Analysis
- max time kernel
93s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
12/05/2024, 03:23
General
- Target c50edc34aed88e8c744ab3f52fe2cba34b498ae3c9f553b286c5771264a61819.exe
- Size 5.8MB
- Sample240512-dxklbaeb2s
- SHA256 c50edc34aed88e8c744ab3f52fe2cba34b498ae3c9f553b286c5771264a61819
Malware Config
Extracted
-
risepro
-
191.101.209.39
-
5.42.66.10
Signatures
- PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- Drops startup file 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c50edc34aed88e8c744ab3f52fe2cba34b498ae3c9f553b286c5771264a61819.exe"C:\Users\Admin\AppData\Local\Temp\c50edc34aed88e8c744ab3f52fe2cba34b498ae3c9f553b286c5771264a61819.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP HR" /sc HOURLY /rl HIGHEST2⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP LG" /sc ONLOGON /rl HIGHEST2⤵
- Creates scheduled task(s)
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
WinTrackerSP.exe
memory/5052-3-0x0000000000C50000-0x0000000000C51000-memory.dmp
memory/5052-8-0x0000000000C60000-0x0000000001685000-memory.dmp
memory/5052-7-0x0000000002C80000-0x0000000002C81000-memory.dmp
memory/5052-6-0x0000000002C70000-0x0000000002C71000-memory.dmp
memory/5052-5-0x0000000002C60000-0x0000000002C61000-memory.dmp
memory/5052-4-0x0000000002C50000-0x0000000002C51000-memory.dmp
memory/5052-2-0x0000000000C40000-0x0000000000C41000-memory.dmp
memory/5052-1-0x0000000000CEA000-0x00000000010B6000-memory.dmp
memory/5052-0-0x0000000000B30000-0x0000000000B31000-memory.dmp
memory/5052-18-0x0000000000CEA000-0x00000000010B6000-memory.dmp
memory/5052-19-0x0000000000C60000-0x0000000001685000-memory.dmp