Overview

overview

10

Static

static

3

02c45cef65...b8.exe

windows7-x64

10

02c45cef65...b8.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    19-02-2024 16:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    02c45cef650eedec38736b43d908ff553132f001d0a0957ab4933298d2b980b8.exe

  • Size

    3.0MB

  • MD5

    9c2580fe181e2688438957d8d5185704

  • SHA1

    e497a2b0f1266e706bee1e96ca3e398ebcaecc5d

  • SHA256

    02c45cef650eedec38736b43d908ff553132f001d0a0957ab4933298d2b980b8

  • SHA512

    2dcd091835a38ec4995d118c5173336d3ea144c4d395e35ca975df728bd4673b8314fa10b7e9a4d3ffaa2955dbd0433e8342f81180ce74855d8cefde20798408

  • SSDEEP

    49152:ENqKD4z3XZUmM6AkRgDiwoDOcImF0rhm+WWSp1sn8zuTOm+Z1EA7M3PDbNY:EQH+m4kTwoKPtFWWH8zUOfDEAIPDm

Score
10/10
riseprostealer

Malware Config

Extracted

Family

risepro

C2

193.233.132.62

Signatures

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\02c45cef650eedec38736b43d908ff553132f001d0a0957ab4933298d2b980b8.exe
    "C:\Users\Admin\AppData\Local\Temp\02c45cef650eedec38736b43d908ff553132f001d0a0957ab4933298d2b980b8.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetWindowsHookEx
    PID:1964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1964-0-0x0000000000DF0000-0x0000000001909000-memory.dmp

    Filesize

    11.1MB

    Download

  • memory/1964-2-0x0000000077BE0000-0x0000000077BE1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1964-1-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

    Filesize

    3.8MB

    Download

  • memory/1964-3-0x0000000000DF0000-0x0000000001909000-memory.dmp

    Filesize

    11.1MB

    Download

  • memory/1964-4-0x0000000000DF0000-0x0000000001909000-memory.dmp

    Filesize

    11.1MB

    Download

  • memory/1964-5-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

    Filesize

    3.8MB

    Download

  • memory/1964-6-0x0000000000DF0000-0x0000000001909000-memory.dmp

    Filesize

    11.1MB

    Download

  • memory/1964-7-0x0000000000DF0000-0x0000000001909000-memory.dmp

    Filesize

    11.1MB

    Download

  • memory/1964-8-0x0000000000DF0000-0x0000000001909000-memory.dmp

    Filesize

    11.1MB

    Download

  • memory/1964-9-0x0000000000DF0000-0x0000000001909000-memory.dmp

    Filesize

    11.1MB

    Download

  • memory/1964-10-0x0000000000DF0000-0x0000000001909000-memory.dmp

    Filesize

    11.1MB

    Download

  • memory/1964-11-0x0000000000DF0000-0x0000000001909000-memory.dmp

    Filesize

    11.1MB

    Download

  • memory/1964-12-0x0000000000DF0000-0x0000000001909000-memory.dmp

    Filesize

    11.1MB

    Download

  • memory/1964-13-0x0000000000DF0000-0x0000000001909000-memory.dmp

    Filesize

    11.1MB

    Download

  • memory/1964-14-0x0000000000DF0000-0x0000000001909000-memory.dmp

    Filesize

    11.1MB

    Download

  • memory/1964-15-0x0000000000DF0000-0x0000000001909000-memory.dmp

    Filesize

    11.1MB

    Download

  • memory/1964-16-0x0000000000DF0000-0x0000000001909000-memory.dmp

    Filesize

    11.1MB

    Download

  • memory/1964-17-0x0000000000DF0000-0x0000000001909000-memory.dmp

    Filesize

    11.1MB

    Download

  • memory/1964-18-0x0000000000DF0000-0x0000000001909000-memory.dmp

    Filesize

    11.1MB

    Download