Overview

overview

10

Static

static

7

340de32620...cs.exe

windows7-x64

10

340de32620...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    340de326207f56a91d4d559f044d0dd0_NeikiAnalytics.exe

  • Size

    2.1MB

  • Sample

    240522-qtdd2sdc6z

  • MD5

    340de326207f56a91d4d559f044d0dd0

  • SHA1

    0a68aba8652ae34eb785a5a439204001e2a7c495

  • SHA256

    0d18db6368c13e3d4f20a312648e971bb9f7913b30111f3c0002db7049b23c15

  • SHA512

    75ae27ee1c489ec29c60a325ba16c8bf2c07598cbccd958fb8552ead79cfb184102ddf55cdc3559c337ea526aa60d79ec03ec2b15fff4d45e72b069e87d8fb74

  • SSDEEP

    49152:ZgtFcjRqQHJWpjH1qqCK0I1tkPlCY5KRPdncw50:+tFcjJWdH1qthgttF5cwy

Score
10/10
riseproevasionstealerthemidatrojan

Malware Config

Extracted

Family

risepro

C2

147.45.47.126:58709

Targets

    • Target

      340de326207f56a91d4d559f044d0dd0_NeikiAnalytics.exe

    • Size

      2.1MB

    • MD5

      340de326207f56a91d4d559f044d0dd0

    • SHA1

      0a68aba8652ae34eb785a5a439204001e2a7c495

    • SHA256

      0d18db6368c13e3d4f20a312648e971bb9f7913b30111f3c0002db7049b23c15

    • SHA512

      75ae27ee1c489ec29c60a325ba16c8bf2c07598cbccd958fb8552ead79cfb184102ddf55cdc3559c337ea526aa60d79ec03ec2b15fff4d45e72b069e87d8fb74

    • SSDEEP

      49152:ZgtFcjRqQHJWpjH1qqCK0I1tkPlCY5KRPdncw50:+tFcjJWdH1qthgttF5cwy

    Score
    10/10
    riseproevasionstealerthemidatrojan

    • RisePro

      RisePro stealer is an infostealer distributed by PrivateLoader.

      stealerrisepro

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks