Analysis

  • max time kernel
    141s
  • max time network
    113s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/04/2024, 11:25

General

  • Target

    8288c18597b9456ec598f635fae00637e8203492be568de96a8a41ae5fd8e746.exe

  • Size

    2.1MB

  • MD5

    9b10a3917212c16b32c137bac370f687

  • SHA1

    546e73958123b2499de98f8ea2617a72b5850225

  • SHA256

    8288c18597b9456ec598f635fae00637e8203492be568de96a8a41ae5fd8e746

  • SHA512

    023e6c1a4134b87552289d4cf4f64006d4a67b7b7fb7ff99feaefbd5ac43ff763de3a2194f3916f8db964084fdc23b76a888237d790b896616a28834c73a761e

  • SSDEEP

    49152:5SUl6vD5DxN6HHLJFwJZaEWKSHKBGeAm5GK49BhjmNQvSR9gDBA:5SSwD5DxkkKEkjmNMSUDa

Score
10/10

Malware Config

Extracted

Family

risepro

C2

147.45.47.93:58709

Signatures

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8288c18597b9456ec598f635fae00637e8203492be568de96a8a41ae5fd8e746.exe
    "C:\Users\Admin\AppData\Local\Temp\8288c18597b9456ec598f635fae00637e8203492be568de96a8a41ae5fd8e746.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:2116

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2116-0-0x00000000000E0000-0x000000000065C000-memory.dmp

          Filesize

          5.5MB

        • memory/2116-1-0x0000000077D44000-0x0000000077D46000-memory.dmp

          Filesize

          8KB

        • memory/2116-2-0x00000000051F0000-0x00000000051F1000-memory.dmp

          Filesize

          4KB

        • memory/2116-3-0x00000000051C0000-0x00000000051C1000-memory.dmp

          Filesize

          4KB

        • memory/2116-4-0x0000000005230000-0x0000000005231000-memory.dmp

          Filesize

          4KB

        • memory/2116-5-0x00000000051B0000-0x00000000051B1000-memory.dmp

          Filesize

          4KB

        • memory/2116-6-0x0000000005200000-0x0000000005201000-memory.dmp

          Filesize

          4KB

        • memory/2116-7-0x0000000005220000-0x0000000005221000-memory.dmp

          Filesize

          4KB

        • memory/2116-8-0x0000000005240000-0x0000000005241000-memory.dmp

          Filesize

          4KB

        • memory/2116-9-0x00000000051D0000-0x00000000051D1000-memory.dmp

          Filesize

          4KB

        • memory/2116-10-0x00000000051E0000-0x00000000051E1000-memory.dmp

          Filesize

          4KB

        • memory/2116-11-0x00000000051A0000-0x00000000051A1000-memory.dmp

          Filesize

          4KB

        • memory/2116-12-0x0000000005260000-0x0000000005262000-memory.dmp

          Filesize

          8KB

        • memory/2116-13-0x00000000000E0000-0x000000000065C000-memory.dmp

          Filesize

          5.5MB

        • memory/2116-14-0x00000000000E0000-0x000000000065C000-memory.dmp

          Filesize

          5.5MB

        • memory/2116-15-0x00000000000E0000-0x000000000065C000-memory.dmp

          Filesize

          5.5MB

        • memory/2116-16-0x00000000000E0000-0x000000000065C000-memory.dmp

          Filesize

          5.5MB

        • memory/2116-17-0x00000000000E0000-0x000000000065C000-memory.dmp

          Filesize

          5.5MB

        • memory/2116-18-0x00000000000E0000-0x000000000065C000-memory.dmp

          Filesize

          5.5MB

        • memory/2116-19-0x00000000000E0000-0x000000000065C000-memory.dmp

          Filesize

          5.5MB

        • memory/2116-20-0x00000000000E0000-0x000000000065C000-memory.dmp

          Filesize

          5.5MB

        • memory/2116-21-0x00000000000E0000-0x000000000065C000-memory.dmp

          Filesize

          5.5MB

        • memory/2116-22-0x00000000000E0000-0x000000000065C000-memory.dmp

          Filesize

          5.5MB

        • memory/2116-23-0x00000000000E0000-0x000000000065C000-memory.dmp

          Filesize

          5.5MB

        • memory/2116-24-0x00000000000E0000-0x000000000065C000-memory.dmp

          Filesize

          5.5MB

        • memory/2116-25-0x00000000000E0000-0x000000000065C000-memory.dmp

          Filesize

          5.5MB

        • memory/2116-26-0x00000000000E0000-0x000000000065C000-memory.dmp

          Filesize

          5.5MB

        • memory/2116-27-0x00000000000E0000-0x000000000065C000-memory.dmp

          Filesize

          5.5MB