Analysis

  • max time kernel
    141s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    04-06-2024 03:41

General

  • Target

    4de928eed092809696e1212bc93c23cd9229773c45552619cb50eb9ccf769185.exe

  • Size

    2.2MB

  • MD5

    ea845d7ae5ffcc92058eb88e941f3110

  • SHA1

    df66b253812b3de5c8dd02ba9650436964fcaa0f

  • SHA256

    4de928eed092809696e1212bc93c23cd9229773c45552619cb50eb9ccf769185

  • SHA512

    44339f7a8d622e30f3c65aea73cc0187ed8b870c265073137e5996f20bc274526f14e7e92b23b2d93c9aa5b3d75e5df5dfc75fe0d8840e6beea2f6fa350b65f1

  • SSDEEP

    49152:0kmKhyq24kI3qebVaqZaHxeaXGtf+rQmgthOe9kUDeTf16HOj+muCP/NOQVh9hPB:0kmKEqlkAbkcaR3XG1SZbUyLWOj9ushd

Score
10/10

Malware Config

Extracted

Family

risepro

C2

147.45.47.126:58709

Signatures

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4de928eed092809696e1212bc93c23cd9229773c45552619cb50eb9ccf769185.exe
    "C:\Users\Admin\AppData\Local\Temp\4de928eed092809696e1212bc93c23cd9229773c45552619cb50eb9ccf769185.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:2168

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2168-0-0x0000000000E10000-0x00000000013D5000-memory.dmp

    Filesize

    5.8MB

  • memory/2168-1-0x00000000773D0000-0x00000000773D2000-memory.dmp

    Filesize

    8KB

  • memory/2168-15-0x0000000000940000-0x0000000000942000-memory.dmp

    Filesize

    8KB

  • memory/2168-16-0x0000000002E20000-0x0000000002E22000-memory.dmp

    Filesize

    8KB

  • memory/2168-14-0x0000000002D10000-0x0000000002D11000-memory.dmp

    Filesize

    4KB

  • memory/2168-13-0x0000000002E00000-0x0000000002E01000-memory.dmp

    Filesize

    4KB

  • memory/2168-12-0x0000000000DC0000-0x0000000000DC1000-memory.dmp

    Filesize

    4KB

  • memory/2168-11-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

    Filesize

    4KB

  • memory/2168-10-0x0000000002E10000-0x0000000002E11000-memory.dmp

    Filesize

    4KB

  • memory/2168-9-0x00000000029E0000-0x00000000029E1000-memory.dmp

    Filesize

    4KB

  • memory/2168-8-0x0000000002D30000-0x0000000002D31000-memory.dmp

    Filesize

    4KB

  • memory/2168-7-0x00000000029F0000-0x00000000029F1000-memory.dmp

    Filesize

    4KB

  • memory/2168-6-0x0000000000950000-0x0000000000951000-memory.dmp

    Filesize

    4KB

  • memory/2168-5-0x0000000002D80000-0x0000000002D81000-memory.dmp

    Filesize

    4KB

  • memory/2168-4-0x0000000000E00000-0x0000000000E01000-memory.dmp

    Filesize

    4KB

  • memory/2168-3-0x0000000000C40000-0x0000000000C41000-memory.dmp

    Filesize

    4KB

  • memory/2168-2-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

    Filesize

    4KB

  • memory/2168-17-0x0000000000E10000-0x00000000013D5000-memory.dmp

    Filesize

    5.8MB

  • memory/2168-18-0x0000000000E10000-0x00000000013D5000-memory.dmp

    Filesize

    5.8MB

  • memory/2168-19-0x0000000000E10000-0x00000000013D5000-memory.dmp

    Filesize

    5.8MB

  • memory/2168-20-0x0000000000E10000-0x00000000013D5000-memory.dmp

    Filesize

    5.8MB

  • memory/2168-21-0x0000000000E10000-0x00000000013D5000-memory.dmp

    Filesize

    5.8MB

  • memory/2168-22-0x0000000000E10000-0x00000000013D5000-memory.dmp

    Filesize

    5.8MB

  • memory/2168-23-0x0000000000E10000-0x00000000013D5000-memory.dmp

    Filesize

    5.8MB

  • memory/2168-24-0x0000000000E10000-0x00000000013D5000-memory.dmp

    Filesize

    5.8MB

  • memory/2168-25-0x0000000000E10000-0x00000000013D5000-memory.dmp

    Filesize

    5.8MB

  • memory/2168-26-0x0000000000E10000-0x00000000013D5000-memory.dmp

    Filesize

    5.8MB

  • memory/2168-27-0x0000000000E10000-0x00000000013D5000-memory.dmp

    Filesize

    5.8MB

  • memory/2168-28-0x0000000000E10000-0x00000000013D5000-memory.dmp

    Filesize

    5.8MB

  • memory/2168-29-0x0000000000E10000-0x00000000013D5000-memory.dmp

    Filesize

    5.8MB

  • memory/2168-30-0x0000000000E10000-0x00000000013D5000-memory.dmp

    Filesize

    5.8MB

  • memory/2168-31-0x0000000000E10000-0x00000000013D5000-memory.dmp

    Filesize

    5.8MB