Analysis
-
max time kernel
140s -
max time network
93s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
15/04/2024, 10:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
09949e70c26db70e2f15c29a95fe129b6827ae1d035eb62f66a9ef761f5c4a7c.exe
Resource
win10v2004-20240412-en
6 signatures
150 seconds
General
-
Target
09949e70c26db70e2f15c29a95fe129b6827ae1d035eb62f66a9ef761f5c4a7c.exe
-
Size
4.5MB
-
MD5
7f8c46da5979128e26c7b1f1b008cc9f
-
SHA1
f960a8158b430c6953e8c609cb18b60deda961e1
-
SHA256
09949e70c26db70e2f15c29a95fe129b6827ae1d035eb62f66a9ef761f5c4a7c
-
SHA512
b6362d99f5d848c68c1af06b89fc9a7bc7630230c3b7ae47c3cbdfd385d72924803019215e7c3694de50a50978112543b64bb98cb10906d061ea28f5955b9370
-
SSDEEP
98304:43cjQaNlzzLeQFK7eCL/s2x4rRJMSMOJnEizIx/7S:4sjQarjeLe04rR+/aEzxm
Malware Config
Extracted
Family
risepro
C2
193.233.132.253:50500
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 09949e70c26db70e2f15c29a95fe129b6827ae1d035eb62f66a9ef761f5c4a7c.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 09949e70c26db70e2f15c29a95fe129b6827ae1d035eb62f66a9ef761f5c4a7c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 09949e70c26db70e2f15c29a95fe129b6827ae1d035eb62f66a9ef761f5c4a7c.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 09949e70c26db70e2f15c29a95fe129b6827ae1d035eb62f66a9ef761f5c4a7c.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3644 09949e70c26db70e2f15c29a95fe129b6827ae1d035eb62f66a9ef761f5c4a7c.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3644 09949e70c26db70e2f15c29a95fe129b6827ae1d035eb62f66a9ef761f5c4a7c.exe 3644 09949e70c26db70e2f15c29a95fe129b6827ae1d035eb62f66a9ef761f5c4a7c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\09949e70c26db70e2f15c29a95fe129b6827ae1d035eb62f66a9ef761f5c4a7c.exe"C:\Users\Admin\AppData\Local\Temp\09949e70c26db70e2f15c29a95fe129b6827ae1d035eb62f66a9ef761f5c4a7c.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3644