risepro | 5dcfac410a8ac5371ec25cbf19002209f1d52c7429ea992e2efd965ff55d4fa9

Resubmissions

23-02-2024 03:45

240223-ea6qpsaf9t 10

23-02-2024 02:03

240223-cg4htahg5x 10

Analysis

max time kernel
19s
max time network
30s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-02-2024 03:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3.exe
Size

2.2MB
MD5

b1c4be84e40e10b9ff3eb14074b402af
SHA1

c792a0dc991474d0d5feba031983f67e6efc35fd
SHA256

e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3
SHA512

32da555bb9ba29f0b7762407732b5e9a4c4d815aac8e7c4bc97c4a5dc07b6b5b26d63db605fca971c5321fde52a48b4c4fd868cf0711f055af6810f6a5302a2b
SSDEEP

49152:oipYE7O1mpoToQJQnE+R2tXBsahaBIWRbLJJZj9W8bQY5ezjYsU:IIpolJQfRmXB9oLxJTj9WNY5e4J

Score

10^/10

risepro collection discovery evasion persistence spyware stealer

Malware Config

Extracted

Family

risepro

193.233.132.62

Signatures

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3.exe
Downloads MZ/PE file

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Wine	e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3.exe
Key opened	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3.exe
Key opened	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\RageMP131 = "C:\\Users\\Admin\\AppData\\Local\\RageMP131\\RageMP131.exe"	e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 ipinfo.io
4 ipinfo.io
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3.exe

pid process

2008 e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3.exe

flow	ioc
3	ipinfo.io
4	ipinfo.io

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1264 schtasks.exe
2464 schtasks.exe

pid	process
1264	schtasks.exe
2464	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3.exe

pid	process
2008	e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3.exe
2008	e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3.exe

description	pid	process	target process
PID 2008 wrote to memory of 1264	2008	e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3.exe	schtasks.exe
PID 2008 wrote to memory of 1264	2008	e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3.exe	schtasks.exe
PID 2008 wrote to memory of 1264	2008	e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3.exe	schtasks.exe
PID 2008 wrote to memory of 1264	2008	e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3.exe	schtasks.exe
PID 2008 wrote to memory of 2464	2008	e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3.exe	schtasks.exe
PID 2008 wrote to memory of 2464	2008	e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3.exe	schtasks.exe
PID 2008 wrote to memory of 2464	2008	e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3.exe	schtasks.exe
PID 2008 wrote to memory of 2464	2008	e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3.exe	schtasks.exe

outlook_office_path 1 IoCs

Processes:

e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3.exe

outlook_win_path 1 IoCs

Processes:

e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3.exe

C:\Users\Admin\AppData\Local\Temp\e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3.exe
"C:\Users\Admin\AppData\Local\Temp\e0324f9407031cdea025049097bf0d30a80f02eeb6e04a5d1d4a21eb8d703bc3.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:2008

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
2⤵
- Creates scheduled task(s)
PID:1264

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
2⤵
- Creates scheduled task(s)
PID:2464

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab84AC.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar84BF.tmp
Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\adobeDecsHtjswRDy\information.txt
Filesize
3KB

MD5
7bb21675fbfff925b2e4dcd4bfb2f3f4

SHA1
05879e1c21595f9930c2f15d6d9a24315457b4d5

SHA256
718d50c72b326a4f86d48a5a5c6eacc0c8ca21095221892935fbcff9654601c0

SHA512
ae23cb9e4cd4e4a840132e23c9aeef11923ee4357e9e79d3ebbc671bca8f5f7b6c80c5e4f8f279ac6bcfc6c79f8f7e145e1739988820a54d8998e9af2f9b33d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\heidiDecsHtjswRDy\QdX9ITDLyCRBWeb Data
Filesize
92KB

MD5
c38ea50a9d1b652272fdae5db82c9404

SHA1
d7444179c921d090b4e5d954997087bc0004e69f

SHA256
b5e3708f123a02f980e4e8397a055b98dceecdc754bbb67872e8bf3651541742

SHA512
b91d23e89ca310a4cc9bbfc9537880e1b0c09d0ebf28fa1514258110f3fe33493f24145430093c9d1eb6ddcac8ef25ed74eb0d0c2c8c0544c1cfe2dcf206e2f5

Download Submit
memory/2008-20-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Filesize
4KB

Download
memory/2008-24-0x0000000000F80000-0x0000000000F81000-memory.dmp

Filesize
4KB

Download
memory/2008-7-0x0000000002990000-0x0000000002991000-memory.dmp

Filesize
4KB

Download
memory/2008-14-0x0000000000910000-0x0000000000912000-memory.dmp

Filesize
8KB

Download
memory/2008-13-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

Filesize
4KB

Download
memory/2008-12-0x0000000000D80000-0x0000000000D81000-memory.dmp

Filesize
4KB

Download
memory/2008-11-0x00000000029C0000-0x00000000029C1000-memory.dmp

Filesize
4KB

Download
memory/2008-10-0x00000000029B0000-0x00000000029B1000-memory.dmp

Filesize
4KB

Download
memory/2008-9-0x0000000002AE0000-0x0000000002AE1000-memory.dmp

Filesize
4KB

Download
memory/2008-8-0x0000000000F50000-0x0000000000F51000-memory.dmp

Filesize
4KB

Download
memory/2008-6-0x0000000000F90000-0x000000000153D000-memory.dmp

Filesize
5.7MB

Download
memory/2008-15-0x0000000002C00000-0x0000000002C02000-memory.dmp

Filesize
8KB

Download
memory/2008-16-0x0000000000F90000-0x000000000153D000-memory.dmp

Filesize
5.7MB

Download
memory/2008-17-0x0000000000D90000-0x0000000000D91000-memory.dmp

Filesize
4KB

Download
memory/2008-0-0x0000000000F90000-0x000000000153D000-memory.dmp

Filesize
5.7MB

Download
memory/2008-21-0x0000000000F90000-0x000000000153D000-memory.dmp

Filesize
5.7MB

Download
memory/2008-22-0x0000000002C10000-0x0000000002C11000-memory.dmp

Filesize
4KB

Download
memory/2008-2-0x0000000000F40000-0x0000000000F41000-memory.dmp

Filesize
4KB

Download
memory/2008-25-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/2008-23-0x00000000008B0000-0x00000000008B1000-memory.dmp

Filesize
4KB

Download
memory/2008-27-0x0000000000F60000-0x0000000000F61000-memory.dmp

Filesize
4KB

Download
memory/2008-28-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

Filesize
4KB

Download
memory/2008-29-0x0000000000F90000-0x000000000153D000-memory.dmp

Filesize
5.7MB

Download
memory/2008-30-0x0000000000D60000-0x0000000000D61000-memory.dmp

Filesize
4KB

Download
memory/2008-3-0x0000000000D50000-0x0000000000D51000-memory.dmp

Filesize
4KB

Download
memory/2008-4-0x00000000029A0000-0x00000000029A1000-memory.dmp

Filesize
4KB

Download
memory/2008-5-0x0000000000920000-0x0000000000921000-memory.dmp

Filesize
4KB

Download
memory/2008-100-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/2008-81-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

Filesize
4KB

Download
memory/2008-77-0x0000000000F70000-0x0000000000F71000-memory.dmp

Filesize
4KB

Download
memory/2008-1-0x0000000077100000-0x0000000077102000-memory.dmp

Filesize
8KB

Download
memory/2008-113-0x0000000002AF0000-0x0000000002AF1000-memory.dmp

Filesize
4KB

Download
memory/2008-105-0x0000000000D70000-0x0000000000D71000-memory.dmp

Filesize
4KB

Download