Analysis
-
max time kernel
291s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
25-04-2024 03:21
General
-
Target
8d0deea181a7b0fc482cdd88a463c489f7a066f76f43ea5e65305471cc00cb45.exe
-
Size
2.2MB
-
MD5
94624a695903186764f9b127f7aa24aa
-
SHA1
eec837c48cd0c5b0422637094993a908a831c629
-
SHA256
8d0deea181a7b0fc482cdd88a463c489f7a066f76f43ea5e65305471cc00cb45
-
SHA512
a6aab5f64781c7466031cb371570aa127a3bf7c15f5ad536c2f5813a1c1f5957edb06583f2d1673df923b27b93fd969ad4858d96eb34f979ddabd0c8a43c483d
-
SSDEEP
49152:reF1xn14/4iz/2//2pjHpPhDwteoSX7fKCLndy61A/fnU:K1xn1RiL23KFJDzLf9InU
Malware Config
Extracted
risepro
147.45.47.93:58709
Signatures
-
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d0deea181a7b0fc482cdd88a463c489f7a066f76f43ea5e65305471cc00cb45.exe"C:\Users\Admin\AppData\Local\Temp\8d0deea181a7b0fc482cdd88a463c489f7a066f76f43ea5e65305471cc00cb45.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.6MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
5.6MB