Analysis
-
max time kernel
142s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
08/05/2024, 09:55
General
-
Target
54763bb5a0e384fa3f253e9d175fbc60_NEIKI.exe
-
Size
2.1MB
-
MD5
54763bb5a0e384fa3f253e9d175fbc60
-
SHA1
b1f5da49c14fae4aabd42ce6169aab30fa9dd94f
-
SHA256
b4980cf355475d0879d2bac69fe4aacf7176c404da18ed6457756860428f406c
-
SHA512
da16db4b05b42c57e511c53128d0b14e3b64745f55a34520e3f6b344e2850d8ddfc7855f7c62ace1ef3eb3fb27b5442913d90e73342a6a7adee13c924462bafb
-
SSDEEP
49152:TyFiWjD/hcTLWJXbrYYAK6gGDe57Db8291iJNRHRQFg4:TWiWjDJcfWtbgVfD2h9QNVWF
Score
10/10
Malware Config
Extracted
Family
risepro
C2
147.45.47.93:58709
Signatures
-
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer 10 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\54763bb5a0e384fa3f253e9d175fbc60_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\54763bb5a0e384fa3f253e9d175fbc60_NEIKI.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.5MB
-
Filesize
6.5MB
-
Filesize
6.5MB
-
Filesize
6.5MB
-
Filesize
6.5MB
-
Filesize
6.5MB
-
Filesize
6.5MB
-
Filesize
6.5MB
-
Filesize
6.5MB
-
Filesize
6.5MB