Analysis
-
max time kernel
292s -
max time network
297s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
-
submitted
07/03/2024, 05:00
General
-
Target
ad8d7b0d8ccbf9adc53ad8c32dd9ed63d4bc6989deebbf480afb7e0c0530f8c0.exe
-
Size
2.3MB
-
MD5
bb289d26e56c273b170e9002388776c1
-
SHA1
4a00b3a463bdb8411a27109c5d56ea669c39b8ed
-
SHA256
ad8d7b0d8ccbf9adc53ad8c32dd9ed63d4bc6989deebbf480afb7e0c0530f8c0
-
SHA512
a119d66a8ff511594d8a1ea95ddcf3dd510a403956178b0ab084cb8bba761cf94ab8505bd8b15918d71cafd716d33ebd04f342cf14d2845088ab802ceaafe8c3
-
SSDEEP
49152:Y4fgpqzShJtLNOtQYuxPgEeCQXkpS2xmdVfxOAi61vS0C:n2hNdL7QXiuFxdK
Malware Config
Extracted
risepro
193.233.132.62:50500
Signatures
-
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad8d7b0d8ccbf9adc53ad8c32dd9ed63d4bc6989deebbf480afb7e0c0530f8c0.exe"C:\Users\Admin\AppData\Local\Temp\ad8d7b0d8ccbf9adc53ad8c32dd9ed63d4bc6989deebbf480afb7e0c0530f8c0.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
5.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
5.8MB