Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
20/03/2024, 18:42
General
- Target a01dc9c2e2a8ffee43e52e2b810fcca6.exe
- Size 2.0MB
- Sample240320-xcbbpaff89
- SHA256 d80aa8ab0acc3f3900ad6df828fe2ca693a7b09c72b5c77d949bb237a42aef8e
Malware Config
Extracted
-
risepro
-
193.233.132.74:58709
Signatures
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a01dc9c2e2a8ffee43e52e2b810fcca6.exe"C:\Users\Admin\AppData\Local\Temp\a01dc9c2e2a8ffee43e52e2b810fcca6.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4508-0-0x00000000001E0000-0x00000000006FD000-memory.dmp
memory/4508-1-0x00000000001E0000-0x00000000006FD000-memory.dmp
memory/4508-2-0x00000000001E0000-0x00000000006FD000-memory.dmp
memory/4508-3-0x00000000001E0000-0x00000000006FD000-memory.dmp
memory/4508-4-0x00000000001E0000-0x00000000006FD000-memory.dmp
memory/4508-5-0x00000000001E0000-0x00000000006FD000-memory.dmp
memory/4508-6-0x00000000001E0000-0x00000000006FD000-memory.dmp
memory/4508-7-0x00000000001E0000-0x00000000006FD000-memory.dmp
memory/4508-8-0x00000000001E0000-0x00000000006FD000-memory.dmp
memory/4508-9-0x00000000001E0000-0x00000000006FD000-memory.dmp
memory/4508-10-0x00000000001E0000-0x00000000006FD000-memory.dmp
memory/4508-11-0x00000000001E0000-0x00000000006FD000-memory.dmp
memory/4508-12-0x00000000001E0000-0x00000000006FD000-memory.dmp
memory/4508-13-0x00000000001E0000-0x00000000006FD000-memory.dmp
memory/4508-14-0x00000000001E0000-0x00000000006FD000-memory.dmp