Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
13/02/2024, 05:58
General
-
Target
f0a25e484d3aa6d6fa1c5cb397d4b8bbb968c2ddaaf21b0a930d8edc12099925.exe
-
Size
2.3MB
-
MD5
46fb64b81ad095181093f7bebea75264
-
SHA1
5b4becf77e6eefe07178a23672019ee96a34bb95
-
SHA256
f0a25e484d3aa6d6fa1c5cb397d4b8bbb968c2ddaaf21b0a930d8edc12099925
-
SHA512
b1c56fa8cbf9b940226f74819326103aee83b0b546443cf4e8d050ecaf39fe016c8be6fc4074ccf051e0e583a702aa03b33b8be0316c1c4d3b59fa57afaef62f
-
SSDEEP
49152:fwaPhUC+YgXDZ40GPwOs7rtb1JLnFyNTDHjt5MxhlwB3AG/NYcTSDMKztcnqrQaO:fzUXhDZ49D2b7pyt7MxAlhTO5eqrQa5I
Malware Config
Extracted
risepro
193.233.132.62
Signatures
-
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0a25e484d3aa6d6fa1c5cb397d4b8bbb968c2ddaaf21b0a930d8edc12099925.exe"C:\Users\Admin\AppData\Local\Temp\f0a25e484d3aa6d6fa1c5cb397d4b8bbb968c2ddaaf21b0a930d8edc12099925.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.8MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
5.8MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB