Analysis
- max time kernel
146s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20240412-en - resource tags
- submitted
14/04/2024, 10:50
General
- Target b74b0c462ffa559587732622b23c2b05b9755d052b438b8b517693b1b75eafe3.exe
- Size 2.2MB
- Sample240414-mxcedaga69
- SHA256 b74b0c462ffa559587732622b23c2b05b9755d052b438b8b517693b1b75eafe3
Malware Config
Extracted
-
risepro
-
147.45.47.93:58709
Signatures
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b74b0c462ffa559587732622b23c2b05b9755d052b438b8b517693b1b75eafe3.exe"C:\Users\Admin\AppData\Local\Temp\b74b0c462ffa559587732622b23c2b05b9755d052b438b8b517693b1b75eafe3.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3936-0-0x0000000000CE0000-0x000000000127F000-memory.dmp
memory/3936-1-0x0000000077306000-0x0000000077308000-memory.dmp
memory/3936-3-0x0000000005860000-0x0000000005861000-memory.dmp
memory/3936-2-0x0000000005890000-0x0000000005891000-memory.dmp
memory/3936-4-0x0000000005850000-0x0000000005851000-memory.dmp
memory/3936-6-0x0000000005840000-0x0000000005841000-memory.dmp
memory/3936-5-0x00000000058C0000-0x00000000058C1000-memory.dmp
memory/3936-8-0x00000000058D0000-0x00000000058D1000-memory.dmp
memory/3936-7-0x00000000058A0000-0x00000000058A1000-memory.dmp
memory/3936-10-0x0000000005880000-0x0000000005881000-memory.dmp
memory/3936-9-0x00000000058F0000-0x00000000058F1000-memory.dmp
memory/3936-12-0x0000000005830000-0x0000000005831000-memory.dmp
memory/3936-11-0x00000000058E0000-0x00000000058E1000-memory.dmp
memory/3936-13-0x0000000005910000-0x0000000005912000-memory.dmp
memory/3936-14-0x0000000000CE0000-0x000000000127F000-memory.dmp
memory/3936-15-0x0000000000CE0000-0x000000000127F000-memory.dmp
memory/3936-16-0x0000000000CE0000-0x000000000127F000-memory.dmp
memory/3936-17-0x0000000000CE0000-0x000000000127F000-memory.dmp
memory/3936-18-0x0000000000CE0000-0x000000000127F000-memory.dmp
memory/3936-19-0x0000000000CE0000-0x000000000127F000-memory.dmp
memory/3936-20-0x0000000000CE0000-0x000000000127F000-memory.dmp
memory/3936-21-0x0000000000CE0000-0x000000000127F000-memory.dmp
memory/3936-22-0x0000000000CE0000-0x000000000127F000-memory.dmp
memory/3936-23-0x0000000000CE0000-0x000000000127F000-memory.dmp
memory/3936-24-0x0000000000CE0000-0x000000000127F000-memory.dmp
memory/3936-25-0x0000000000CE0000-0x000000000127F000-memory.dmp
memory/3936-26-0x0000000000CE0000-0x000000000127F000-memory.dmp
memory/3936-27-0x0000000000CE0000-0x000000000127F000-memory.dmp
memory/3936-28-0x0000000000CE0000-0x000000000127F000-memory.dmp