Resubmissions
14/01/2025, 09:11
250114-k5qwmatndx29/02/2024, 21:21
240229-z7ptnsch3w23/02/2024, 03:45
240223-ea6qpsaf9t1023/02/2024, 02:03
240223-cg4htahg5x10Analysis
- max time kernel
141s - max time network
136s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
23/02/2024, 03:45
General
- Target ec291f72135b5826eae935f229e4c1bc2bc14d3671c9001452be407fc130ca3b.exe
- Size 2.2MB
- Sample240223-ea6qpsaf9t
- SHA256 ec291f72135b5826eae935f229e4c1bc2bc14d3671c9001452be407fc130ca3b
Malware Config
Extracted
-
risepro
-
193.233.132.62
Signatures
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec291f72135b5826eae935f229e4c1bc2bc14d3671c9001452be407fc130ca3b.exe"C:\Users\Admin\AppData\Local\Temp\ec291f72135b5826eae935f229e4c1bc2bc14d3671c9001452be407fc130ca3b.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2196-0-0x00000000003D0000-0x0000000000970000-memory.dmp
memory/2196-1-0x0000000077970000-0x0000000077972000-memory.dmp
memory/2196-6-0x0000000002380000-0x0000000002381000-memory.dmp
memory/2196-5-0x00000000029C0000-0x00000000029C1000-memory.dmp
memory/2196-4-0x00000000026D0000-0x00000000026D1000-memory.dmp
memory/2196-3-0x00000000024F0000-0x00000000024F1000-memory.dmp
memory/2196-2-0x00000000026C0000-0x00000000026C1000-memory.dmp
memory/2196-15-0x0000000002320000-0x0000000002322000-memory.dmp
memory/2196-14-0x0000000002AF0000-0x0000000002AF1000-memory.dmp
memory/2196-13-0x0000000002660000-0x0000000002661000-memory.dmp
memory/2196-12-0x0000000002AE0000-0x0000000002AE1000-memory.dmp
memory/2196-11-0x00000000029D0000-0x00000000029D1000-memory.dmp
memory/2196-10-0x0000000002B00000-0x0000000002B01000-memory.dmp
memory/2196-9-0x00000000026E0000-0x00000000026E1000-memory.dmp
memory/2196-8-0x0000000002970000-0x0000000002971000-memory.dmp
memory/2196-7-0x00000000003D0000-0x0000000000970000-memory.dmp
memory/2196-16-0x0000000002B10000-0x0000000002B12000-memory.dmp
memory/2196-17-0x00000000003D0000-0x0000000000970000-memory.dmp
memory/2196-18-0x00000000003D0000-0x0000000000970000-memory.dmp
memory/2196-20-0x00000000003D0000-0x0000000000970000-memory.dmp
memory/2196-19-0x00000000003D0000-0x0000000000970000-memory.dmp
memory/2196-21-0x00000000003D0000-0x0000000000970000-memory.dmp
memory/2196-22-0x00000000003D0000-0x0000000000970000-memory.dmp
memory/2196-23-0x00000000003D0000-0x0000000000970000-memory.dmp
memory/2196-24-0x00000000003D0000-0x0000000000970000-memory.dmp
memory/2196-25-0x00000000003D0000-0x0000000000970000-memory.dmp
memory/2196-26-0x00000000003D0000-0x0000000000970000-memory.dmp
memory/2196-27-0x00000000003D0000-0x0000000000970000-memory.dmp
memory/2196-28-0x00000000003D0000-0x0000000000970000-memory.dmp
memory/2196-29-0x00000000003D0000-0x0000000000970000-memory.dmp
memory/2196-30-0x00000000003D0000-0x0000000000970000-memory.dmp
memory/2196-31-0x00000000003D0000-0x0000000000970000-memory.dmp
memory/2196-32-0x00000000003D0000-0x0000000000970000-memory.dmp