Analysis

  • max time kernel
    141s
  • max time network
    89s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240214-en
  • resource tags

    arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    07-04-2024 20:21

General

  • Target

    c2e6f7b28579030cca1320a1a1c2a349ddf12fe4837e62aa0fe5c3736ae555eb.exe

  • Size

    3.1MB

  • MD5

    617626f51fba71ac3a8d8e52fc43784c

  • SHA1

    ba413b6aef61118693cbd5ca8fcda42fc6c57932

  • SHA256

    c2e6f7b28579030cca1320a1a1c2a349ddf12fe4837e62aa0fe5c3736ae555eb

  • SHA512

    9866cd81f47d352012a35292ad2cbbe74482d1dde095c2a7b24a0887c9277b18f48e2d6d490aa43b87bd092d86a72754f7d4926287546f1660d395ef00f4afdb

  • SSDEEP

    49152:pOtGELt7tNQkVaLLtf3CdBVsvvbiyhBCEXTMcNYgYx+DPy3Seb89vgfUn2Db:pORLtaL5fJtzCsiXOPAdm2UAb

Malware Config

Signatures

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 9 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c2e6f7b28579030cca1320a1a1c2a349ddf12fe4837e62aa0fe5c3736ae555eb.exe
    "C:\Users\Admin\AppData\Local\Temp\c2e6f7b28579030cca1320a1a1c2a349ddf12fe4837e62aa0fe5c3736ae555eb.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    PID:2524

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2524-0-0x0000000000390000-0x0000000000B4A000-memory.dmp

    Filesize

    7.7MB

  • memory/2524-1-0x0000000000390000-0x0000000000B4A000-memory.dmp

    Filesize

    7.7MB

  • memory/2524-2-0x0000000000390000-0x0000000000B4A000-memory.dmp

    Filesize

    7.7MB

  • memory/2524-3-0x0000000000390000-0x0000000000B4A000-memory.dmp

    Filesize

    7.7MB

  • memory/2524-4-0x0000000000390000-0x0000000000B4A000-memory.dmp

    Filesize

    7.7MB

  • memory/2524-5-0x0000000000390000-0x0000000000B4A000-memory.dmp

    Filesize

    7.7MB

  • memory/2524-7-0x0000000000390000-0x0000000000B4A000-memory.dmp

    Filesize

    7.7MB

  • memory/2524-6-0x0000000000390000-0x0000000000B4A000-memory.dmp

    Filesize

    7.7MB

  • memory/2524-8-0x0000000000390000-0x0000000000B4A000-memory.dmp

    Filesize

    7.7MB