Analysis
- max time kernel
117s - max time network
118s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
03/06/2024, 05:40
General
- Target 8874fb20a8e228dff563cc9663efbd2f8f0e021da64bc4174e9cd3bdd005b540.exe
- Size 4.7MB
- Sample240603-gdb2lsde2y
- SHA256 8874fb20a8e228dff563cc9663efbd2f8f0e021da64bc4174e9cd3bdd005b540
Malware Config
Extracted
-
risepro
-
5.42.65.116:50500
Signatures
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8874fb20a8e228dff563cc9663efbd2f8f0e021da64bc4174e9cd3bdd005b540.exe"C:\Users\Admin\AppData\Local\Temp\8874fb20a8e228dff563cc9663efbd2f8f0e021da64bc4174e9cd3bdd005b540.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2264-51-0x0000000000A30000-0x0000000000A45000-memory.dmp
memory/2264-47-0x0000000000A30000-0x0000000000A45000-memory.dmp
memory/2264-2-0x0000000074200000-0x00000000748EE000-memory.dmp
memory/2264-3-0x0000000005340000-0x00000000055A2000-memory.dmp
memory/2264-4-0x0000000006970000-0x0000000006B96000-memory.dmp
memory/2264-5-0x0000000000A30000-0x0000000000A4C000-memory.dmp
memory/2264-7-0x0000000000A30000-0x0000000000A45000-memory.dmp
memory/2264-6-0x0000000000A30000-0x0000000000A45000-memory.dmp
memory/2264-65-0x0000000000A30000-0x0000000000A45000-memory.dmp
memory/2264-66-0x0000000074200000-0x00000000748EE000-memory.dmp
memory/2264-63-0x0000000000A30000-0x0000000000A45000-memory.dmp
memory/2264-61-0x0000000000A30000-0x0000000000A45000-memory.dmp
memory/2264-59-0x0000000000A30000-0x0000000000A45000-memory.dmp
memory/2264-57-0x0000000000A30000-0x0000000000A45000-memory.dmp
memory/2264-55-0x0000000000A30000-0x0000000000A45000-memory.dmp
memory/2264-54-0x0000000000A30000-0x0000000000A45000-memory.dmp
memory/2264-9-0x0000000000A30000-0x0000000000A45000-memory.dmp
memory/2264-50-0x0000000000A30000-0x0000000000A45000-memory.dmp
memory/2264-11-0x0000000000A30000-0x0000000000A45000-memory.dmp
memory/2264-13-0x0000000000A30000-0x0000000000A45000-memory.dmp
memory/2264-1-0x00000000003A0000-0x0000000000858000-memory.dmp
memory/2264-0-0x000000007420E000-0x000000007420F000-memory.dmp
memory/2264-84-0x0000000074200000-0x00000000748EE000-memory.dmp
memory/2264-45-0x0000000000A30000-0x0000000000A45000-memory.dmp
memory/2264-43-0x0000000000A30000-0x0000000000A45000-memory.dmp
memory/2264-41-0x0000000000A30000-0x0000000000A45000-memory.dmp
memory/2264-39-0x0000000000A30000-0x0000000000A45000-memory.dmp
memory/2264-37-0x0000000000A30000-0x0000000000A45000-memory.dmp
memory/2264-35-0x0000000000A30000-0x0000000000A45000-memory.dmp
memory/2264-34-0x0000000000A30000-0x0000000000A45000-memory.dmp
memory/2264-31-0x0000000000A30000-0x0000000000A45000-memory.dmp
memory/2264-29-0x0000000000A30000-0x0000000000A45000-memory.dmp
memory/2264-27-0x0000000000A30000-0x0000000000A45000-memory.dmp
memory/2264-25-0x0000000000A30000-0x0000000000A45000-memory.dmp
memory/2264-23-0x0000000000A30000-0x0000000000A45000-memory.dmp
memory/2264-21-0x0000000000A30000-0x0000000000A45000-memory.dmp
memory/2264-19-0x0000000000A30000-0x0000000000A45000-memory.dmp
memory/2264-17-0x0000000000A30000-0x0000000000A45000-memory.dmp
memory/2264-15-0x0000000000A30000-0x0000000000A45000-memory.dmp
memory/2404-67-0x0000000000400000-0x0000000000596000-memory.dmp
memory/2404-70-0x0000000000400000-0x0000000000596000-memory.dmp
memory/2404-83-0x0000000000400000-0x0000000000596000-memory.dmp
memory/2404-85-0x0000000000400000-0x0000000000596000-memory.dmp