Analysis

  • max time kernel
    125s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    26-03-2024 21:36

General

  • Target

    Installer (2).exe

  • Size

    166.8MB

  • MD5

    dc2cfdace871eb8499e326f155b01d63

  • SHA1

    3eb3fb28d2fed92c45f32d3e24d347bc32dd456f

  • SHA256

    2e1a346d13ae17dff86d8b824ec3b78e097827f67322c0c6175670db8c41303e

  • SHA512

    b49fddcd033e953abbefa4ade4c69f6b96836cdfd70d197d5fbf9341cfa079c3b54dd50130bc697203d0e19124e35c13f33ac8a8adf111ce2143b1b48380c8cb

  • SSDEEP

    1572864:4BRO09akMhGIrAVqO9uP2WP2QW4Ev7K2hPt:4XO0bIrahB2Ev7K2hPt

Malware Config

Signatures

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 6 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Installer (2).exe
    "C:\Users\Admin\AppData\Local\Temp\Installer (2).exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:352
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath 'C:/Program Files/microsoftgame'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2416
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath 'C:/Program Files/microsoftgame'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1624
    • C:\Program Files\microsoftgame\connection1503.exe
      "C:\Program Files\microsoftgame\connection1503.exe"
      2⤵
      • Executes dropped EXE
      PID:2012
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath 'C:/Program Files/microsoftgame'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2804
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath 'C:/Program Files/microsoftgame'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2920
    • C:\Program Files\microsoftgame\update1503.exe
      "C:\Program Files\microsoftgame\update1503.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2584
      • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
        C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
        3⤵
        • Accesses Microsoft Outlook profiles
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • outlook_office_path
        • outlook_win_path
        PID:2696

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\microsoftgame\connection1503.exe

    Filesize

    23.3MB

    MD5

    0d12580a46ba44883c4dbcd83700cfa0

    SHA1

    760e448b1a568e262c681f463bebef781e2152b2

    SHA256

    a32260f5dd057b844e6e96d19162809e9e774cddc6482c51692d63a4edf638a8

    SHA512

    8c1cb27343848ac43fc13c46aea51c935b061a4b6629d1b6e67de20768a511431e376dcf21afdd7e0e06b3cf81aed62bc1264a095c7540a61638f04a51cb762d

  • C:\Users\Admin\AppData\Local\Temp\heidiOd013eCyxrFc\ZsZGuVn2ZSQ3Web Data

    Filesize

    92KB

    MD5

    d5ee43d2a25c2370159327c951da3f57

    SHA1

    11b76c32e3a08381101d597187e3c96788659025

    SHA256

    c66200d56aced972e2dd7d63f73c12d0e7f575827ea54f83ac66a37f832234ed

    SHA512

    8108a4bcde1fed31b7ae863510e4705ad74c934a53e42dbd51cad8701c4a272af939e38076904dc7941dcbfd57aa60152798250af34696c196171a465fb5a1dd

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

    Filesize

    7KB

    MD5

    cf71fb61d254bfaf28c6faa47ad7ca10

    SHA1

    93c7f0400f264b832316cf80591a2e7cce097db4

    SHA256

    f546fab7b602b0d81a0a102473cfe8df95b1c29cb122528f431b4994bd07306c

    SHA512

    12099971b207e2909b686071c3df4aebb2493ca26ddbef47165f14e593233c1af8008faf97f25fc3faa629f81fb7c1eaeb9fb32ef4ef26cbab4ee8e6fd5a7824

  • \??\PIPE\srvsvc

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • \Program Files\microsoftgame\connection1503.exe

    Filesize

    19.2MB

    MD5

    b4591bf01f419304ecfe8a2fe4a41511

    SHA1

    236f9da6160be2b3c9989e1ffb799c8a13a8face

    SHA256

    e30d09eedabcd45d9f83371c8f97987ff47b85440240754e6a26415a3e4b0b35

    SHA512

    4b1e7ec134fb17836f439466d4115ed275219058db94b3df0efb631d983cc331b27b45cd5bb85988d9a351d57cd05a6364a9ed1db0e0f40c181e423ddc562139

