kGWusbQnIyDi1E1uonTKi/OjCCNG:1XOGgUYC4RKXFhrusbaDkE1u

Malware Config

Extracted

Family

risepro

C2

193.233.132.51

Targets

    • Target

      2e66ff2866f789dc6a3a8aadf7ce8c44bce8ef5b1703385554df3d720012c448

    • Size

      1.6MB

    • MD5

      6caa2fafb3daa1da81c7f1fcac3956a8

    • SHA1

      be0a4610e12455c4807604bbd41646bbc5d7cb7d

    • SHA256

      2e66ff2866f789dc6a3a8aadf7ce8c44bce8ef5b1703385554df3d720012c448

    • SHA512

      9876339d21ee82b8c34dc6fbb0cd5415f00384143d2bab79c8cbf8f8f1d962a1687e664d7f52f9262a1fc5b889747916dc4d49fa7e83354f8ad77fc52a48e3cf

    • SSDEEP

      49152:80ceOGgUYYEmluRKYoFh4kGWusbQnIyDi1E1uonTKi/OjCCNG:1XOGgUYC4RKXFhrusbaDkE1u

    • Drops startup file

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks