Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
-
submitted
20-03-2024 14:25
General
-
Target
a2449bc80cef9117c5afeae850fad00f671e3ddffe8c0c4f32328686dead719a.exe
-
Size
3.0MB
-
MD5
4828abd9d1245036b5193268ef6ba148
-
SHA1
0e8b3a3e2e5ea4b4714cd9fc1fa697a90ca1a164
-
SHA256
a2449bc80cef9117c5afeae850fad00f671e3ddffe8c0c4f32328686dead719a
-
SHA512
89f0a89406e5976730f02d18b04da4326beefec40061700fb83f9d3abafb8598d94bb5fb49435e4cf601797d50aac78f016c16f5bdc294397bdfcff70745b7d2
-
SSDEEP
49152:F2N+qwpn1I3BqbMmT4GH/NQ7YbOPLHBNdr5M76WOwHUQ:g+98xqbMmT4GH1wYYx5M76WvHp
Malware Config
Extracted
risepro
193.233.132.62:58709
Signatures
-
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2449bc80cef9117c5afeae850fad00f671e3ddffe8c0c4f32328686dead719a.exe"C:\Users\Admin\AppData\Local\Temp\a2449bc80cef9117c5afeae850fad00f671e3ddffe8c0c4f32328686dead719a.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB