risepro | 5dcfac410a8ac5371ec25cbf19002209f1d52c7429ea992e2efd965ff55d4fa9

Resubmissions

23-02-2024 03:45

240223-ea6qpsaf9t 10

23-02-2024 02:03

240223-cg4htahg5x 10

Analysis

max time kernel
141s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-02-2024 03:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ec291f72135b5826eae935f229e4c1bc2bc14d3671c9001452be407fc130ca3b.exe
Size

2.2MB
MD5

879185bab33bfd8f52e1958155093bd2
SHA1

865d0dd25f9988da461328ec8eef160a31a57811
SHA256

ec291f72135b5826eae935f229e4c1bc2bc14d3671c9001452be407fc130ca3b
SHA512

010b6182ba5dd446c2a7ecfc72d97dd1257438e74923d7c96223e34c56064be392394402e848e163fb2bfb9022665f544903e7ab3819fd733b60e792b021a999
SSDEEP

49152:TsL6RlKy19ek1DOJ3aiXV1sawoef9QncLD8W7m9CNR6oOYdAojKahnLR1ybYqT:T86rK29P12L7saTMqnap7m9+dLjRhnLs

Score

10^/10

risepro evasion stealer

Malware Config

Extracted

Family

risepro

193.233.132.62

Signatures

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

ec291f72135b5826eae935f229e4c1bc2bc14d3671c9001452be407fc130ca3b.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ec291f72135b5826eae935f229e4c1bc2bc14d3671c9001452be407fc130ca3b.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ec291f72135b5826eae935f229e4c1bc2bc14d3671c9001452be407fc130ca3b.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ec291f72135b5826eae935f229e4c1bc2bc14d3671c9001452be407fc130ca3b.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ec291f72135b5826eae935f229e4c1bc2bc14d3671c9001452be407fc130ca3b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ec291f72135b5826eae935f229e4c1bc2bc14d3671c9001452be407fc130ca3b.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

ec291f72135b5826eae935f229e4c1bc2bc14d3671c9001452be407fc130ca3b.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Wine	ec291f72135b5826eae935f229e4c1bc2bc14d3671c9001452be407fc130ca3b.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

ec291f72135b5826eae935f229e4c1bc2bc14d3671c9001452be407fc130ca3b.exe

pid process

2196 ec291f72135b5826eae935f229e4c1bc2bc14d3671c9001452be407fc130ca3b.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

ec291f72135b5826eae935f229e4c1bc2bc14d3671c9001452be407fc130ca3b.exe

pid process

2196 ec291f72135b5826eae935f229e4c1bc2bc14d3671c9001452be407fc130ca3b.exe

pid	process
2196	ec291f72135b5826eae935f229e4c1bc2bc14d3671c9001452be407fc130ca3b.exe

pid	process
2196	ec291f72135b5826eae935f229e4c1bc2bc14d3671c9001452be407fc130ca3b.exe

C:\Users\Admin\AppData\Local\Temp\ec291f72135b5826eae935f229e4c1bc2bc14d3671c9001452be407fc130ca3b.exe
"C:\Users\Admin\AppData\Local\Temp\ec291f72135b5826eae935f229e4c1bc2bc14d3671c9001452be407fc130ca3b.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2196

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2196-0-0x00000000003D0000-0x0000000000970000-memory.dmp

Filesize
5.6MB

Download
memory/2196-1-0x0000000077970000-0x0000000077972000-memory.dmp

Filesize
8KB

Download
memory/2196-6-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/2196-5-0x00000000029C0000-0x00000000029C1000-memory.dmp

Filesize
4KB

Download
memory/2196-4-0x00000000026D0000-0x00000000026D1000-memory.dmp

Filesize
4KB

Download
memory/2196-3-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/2196-2-0x00000000026C0000-0x00000000026C1000-memory.dmp

Filesize
4KB

Download
memory/2196-15-0x0000000002320000-0x0000000002322000-memory.dmp

Filesize
8KB

Download
memory/2196-14-0x0000000002AF0000-0x0000000002AF1000-memory.dmp

Filesize
4KB

Download
memory/2196-13-0x0000000002660000-0x0000000002661000-memory.dmp

Filesize
4KB

Download
memory/2196-12-0x0000000002AE0000-0x0000000002AE1000-memory.dmp

Filesize
4KB

Download
memory/2196-11-0x00000000029D0000-0x00000000029D1000-memory.dmp

Filesize
4KB

Download
memory/2196-10-0x0000000002B00000-0x0000000002B01000-memory.dmp

Filesize
4KB

Download
memory/2196-9-0x00000000026E0000-0x00000000026E1000-memory.dmp

Filesize
4KB

Download
memory/2196-8-0x0000000002970000-0x0000000002971000-memory.dmp

Filesize
4KB

Download
memory/2196-7-0x00000000003D0000-0x0000000000970000-memory.dmp

Filesize
5.6MB

Download
memory/2196-16-0x0000000002B10000-0x0000000002B12000-memory.dmp

Filesize
8KB

Download
memory/2196-17-0x00000000003D0000-0x0000000000970000-memory.dmp

Filesize
5.6MB

Download
memory/2196-18-0x00000000003D0000-0x0000000000970000-memory.dmp

Filesize
5.6MB

Download
memory/2196-20-0x00000000003D0000-0x0000000000970000-memory.dmp

Filesize
5.6MB

Download
memory/2196-19-0x00000000003D0000-0x0000000000970000-memory.dmp

Filesize
5.6MB

Download
memory/2196-21-0x00000000003D0000-0x0000000000970000-memory.dmp

Filesize
5.6MB

Download
memory/2196-22-0x00000000003D0000-0x0000000000970000-memory.dmp

Filesize
5.6MB

Download
memory/2196-23-0x00000000003D0000-0x0000000000970000-memory.dmp

Filesize
5.6MB

Download
memory/2196-24-0x00000000003D0000-0x0000000000970000-memory.dmp

Filesize
5.6MB

Download
memory/2196-25-0x00000000003D0000-0x0000000000970000-memory.dmp

Filesize
5.6MB

Download
memory/2196-26-0x00000000003D0000-0x0000000000970000-memory.dmp

Filesize
5.6MB

Download
memory/2196-27-0x00000000003D0000-0x0000000000970000-memory.dmp

Filesize
5.6MB

Download
memory/2196-28-0x00000000003D0000-0x0000000000970000-memory.dmp

Filesize
5.6MB

Download
memory/2196-29-0x00000000003D0000-0x0000000000970000-memory.dmp

Filesize
5.6MB

Download
memory/2196-30-0x00000000003D0000-0x0000000000970000-memory.dmp

Filesize
5.6MB

Download
memory/2196-31-0x00000000003D0000-0x0000000000970000-memory.dmp

Filesize
5.6MB

Download
memory/2196-32-0x00000000003D0000-0x0000000000970000-memory.dmp

Filesize
5.6MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads