Analysis
-
max time kernel
146s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03/04/2024, 12:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ffa40463814505e634702efbcaece393b419b05b3fb7701166a0421eb76af415.exe
Resource
win7-20240221-en
3 signatures
150 seconds
General
-
Target
ffa40463814505e634702efbcaece393b419b05b3fb7701166a0421eb76af415.exe
-
Size
1.1MB
-
MD5
7d0c94a0dafc3fb9a3573a6366f7e957
-
SHA1
10fce6aa77b270fff18d193a7016aa1b3eebe16f
-
SHA256
ffa40463814505e634702efbcaece393b419b05b3fb7701166a0421eb76af415
-
SHA512
3fc78fb60222298e5723f8eb9f83c7888dcb21c5fdf73972ccc7b4b7ff0664ec4e324737f210633634a4c2f70894a4a8f63f4a8fc8e92d58a7c781d43d9fb5bf
-
SSDEEP
24576:b644BNuMbtCIG5FeXb+oaxlAstzwQ+iyIakELysIGn8txOB:24WNuMbtC55FmX2lRzlbL8ysV+x
Malware Config
Extracted
Family
risepro
C2
193.233.132.62:50500
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
pid Process 1300 ffa40463814505e634702efbcaece393b419b05b3fb7701166a0421eb76af415.exe 1300 ffa40463814505e634702efbcaece393b419b05b3fb7701166a0421eb76af415.exe 1300 ffa40463814505e634702efbcaece393b419b05b3fb7701166a0421eb76af415.exe 1300 ffa40463814505e634702efbcaece393b419b05b3fb7701166a0421eb76af415.exe 1300 ffa40463814505e634702efbcaece393b419b05b3fb7701166a0421eb76af415.exe 1300 ffa40463814505e634702efbcaece393b419b05b3fb7701166a0421eb76af415.exe 1300 ffa40463814505e634702efbcaece393b419b05b3fb7701166a0421eb76af415.exe 1300 ffa40463814505e634702efbcaece393b419b05b3fb7701166a0421eb76af415.exe 1300 ffa40463814505e634702efbcaece393b419b05b3fb7701166a0421eb76af415.exe 1300 ffa40463814505e634702efbcaece393b419b05b3fb7701166a0421eb76af415.exe 1300 ffa40463814505e634702efbcaece393b419b05b3fb7701166a0421eb76af415.exe 1300 ffa40463814505e634702efbcaece393b419b05b3fb7701166a0421eb76af415.exe 1300 ffa40463814505e634702efbcaece393b419b05b3fb7701166a0421eb76af415.exe 1300 ffa40463814505e634702efbcaece393b419b05b3fb7701166a0421eb76af415.exe 1300 ffa40463814505e634702efbcaece393b419b05b3fb7701166a0421eb76af415.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1300 ffa40463814505e634702efbcaece393b419b05b3fb7701166a0421eb76af415.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ffa40463814505e634702efbcaece393b419b05b3fb7701166a0421eb76af415.exe"C:\Users\Admin\AppData\Local\Temp\ffa40463814505e634702efbcaece393b419b05b3fb7701166a0421eb76af415.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:1300