  • \Program Files\microsoftgame\update1503.exe

    Filesize

    12.4MB

    MD5

    1c1b225141144a7f5d8471014d922df5

    SHA1

    85d73110c2ecbde1c06ae4adf11ab47335babc2e

    SHA256

    9e12431b004e595078703b10fe7e69f8d47243e3cde9bec1caa1ed384aa0ae79

    SHA512

    3a9d4816ffd298adec4fe786f18ec8a72301f61ebd89c4b561b6b8ef8ffb4e7efbcdcd6049c184b76596491e3248e49ce31fe95961268f911116c04f9041338c

  • \Users\Admin\AppData\Local\Temp\.net\Installer (2)\a8aMwpSmSRiydchTZFml8SDbGi80c5Y=\D3DCompiler_47_cor3.dll

    Filesize

    4.7MB

    MD5

    a7b7470c347f84365ffe1b2072b4f95c

    SHA1

    57a96f6fb326ba65b7f7016242132b3f9464c7a3

    SHA256

    af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a

    SHA512

    83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d

  • \Users\Admin\AppData\Local\Temp\.net\Installer (2)\a8aMwpSmSRiydchTZFml8SDbGi80c5Y=\PresentationNative_cor3.dll

    Filesize

    1.2MB

    MD5

    0c147149b444748dae0a04e2e3d3269a

    SHA1

    f7edbcd6d1d6b199b6c997d6b781a794d736d3ff

    SHA256

    e284235a4d6e5d905692351cdfe8bc42ed842df8e5a8eb42fde90d1c3e2e90fa

    SHA512

    ec057829c03623cabc5a42ddebec9b75107f987eaf9cb642f3f1aed4d4c64c544f60a1dc7bc4208e025bce38c72091e615ac2fd9f1bd27651d49addcb0ae8b36

  • \Users\Admin\AppData\Local\Temp\.net\Installer (2)\a8aMwpSmSRiydchTZFml8SDbGi80c5Y=\wpfgfx_cor3.dll

    Filesize

    1.9MB

    MD5

    2ca3138aeb800aefe337d433f1590213

    SHA1

    0bbbd04df098d88daac40f7eac8740c6b26607ee

    SHA256

    053eee8408b8979a6cea211a5ee11a3f22b0090f8e6988013a79523aa25439cb

    SHA512

    61151f56a403b327e3ac24fd34dc22baf5049cf3d97a5bca71aa0aa7d0c1f15fb0c6c4230b849ac2763a7f1a1d34c989f71c3201938833947934d46c34e801fe

