Analysis
- max time kernel
141s - max time network
120s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
15/04/2024, 01:00
General
- Target 4c83fa749481d0d8549034facf59317f713674625c990e83dcb6ec3e00fc2447.exe
- Size 2.2MB
- Sample240415-bcnfcsac42
- SHA256 4c83fa749481d0d8549034facf59317f713674625c990e83dcb6ec3e00fc2447
Malware Config
Extracted
-
risepro
-
147.45.47.93:58709
Signatures
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c83fa749481d0d8549034facf59317f713674625c990e83dcb6ec3e00fc2447.exe"C:\Users\Admin\AppData\Local\Temp\4c83fa749481d0d8549034facf59317f713674625c990e83dcb6ec3e00fc2447.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2008-0-0x00000000001E0000-0x000000000076A000-memory.dmp
memory/2008-1-0x0000000077830000-0x0000000077832000-memory.dmp
memory/2008-13-0x00000000029A0000-0x00000000029A1000-memory.dmp
memory/2008-12-0x0000000002760000-0x0000000002761000-memory.dmp
memory/2008-14-0x0000000002290000-0x0000000002292000-memory.dmp
memory/2008-11-0x0000000002AC0000-0x0000000002AC1000-memory.dmp
memory/2008-10-0x0000000002AE0000-0x0000000002AE1000-memory.dmp
memory/2008-9-0x0000000002870000-0x0000000002871000-memory.dmp
memory/2008-8-0x0000000002A50000-0x0000000002A51000-memory.dmp
memory/2008-7-0x0000000002880000-0x0000000002881000-memory.dmp
memory/2008-6-0x00000000022F0000-0x00000000022F1000-memory.dmp
memory/2008-5-0x0000000002A60000-0x0000000002A61000-memory.dmp
memory/2008-4-0x0000000002860000-0x0000000002861000-memory.dmp
memory/2008-2-0x0000000002810000-0x0000000002811000-memory.dmp
memory/2008-3-0x0000000002620000-0x0000000002621000-memory.dmp
memory/2008-15-0x0000000002C40000-0x0000000002C42000-memory.dmp
memory/2008-16-0x00000000001E0000-0x000000000076A000-memory.dmp
memory/2008-17-0x00000000001E0000-0x000000000076A000-memory.dmp
memory/2008-18-0x00000000001E0000-0x000000000076A000-memory.dmp
memory/2008-19-0x00000000001E0000-0x000000000076A000-memory.dmp
memory/2008-20-0x00000000001E0000-0x000000000076A000-memory.dmp
memory/2008-21-0x00000000001E0000-0x000000000076A000-memory.dmp
memory/2008-22-0x00000000001E0000-0x000000000076A000-memory.dmp
memory/2008-23-0x00000000001E0000-0x000000000076A000-memory.dmp
memory/2008-24-0x00000000001E0000-0x000000000076A000-memory.dmp
memory/2008-25-0x00000000001E0000-0x000000000076A000-memory.dmp
memory/2008-26-0x00000000001E0000-0x000000000076A000-memory.dmp
memory/2008-27-0x00000000001E0000-0x000000000076A000-memory.dmp
memory/2008-28-0x00000000001E0000-0x000000000076A000-memory.dmp
memory/2008-29-0x00000000001E0000-0x000000000076A000-memory.dmp
memory/2008-30-0x00000000001E0000-0x000000000076A000-memory.dmp