Analysis
- max time kernel
149s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
03/04/2024, 12:33
General
- Target ffa40463814505e634702efbcaece393b419b05b3fb7701166a0421eb76af415.exe
- Size 1.1MB
- Sample240403-prgg9adb41
- SHA256 ffa40463814505e634702efbcaece393b419b05b3fb7701166a0421eb76af415
Malware Config
Extracted
-
risepro
-
193.233.132.62:50500
Signatures
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ffa40463814505e634702efbcaece393b419b05b3fb7701166a0421eb76af415.exe"C:\Users\Admin\AppData\Local\Temp\ffa40463814505e634702efbcaece393b419b05b3fb7701166a0421eb76af415.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2672-0-0x00000000004A0000-0x0000000000980000-memory.dmp
memory/2672-2-0x00000000004A0000-0x0000000000980000-memory.dmp
memory/2672-3-0x00000000004A0000-0x0000000000980000-memory.dmp
memory/2672-4-0x00000000004A0000-0x0000000000980000-memory.dmp
memory/2672-5-0x00000000004A0000-0x0000000000980000-memory.dmp
memory/2672-6-0x00000000004A0000-0x0000000000980000-memory.dmp
memory/2672-7-0x00000000004A0000-0x0000000000980000-memory.dmp
memory/2672-8-0x00000000004A0000-0x0000000000980000-memory.dmp
memory/2672-9-0x00000000004A0000-0x0000000000980000-memory.dmp
memory/2672-10-0x00000000004A0000-0x0000000000980000-memory.dmp
memory/2672-11-0x00000000004A0000-0x0000000000980000-memory.dmp
memory/2672-12-0x00000000004A0000-0x0000000000980000-memory.dmp
memory/2672-13-0x00000000004A0000-0x0000000000980000-memory.dmp
memory/2672-14-0x00000000004A0000-0x0000000000980000-memory.dmp
memory/2672-15-0x00000000004A0000-0x0000000000980000-memory.dmp