  • memory/352-67-0x0000000004970000-0x0000000004980000-memory.dmp

    Filesize

    64KB

  • memory/352-35-0x0000000002120000-0x0000000002140000-memory.dmp

    Filesize

    128KB

  • memory/352-43-0x0000000003010000-0x0000000003030000-memory.dmp

    Filesize

    128KB

  • memory/352-51-0x00000000045C0000-0x0000000004910000-memory.dmp

    Filesize

    3.3MB

  • memory/352-55-0x0000000003080000-0x00000000030D0000-memory.dmp

    Filesize

    320KB

  • memory/352-59-0x0000000003150000-0x0000000003160000-memory.dmp

    Filesize

    64KB

  • memory/352-63-0x0000000003180000-0x0000000003190000-memory.dmp

    Filesize

    64KB

  • memory/352-47-0x0000000003060000-0x0000000003080000-memory.dmp

    Filesize

    128KB

  • memory/352-39-0x0000000002140000-0x0000000002150000-memory.dmp

    Filesize

    64KB

  • memory/352-14-0x0000000001CB0000-0x0000000001CE0000-memory.dmp

    Filesize

    192KB

  • memory/352-31-0x0000000002570000-0x0000000002600000-memory.dmp

    Filesize

    576KB

  • memory/352-179-0x0000000005BC0000-0x0000000005BCA000-memory.dmp

    Filesize

    40KB

  • memory/352-181-0x0000000005BC0000-0x0000000005BCA000-memory.dmp

    Filesize

    40KB

  • memory/352-27-0x00000000004A0000-0x00000000004B0000-memory.dmp

    Filesize

    64KB

  • memory/352-23-0x0000000002010000-0x0000000002120000-memory.dmp

    Filesize

    1.1MB

  • memory/352-275-0x000000013F9D0000-0x00000001402FC000-memory.dmp

    Filesize

    9.2MB

  • memory/352-19-0x00000000038F0000-0x0000000003EB0000-memory.dmp

    Filesize

    5.8MB

  • memory/352-17-0x000000013F9D0000-0x00000001402FC000-memory.dmp

    Filesize

    9.2MB

  • memory/352-5-0x0000000002BF0000-0x0000000003010000-memory.dmp

    Filesize

    4.1MB

  • memory/352-9-0x000000000C3B0000-0x0000000011530000-memory.dmp

    Filesize

    81.5MB

  • memory/1624-272-0x000007FEF4750000-0x000007FEF50ED000-memory.dmp

    Filesize

    9.6MB

  • memory/1624-270-0x00000000029B0000-0x0000000002A30000-memory.dmp

    Filesize

    512KB

  • memory/1624-269-0x00000000029B4000-0x00000000029B7000-memory.dmp

    Filesize

    12KB

  • memory/1624-267-0x000007FEF4750000-0x000007FEF50ED000-memory.dmp

    Filesize

    9.6MB

  • memory/1624-263-0x0000000002240000-0x0000000002248000-memory.dmp

    Filesize

    32KB

  • memory/1624-274-0x00000000029BB000-0x0000000002A22000-memory.dmp

    Filesize

    412KB

  • memory/2416-266-0x000007FEF4750000-0x000007FEF50ED000-memory.dmp

    Filesize

    9.6MB

  • memory/2416-264-0x000007FEF4750000-0x000007FEF50ED000-memory.dmp

    Filesize

    9.6MB

  • memory/2416-271-0x0000000002CE4000-0x0000000002CE7000-memory.dmp

    Filesize

    12KB

  • memory/2416-268-0x000007FEF4750000-0x000007FEF50ED000-memory.dmp

    Filesize

    9.6MB

  • memory/2416-265-0x0000000002CE0000-0x0000000002D60000-memory.dmp

    Filesize

    512KB

  • memory/2416-262-0x000000001B6B0000-0x000000001B992000-memory.dmp

    Filesize

    2.9MB

  • memory/2416-273-0x0000000002CEB000-0x0000000002D52000-memory.dmp

    Filesize

    412KB

  • memory/2696-421-0x0000000002870000-0x00000000028E8000-memory.dmp

    Filesize

    480KB

  • memory/2696-419-0x0000000002870000-0x00000000028E8000-memory.dmp

    Filesize

    480KB

  • memory/2696-417-0x00000000008C0000-0x00000000008C1000-memory.dmp

    Filesize

    4KB

  • memory/2696-397-0x0000000000210000-0x000000000034E000-memory.dmp

    Filesize

    1.2MB

  • memory/2696-333-0x0000000000210000-0x000000000034E000-memory.dmp

    Filesize

    1.2MB

  • memory/2804-310-0x0000000002A74000-0x0000000002A77000-memory.dmp

    Filesize

    12KB

  • memory/2804-309-0x000007FEF46B0000-0x000007FEF504D000-memory.dmp

    Filesize

    9.6MB

  • memory/2804-308-0x0000000002A7B000-0x0000000002AE2000-memory.dmp

    Filesize

    412KB

  • memory/2804-304-0x0000000001F70000-0x0000000001F78000-memory.dmp

    Filesize

    32KB

  • memory/2920-311-0x0000000002CD0000-0x0000000002D50000-memory.dmp

    Filesize

    512KB

  • memory/2920-312-0x0000000002CD0000-0x0000000002D50000-memory.dmp

    Filesize

    512KB

  • memory/2920-313-0x000007FEF46B0000-0x000007FEF504D000-memory.dmp

    Filesize

    9.6MB

  • memory/2920-307-0x000007FEF46B0000-0x000007FEF504D000-memory.dmp

    Filesize

    9.6MB

  • memory/2920-303-0x000000001B710000-0x000000001B9F2000-memory.dmp

    Filesize

    2.9MB

  • memory/2920-306-0x0000000002CD0000-0x0000000002D50000-memory.dmp

    Filesize

    512KB

  • memory/2920-305-0x000007FEF46B0000-0x000007FEF504D000-memory.dmp

    Filesize

    9.6MB