Analysis
- max time kernel
142s - max time network
121s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
- submitted
12/02/2024, 23:48
General
- Target SecuriteInfo.com.Trojan.Siggen26.6766.1834.3852.exe
- Size 2.3MB
- Sample240212-3teckaee4w
- SHA256 c24d184cdbdeff2bd7bd14e7bd5e3c6853570959fdd3b357696674cc589b188a
Malware Config
Extracted
-
risepro
-
193.233.132.62
Signatures
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen26.6766.1834.3852.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen26.6766.1834.3852.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2212-0-0x0000000000210000-0x00000000007D7000-memory.dmp
memory/2212-1-0x0000000077930000-0x0000000077932000-memory.dmp
memory/2212-6-0x0000000000B40000-0x0000000000B41000-memory.dmp
memory/2212-5-0x0000000002B80000-0x0000000002B81000-memory.dmp
memory/2212-4-0x0000000000E20000-0x0000000000E21000-memory.dmp
memory/2212-3-0x0000000000BB0000-0x0000000000BB1000-memory.dmp
memory/2212-2-0x0000000000E10000-0x0000000000E11000-memory.dmp
memory/2212-7-0x0000000000210000-0x00000000007D7000-memory.dmp
memory/2212-8-0x00000000027F0000-0x00000000027F1000-memory.dmp
memory/2212-14-0x0000000000A20000-0x0000000000A22000-memory.dmp
memory/2212-15-0x0000000002C10000-0x0000000002C12000-memory.dmp
memory/2212-13-0x0000000000BE0000-0x0000000000BE1000-memory.dmp
memory/2212-12-0x0000000002BA0000-0x0000000002BA1000-memory.dmp
memory/2212-11-0x0000000002B90000-0x0000000002B91000-memory.dmp
memory/2212-10-0x0000000002BB0000-0x0000000002BB1000-memory.dmp
memory/2212-9-0x0000000002660000-0x0000000002661000-memory.dmp
memory/2212-16-0x0000000000210000-0x00000000007D7000-memory.dmp
memory/2212-17-0x0000000000210000-0x00000000007D7000-memory.dmp
memory/2212-18-0x0000000000210000-0x00000000007D7000-memory.dmp
memory/2212-19-0x0000000000210000-0x00000000007D7000-memory.dmp
memory/2212-20-0x0000000000210000-0x00000000007D7000-memory.dmp
memory/2212-21-0x0000000000210000-0x00000000007D7000-memory.dmp
memory/2212-22-0x0000000000210000-0x00000000007D7000-memory.dmp
memory/2212-23-0x0000000000210000-0x00000000007D7000-memory.dmp
memory/2212-24-0x0000000000210000-0x00000000007D7000-memory.dmp
memory/2212-25-0x0000000000210000-0x00000000007D7000-memory.dmp
memory/2212-26-0x0000000000210000-0x00000000007D7000-memory.dmp
memory/2212-27-0x0000000000210000-0x00000000007D7000-memory.dmp
memory/2212-28-0x0000000000210000-0x00000000007D7000-memory.dmp
memory/2212-29-0x0000000000210000-0x00000000007D7000-memory.dmp
memory/2212-30-0x0000000000210000-0x00000000007D7000-memory.dmp
memory/2212-31-0x0000000000210000-0x00000000007D7000-memory.dmp