Analysis
- max time kernel
140s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
12/02/2024, 19:38
General
- Target SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
- Size 2.3MB
- Sample240212-yccp7ach48
- SHA256 a57a3b08bfb8aec37a412a829baf276ce0dd2782927ccc925f4509c97680ea73
Malware Config
Extracted
-
risepro
-
193.233.132.62
Signatures
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3236-0-0x0000000000C60000-0x0000000001227000-memory.dmp
memory/3236-1-0x00000000779B4000-0x00000000779B6000-memory.dmp
memory/3236-3-0x0000000004D80000-0x0000000004D81000-memory.dmp
memory/3236-2-0x0000000004DB0000-0x0000000004DB1000-memory.dmp
memory/3236-5-0x0000000004D70000-0x0000000004D71000-memory.dmp
memory/3236-4-0x0000000004DF0000-0x0000000004DF1000-memory.dmp
memory/3236-6-0x0000000000C60000-0x0000000001227000-memory.dmp
memory/3236-7-0x0000000004D60000-0x0000000004D61000-memory.dmp
memory/3236-9-0x0000000004E10000-0x0000000004E11000-memory.dmp
memory/3236-11-0x0000000004DD0000-0x0000000004DD1000-memory.dmp
memory/3236-10-0x0000000004DA0000-0x0000000004DA1000-memory.dmp
memory/3236-8-0x0000000004DC0000-0x0000000004DC1000-memory.dmp
memory/3236-13-0x0000000004D50000-0x0000000004D51000-memory.dmp
memory/3236-12-0x0000000004E00000-0x0000000004E01000-memory.dmp
memory/3236-14-0x0000000004E30000-0x0000000004E32000-memory.dmp
memory/3236-15-0x0000000000C60000-0x0000000001227000-memory.dmp
memory/3236-16-0x0000000000C60000-0x0000000001227000-memory.dmp
memory/3236-17-0x0000000000C60000-0x0000000001227000-memory.dmp
memory/3236-18-0x0000000000C60000-0x0000000001227000-memory.dmp
memory/3236-19-0x0000000000C60000-0x0000000001227000-memory.dmp
memory/3236-20-0x0000000000C60000-0x0000000001227000-memory.dmp
memory/3236-21-0x0000000000C60000-0x0000000001227000-memory.dmp
memory/3236-22-0x0000000000C60000-0x0000000001227000-memory.dmp
memory/3236-23-0x0000000000C60000-0x0000000001227000-memory.dmp
memory/3236-24-0x0000000000C60000-0x0000000001227000-memory.dmp
memory/3236-25-0x0000000000C60000-0x0000000001227000-memory.dmp
memory/3236-26-0x0000000000C60000-0x0000000001227000-memory.dmp
memory/3236-27-0x0000000000C60000-0x0000000001227000-memory.dmp
memory/3236-28-0x0000000000C60000-0x0000000001227000-memory.dmp
memory/3236-29-0x0000000000C60000-0x0000000001227000-memory.dmp
memory/3236-30-0x0000000000C60000-0x0000000001227000-memory.dmp