Analysis
-
max time kernel
148s -
max time network
158s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
-
submitted
28-03-2024 02:25
General
-
Target
37ad02bc91cbf3debed1a7d46e051f6e237b0218f6a8efe5bd32a9cfab624f56.exe
-
Size
3.0MB
-
MD5
eda280183613d80370c5095681e63014
-
SHA1
e756cab33b145fccd78bb684efdbeac063b8a5ad
-
SHA256
37ad02bc91cbf3debed1a7d46e051f6e237b0218f6a8efe5bd32a9cfab624f56
-
SHA512
3dd6d489b783f1119584d466694f6ff98514b1badea293d5ab90f5ca3581bc153b1f6cfd83c0c75a196a6ed6b42dbfd02b295e544311cc8645853f6b92d53220
-
SSDEEP
49152:d69yN4/+xScS6+hVSFdwNBQwoSjTswnPEBerNW6HsUoZ:d6/+xcZhVSjwNBQwtjTs8PEINbMUoZ
Malware Config
Signatures
-
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes
-
C:\Users\Admin\AppData\Local\Temp\37ad02bc91cbf3debed1a7d46e051f6e237b0218f6a8efe5bd32a9cfab624f56.exe"C:\Users\Admin\AppData\Local\Temp\37ad02bc91cbf3debed1a7d46e051f6e237b0218f6a8efe5bd32a9cfab624f56.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB