Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
-
submitted
27/03/2024, 23:25
General
-
Target
812d97565d7a929cc7ec239fb8296fa9fea67caa68cda8d9b823a569050c0584.exe
-
Size
2.9MB
-
MD5
dd1d1a22b58d85eeb468803241e11438
-
SHA1
58fdb9cb95665956efd13882800c9d72786696f5
-
SHA256
812d97565d7a929cc7ec239fb8296fa9fea67caa68cda8d9b823a569050c0584
-
SHA512
28b7461b1d1d87bf67c09d58dfebc34eefa69c64fe7d3aa006a8f9f945f2e0530b547539fbfe440c078bbffabc89d4520eabfc1c2ff3fedde6fa8295d384a942
-
SSDEEP
49152:zC2KdJSG128UOOdkj8cGrtfFCo2tuepOpzw8nsU2/:FSJSG128U5kj8caJFCFtGtw8sj
Malware Config
Signatures
-
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes
-
C:\Users\Admin\AppData\Local\Temp\812d97565d7a929cc7ec239fb8296fa9fea67caa68cda8d9b823a569050c0584.exe"C:\Users\Admin\AppData\Local\Temp\812d97565d7a929cc7ec239fb8296fa9fea67caa68cda8d9b823a569050c0584.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB