Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/03/2024, 01:57

General

  • Target

    4f7561f046077c4ef12cfc0f9de2f061.exe

  • Size

    6.0MB

  • MD5

    4f7561f046077c4ef12cfc0f9de2f061

  • SHA1

    0c23ecc53a16ac37eee02cd4068e7703bf7a701a

  • SHA256

    1de47025421234e0d8b32ea3f565f013ba7c48f3039e60c52615c1491f708e96

  • SHA512

    f15dfab51317e7ec5d37fd20db9845a4875659ab6037b0b178f89cb2ab197edd5ad5261e2a3e94eab9090749cf83faee476859ee56d07c1ab60d1afb7ac04ede

  • SSDEEP

    98304:0G7YAdjJI7iMD00WfN/lAg7Ih3ShjxFdohx1VA+L7b91338JuABzk:r7d1ApWfvPS3e/qlP38lBA

Score
10/10

Malware Config

Extracted

Family

risepro

C2

147.45.47.116:50500

Signatures

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4f7561f046077c4ef12cfc0f9de2f061.exe
    "C:\Users\Admin\AppData\Local\Temp\4f7561f046077c4ef12cfc0f9de2f061.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:2120

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2120-1-0x0000000000B30000-0x0000000001622000-memory.dmp

    Filesize

    10.9MB

  • memory/2120-0-0x0000000001740000-0x0000000001741000-memory.dmp

    Filesize

    4KB

  • memory/2120-2-0x0000000001750000-0x0000000001751000-memory.dmp

    Filesize

    4KB

  • memory/2120-3-0x00000000018B0000-0x00000000018B1000-memory.dmp

    Filesize

    4KB

  • memory/2120-5-0x00000000018C0000-0x00000000018C1000-memory.dmp

    Filesize

    4KB

  • memory/2120-6-0x00000000018D0000-0x00000000018D1000-memory.dmp

    Filesize

    4KB

  • memory/2120-4-0x0000000000B30000-0x0000000001622000-memory.dmp

    Filesize

    10.9MB

  • memory/2120-8-0x00000000018F0000-0x00000000018F1000-memory.dmp

    Filesize

    4KB

  • memory/2120-7-0x00000000018E0000-0x00000000018E1000-memory.dmp

    Filesize

    4KB

  • memory/2120-10-0x0000000001910000-0x0000000001911000-memory.dmp

    Filesize

    4KB

  • memory/2120-11-0x0000000001920000-0x0000000001921000-memory.dmp

    Filesize

    4KB

  • memory/2120-9-0x0000000001900000-0x0000000001901000-memory.dmp

    Filesize

    4KB

  • memory/2120-13-0x0000000001940000-0x0000000001941000-memory.dmp

    Filesize

    4KB

  • memory/2120-12-0x0000000001930000-0x0000000001931000-memory.dmp

    Filesize

    4KB

  • memory/2120-17-0x0000000003420000-0x0000000003421000-memory.dmp

    Filesize

    4KB

  • memory/2120-16-0x0000000003410000-0x0000000003411000-memory.dmp

    Filesize

    4KB

  • memory/2120-15-0x0000000003400000-0x0000000003401000-memory.dmp

    Filesize

    4KB

  • memory/2120-18-0x0000000003430000-0x0000000003431000-memory.dmp

    Filesize

    4KB

  • memory/2120-20-0x0000000003450000-0x0000000003451000-memory.dmp

    Filesize

    4KB

  • memory/2120-24-0x00000000034A0000-0x00000000034A1000-memory.dmp

    Filesize

    4KB

  • memory/2120-25-0x00000000034B0000-0x00000000034B1000-memory.dmp

    Filesize

    4KB

  • memory/2120-26-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/2120-27-0x00000000034D0000-0x00000000034D1000-memory.dmp

    Filesize

    4KB

  • memory/2120-23-0x0000000003490000-0x0000000003491000-memory.dmp

    Filesize

    4KB

  • memory/2120-22-0x0000000003480000-0x0000000003481000-memory.dmp

    Filesize

    4KB

  • memory/2120-21-0x0000000003470000-0x0000000003471000-memory.dmp

    Filesize

    4KB

  • memory/2120-19-0x0000000003440000-0x0000000003441000-memory.dmp

    Filesize

    4KB

  • memory/2120-14-0x0000000001950000-0x0000000001951000-memory.dmp

    Filesize

    4KB

  • memory/2120-31-0x0000000000B30000-0x0000000001622000-memory.dmp

    Filesize

    10.9MB