Analysis

  • max time kernel
    150s
  • max time network
    158s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240412-en
  • resource tags

    arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    15/04/2024, 11:25

General

  • Target

    8288c18597b9456ec598f635fae00637e8203492be568de96a8a41ae5fd8e746.exe

  • Size

    2.1MB

  • MD5

    9b10a3917212c16b32c137bac370f687

  • SHA1

    546e73958123b2499de98f8ea2617a72b5850225

  • SHA256

    8288c18597b9456ec598f635fae00637e8203492be568de96a8a41ae5fd8e746

  • SHA512

    023e6c1a4134b87552289d4cf4f64006d4a67b7b7fb7ff99feaefbd5ac43ff763de3a2194f3916f8db964084fdc23b76a888237d790b896616a28834c73a761e

  • SSDEEP

    49152:5SUl6vD5DxN6HHLJFwJZaEWKSHKBGeAm5GK49BhjmNQvSR9gDBA:5SSwD5DxkkKEkjmNMSUDa

Score
10/10

Malware Config

Extracted

Family

risepro

C2

147.45.47.93:58709

Signatures

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8288c18597b9456ec598f635fae00637e8203492be568de96a8a41ae5fd8e746.exe
    "C:\Users\Admin\AppData\Local\Temp\8288c18597b9456ec598f635fae00637e8203492be568de96a8a41ae5fd8e746.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:3436

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/3436-0-0x00000000002C0000-0x000000000083C000-memory.dmp

          Filesize

          5.5MB

        • memory/3436-1-0x0000000077E86000-0x0000000077E88000-memory.dmp

          Filesize

          8KB

        • memory/3436-2-0x0000000005220000-0x0000000005221000-memory.dmp

          Filesize

          4KB

        • memory/3436-4-0x0000000005250000-0x0000000005251000-memory.dmp

          Filesize

          4KB

        • memory/3436-3-0x00000000051F0000-0x00000000051F1000-memory.dmp

          Filesize

          4KB

        • memory/3436-6-0x00000000051D0000-0x00000000051D1000-memory.dmp

          Filesize

          4KB

        • memory/3436-5-0x00000000051E0000-0x00000000051E1000-memory.dmp

          Filesize

          4KB

        • memory/3436-7-0x0000000005230000-0x0000000005231000-memory.dmp

          Filesize

          4KB

        • memory/3436-8-0x0000000005260000-0x0000000005261000-memory.dmp

          Filesize

          4KB

        • memory/3436-9-0x0000000005280000-0x0000000005281000-memory.dmp

          Filesize

          4KB

        • memory/3436-10-0x0000000005210000-0x0000000005211000-memory.dmp

          Filesize

          4KB

        • memory/3436-11-0x0000000005270000-0x0000000005271000-memory.dmp

          Filesize

          4KB

        • memory/3436-12-0x00000000051C0000-0x00000000051C1000-memory.dmp

          Filesize

          4KB

        • memory/3436-13-0x00000000052B0000-0x00000000052B2000-memory.dmp

          Filesize

          8KB

        • memory/3436-14-0x00000000002C0000-0x000000000083C000-memory.dmp

          Filesize

          5.5MB

        • memory/3436-15-0x00000000002C0000-0x000000000083C000-memory.dmp

          Filesize

          5.5MB

        • memory/3436-16-0x00000000002C0000-0x000000000083C000-memory.dmp

          Filesize

          5.5MB

        • memory/3436-17-0x00000000002C0000-0x000000000083C000-memory.dmp

          Filesize

          5.5MB

        • memory/3436-18-0x00000000002C0000-0x000000000083C000-memory.dmp

          Filesize

          5.5MB

        • memory/3436-19-0x00000000002C0000-0x000000000083C000-memory.dmp

          Filesize

          5.5MB

        • memory/3436-20-0x00000000002C0000-0x000000000083C000-memory.dmp

          Filesize

          5.5MB

        • memory/3436-21-0x00000000002C0000-0x000000000083C000-memory.dmp

          Filesize

          5.5MB

        • memory/3436-22-0x00000000002C0000-0x000000000083C000-memory.dmp

          Filesize

          5.5MB

        • memory/3436-23-0x00000000002C0000-0x000000000083C000-memory.dmp

          Filesize

          5.5MB

        • memory/3436-24-0x00000000002C0000-0x000000000083C000-memory.dmp

          Filesize

          5.5MB

        • memory/3436-25-0x00000000002C0000-0x000000000083C000-memory.dmp

          Filesize

          5.5MB

        • memory/3436-26-0x00000000002C0000-0x000000000083C000-memory.dmp

          Filesize

          5.5MB

        • memory/3436-27-0x00000000002C0000-0x000000000083C000-memory.dmp

          Filesize

          5.5MB

        • memory/3436-28-0x00000000002C0000-0x000000000083C000-memory.dmp

          Filesize

          5.5MB