Analysis
-
max time kernel
292s -
max time network
255s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
04/04/2024, 22:18
General
-
Target
036443dacd073db8584a80bbe323986b3c5646e562c608e5111e9debfdb6f591.exe
-
Size
3.0MB
-
MD5
fb00b486ac92ab8f06d4bc0805894d6a
-
SHA1
d4817503ec6d9761aae25f55632e6f38274b61af
-
SHA256
036443dacd073db8584a80bbe323986b3c5646e562c608e5111e9debfdb6f591
-
SHA512
1bd4d2579ff84e4f3e480814e261ae552dd0a82dce793bfaa001c2b389f963be1b074795c3503d92b061a52944bdfc87da236d65f5531ceab596a27122b92660
-
SSDEEP
49152:yRH+1QuHG33oJCR+53muVEsAEvYHnEBFJXJRg5pvYP4NhYaL0ZvdLqMx3J3D/JHZ:yRL8+I52u2sfVDgzvYwjL0ZAMx3K6
Score
10/10
Malware Config
Signatures
-
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer 10 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\036443dacd073db8584a80bbe323986b3c5646e562c608e5111e9debfdb6f591.exe"C:\Users\Admin\AppData\Local\Temp\036443dacd073db8584a80bbe323986b3c5646e562c608e5111e9debfdb6f591.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.6MB
-
Filesize
7.6MB
-
Filesize
7.6MB
-
Filesize
7.6MB
-
Filesize
7.6MB
-
Filesize
7.6MB
-
Filesize
7.6MB
-
Filesize
7.6MB
-
Filesize
7.6MB
-
Filesize
7.6MB