Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
22/04/2024, 01:58
General
- Target b091cf1eb851edf585b6298906897b924cc09ff9bce8831ea432e7865f3a2dfe.exe
- Size 2.2MB
- Sample240422-cebp1seb25
- SHA256 b091cf1eb851edf585b6298906897b924cc09ff9bce8831ea432e7865f3a2dfe
Malware Config
Extracted
-
risepro
-
147.45.47.93:58709
Signatures
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b091cf1eb851edf585b6298906897b924cc09ff9bce8831ea432e7865f3a2dfe.exe"C:\Users\Admin\AppData\Local\Temp\b091cf1eb851edf585b6298906897b924cc09ff9bce8831ea432e7865f3a2dfe.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/772-0-0x00000000008F0000-0x0000000000E97000-memory.dmp
memory/772-1-0x0000000077474000-0x0000000077476000-memory.dmp
memory/772-2-0x0000000004D10000-0x0000000004D11000-memory.dmp
memory/772-3-0x0000000004CE0000-0x0000000004CE1000-memory.dmp
memory/772-4-0x0000000004D50000-0x0000000004D51000-memory.dmp
memory/772-5-0x0000000004CD0000-0x0000000004CD1000-memory.dmp
memory/772-6-0x0000000004CC0000-0x0000000004CC1000-memory.dmp
memory/772-7-0x0000000004D20000-0x0000000004D21000-memory.dmp
memory/772-8-0x0000000004D40000-0x0000000004D41000-memory.dmp
memory/772-9-0x0000000004D70000-0x0000000004D71000-memory.dmp
memory/772-10-0x0000000004D00000-0x0000000004D01000-memory.dmp
memory/772-11-0x0000000004D60000-0x0000000004D61000-memory.dmp
memory/772-12-0x0000000004CB0000-0x0000000004CB1000-memory.dmp
memory/772-13-0x0000000004D90000-0x0000000004D92000-memory.dmp
memory/772-14-0x00000000008F0000-0x0000000000E97000-memory.dmp
memory/772-15-0x00000000008F0000-0x0000000000E97000-memory.dmp
memory/772-16-0x00000000008F0000-0x0000000000E97000-memory.dmp
memory/772-17-0x00000000008F0000-0x0000000000E97000-memory.dmp
memory/772-18-0x00000000008F0000-0x0000000000E97000-memory.dmp
memory/772-19-0x00000000008F0000-0x0000000000E97000-memory.dmp
memory/772-20-0x00000000008F0000-0x0000000000E97000-memory.dmp
memory/772-21-0x00000000008F0000-0x0000000000E97000-memory.dmp
memory/772-22-0x00000000008F0000-0x0000000000E97000-memory.dmp
memory/772-23-0x00000000008F0000-0x0000000000E97000-memory.dmp
memory/772-24-0x00000000008F0000-0x0000000000E97000-memory.dmp
memory/772-25-0x00000000008F0000-0x0000000000E97000-memory.dmp
memory/772-26-0x00000000008F0000-0x0000000000E97000-memory.dmp
memory/772-27-0x00000000008F0000-0x0000000000E97000-memory.dmp
memory/772-28-0x00000000008F0000-0x0000000000E97000-memory.dmp