Analysis

  • max time kernel
    141s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-06-2024 00:25

General

  • Target

    52443a3d5e4e0b5c57b662d6c1d6ed30f3495114054dd70d7251d1af3243b7ae.exe

  • Size

    2.3MB

  • MD5

    c693e419a5ecfd93e96d27f79cdc7853

  • SHA1

    e6856fa68c9d59515c6861aaabf0f8487c22780a

  • SHA256

    52443a3d5e4e0b5c57b662d6c1d6ed30f3495114054dd70d7251d1af3243b7ae

  • SHA512

    86171d4f67555b302f2f3e7c1ded4ae940ab8200d73d37957c918eec055ab0bee87a38fd589a2f9f75995c8771ed571b1c8d3a040b74bd5e30d26fa51c30de11

  • SSDEEP

    49152:xkmKhyq24kI3qebVanxLe/ww38AbQmz9lvAHhbedwtkcZSddQuQB58obQwT6:xkmKEqlkAbknxy/n8wZXvUhbewtxTuQo

Score
10/10

Malware Config

Extracted

Family

risepro

C2

147.45.47.126:58709

Signatures

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\52443a3d5e4e0b5c57b662d6c1d6ed30f3495114054dd70d7251d1af3243b7ae.exe
    "C:\Users\Admin\AppData\Local\Temp\52443a3d5e4e0b5c57b662d6c1d6ed30f3495114054dd70d7251d1af3243b7ae.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:1056

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1056-0-0x0000000000330000-0x00000000008FF000-memory.dmp

    Filesize

    5.8MB

  • memory/1056-1-0x0000000077DC4000-0x0000000077DC6000-memory.dmp

    Filesize

    8KB

  • memory/1056-6-0x00000000052A0000-0x00000000052A1000-memory.dmp

    Filesize

    4KB

  • memory/1056-13-0x0000000005290000-0x0000000005291000-memory.dmp

    Filesize

    4KB

  • memory/1056-12-0x0000000005340000-0x0000000005341000-memory.dmp

    Filesize

    4KB

  • memory/1056-11-0x00000000052E0000-0x00000000052E1000-memory.dmp

    Filesize

    4KB

  • memory/1056-10-0x0000000005350000-0x0000000005351000-memory.dmp

    Filesize

    4KB

  • memory/1056-7-0x0000000005310000-0x0000000005311000-memory.dmp

    Filesize

    4KB

  • memory/1056-9-0x0000000005300000-0x0000000005301000-memory.dmp

    Filesize

    4KB

  • memory/1056-8-0x0000000005320000-0x0000000005321000-memory.dmp

    Filesize

    4KB

  • memory/1056-5-0x00000000052B0000-0x00000000052B1000-memory.dmp

    Filesize

    4KB

  • memory/1056-4-0x0000000005330000-0x0000000005331000-memory.dmp

    Filesize

    4KB

  • memory/1056-3-0x00000000052C0000-0x00000000052C1000-memory.dmp

    Filesize

    4KB

  • memory/1056-2-0x00000000052F0000-0x00000000052F1000-memory.dmp

    Filesize

    4KB

  • memory/1056-14-0x0000000005360000-0x0000000005362000-memory.dmp

    Filesize

    8KB

  • memory/1056-15-0x0000000000330000-0x00000000008FF000-memory.dmp

    Filesize

    5.8MB

  • memory/1056-16-0x0000000000330000-0x00000000008FF000-memory.dmp

    Filesize

    5.8MB

  • memory/1056-17-0x0000000000330000-0x00000000008FF000-memory.dmp

    Filesize

    5.8MB

  • memory/1056-18-0x0000000000330000-0x00000000008FF000-memory.dmp

    Filesize

    5.8MB

  • memory/1056-19-0x0000000000330000-0x00000000008FF000-memory.dmp

    Filesize

    5.8MB

  • memory/1056-20-0x0000000000330000-0x00000000008FF000-memory.dmp

    Filesize

    5.8MB

  • memory/1056-21-0x0000000000330000-0x00000000008FF000-memory.dmp

    Filesize

    5.8MB

  • memory/1056-22-0x0000000000330000-0x00000000008FF000-memory.dmp

    Filesize

    5.8MB

  • memory/1056-23-0x0000000000330000-0x00000000008FF000-memory.dmp

    Filesize

    5.8MB

  • memory/1056-24-0x0000000000330000-0x00000000008FF000-memory.dmp

    Filesize

    5.8MB

  • memory/1056-25-0x0000000000330000-0x00000000008FF000-memory.dmp

    Filesize

    5.8MB

  • memory/1056-26-0x0000000000330000-0x00000000008FF000-memory.dmp

    Filesize

    5.8MB

  • memory/1056-27-0x0000000000330000-0x00000000008FF000-memory.dmp

    Filesize

    5.8MB

  • memory/1056-28-0x0000000000330000-0x00000000008FF000-memory.dmp

    Filesize

    5.8MB

  • memory/1056-29-0x0000000000330000-0x00000000008FF000-memory.dmp

    Filesize

    5.8MB