Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    04-06-2024 10:49

General

  • Target

    abed6f09999c18d12d84a49fb67b12cd4a2ca7a79fa365cecd9d955c3364ff5c.exe

  • Size

    5.1MB

  • MD5

    80b4a765ed935f41c378ac4ae985f72b

  • SHA1

    5d0e9d4e18da85ca394f7b698a57a4763bd97f82

  • SHA256

    abed6f09999c18d12d84a49fb67b12cd4a2ca7a79fa365cecd9d955c3364ff5c

  • SHA512

    07c00704e16b8361d82a2f3418aef1730474c69ceb5fb2542eaed24224b2d2fd214d8cc0f82b5546a09f9db53f75052c584c37008257a52ee3912aa59da193d1

  • SSDEEP

    98304:WGCsyIF+m4RdaWl6eKuFrKQPUNYVsYnVK13z9OI:WGCjRY7eXc2No13zA

Score
10/10

Malware Config

Extracted

Family

risepro

C2

5.42.65.116:50500

Signatures

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • .NET Reactor proctector 1 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\abed6f09999c18d12d84a49fb67b12cd4a2ca7a79fa365cecd9d955c3364ff5c.exe
    "C:\Users\Admin\AppData\Local\Temp\abed6f09999c18d12d84a49fb67b12cd4a2ca7a79fa365cecd9d955c3364ff5c.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2872
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
        PID:2420

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2420-68-0x0000000000400000-0x0000000000596000-memory.dmp

      Filesize

      1.6MB

    • memory/2420-84-0x0000000000400000-0x0000000000596000-memory.dmp

      Filesize

      1.6MB

    • memory/2420-83-0x0000000000400000-0x0000000000596000-memory.dmp

      Filesize

      1.6MB

    • memory/2420-66-0x0000000000400000-0x0000000000596000-memory.dmp

      Filesize

      1.6MB

    • memory/2872-39-0x0000000000360000-0x0000000000375000-memory.dmp

      Filesize

      84KB

    • memory/2872-69-0x0000000074690000-0x0000000074D7E000-memory.dmp

      Filesize

      6.9MB

    • memory/2872-6-0x0000000000360000-0x0000000000375000-memory.dmp

      Filesize

      84KB

    • memory/2872-21-0x0000000000360000-0x0000000000375000-memory.dmp

      Filesize

      84KB

    • memory/2872-41-0x0000000000360000-0x0000000000375000-memory.dmp

      Filesize

      84KB

    • memory/2872-63-0x0000000000360000-0x0000000000375000-memory.dmp

      Filesize

      84KB

    • memory/2872-61-0x0000000000360000-0x0000000000375000-memory.dmp

      Filesize

      84KB

    • memory/2872-59-0x0000000000360000-0x0000000000375000-memory.dmp

      Filesize

      84KB

    • memory/2872-57-0x0000000000360000-0x0000000000375000-memory.dmp

      Filesize

      84KB

    • memory/2872-55-0x0000000000360000-0x0000000000375000-memory.dmp

      Filesize

      84KB

    • memory/2872-53-0x0000000000360000-0x0000000000375000-memory.dmp

      Filesize

      84KB

    • memory/2872-51-0x0000000000360000-0x0000000000375000-memory.dmp

      Filesize

      84KB

    • memory/2872-49-0x0000000000360000-0x0000000000375000-memory.dmp

      Filesize

      84KB

    • memory/2872-31-0x0000000000360000-0x0000000000375000-memory.dmp

      Filesize

      84KB

    • memory/2872-45-0x0000000000360000-0x0000000000375000-memory.dmp

      Filesize

      84KB

    • memory/2872-43-0x0000000000360000-0x0000000000375000-memory.dmp

      Filesize

      84KB

    • memory/2872-0-0x000000007469E000-0x000000007469F000-memory.dmp

      Filesize

      4KB

    • memory/2872-37-0x0000000000360000-0x0000000000375000-memory.dmp

      Filesize

      84KB

    • memory/2872-2-0x0000000074690000-0x0000000074D7E000-memory.dmp

      Filesize

      6.9MB

    • memory/2872-5-0x0000000000360000-0x000000000037C000-memory.dmp

      Filesize

      112KB

    • memory/2872-47-0x0000000000360000-0x0000000000375000-memory.dmp

      Filesize

      84KB

    • memory/2872-29-0x0000000000360000-0x0000000000375000-memory.dmp

      Filesize

      84KB

    • memory/2872-27-0x0000000000360000-0x0000000000375000-memory.dmp

      Filesize

      84KB

    • memory/2872-25-0x0000000000360000-0x0000000000375000-memory.dmp

      Filesize

      84KB

    • memory/2872-23-0x0000000000360000-0x0000000000375000-memory.dmp

      Filesize

      84KB

    • memory/2872-19-0x0000000000360000-0x0000000000375000-memory.dmp

      Filesize

      84KB

    • memory/2872-17-0x0000000000360000-0x0000000000375000-memory.dmp

      Filesize

      84KB

    • memory/2872-15-0x0000000000360000-0x0000000000375000-memory.dmp

      Filesize

      84KB

    • memory/2872-13-0x0000000000360000-0x0000000000375000-memory.dmp

      Filesize

      84KB

    • memory/2872-11-0x0000000000360000-0x0000000000375000-memory.dmp

      Filesize

      84KB

    • memory/2872-9-0x0000000000360000-0x0000000000375000-memory.dmp

      Filesize

      84KB

    • memory/2872-7-0x0000000000360000-0x0000000000375000-memory.dmp

      Filesize

      84KB

    • memory/2872-65-0x0000000000360000-0x0000000000375000-memory.dmp

      Filesize

      84KB

    • memory/2872-33-0x0000000000360000-0x0000000000375000-memory.dmp

      Filesize

      84KB

    • memory/2872-4-0x0000000006A20000-0x0000000006C4A000-memory.dmp

      Filesize

      2.2MB

    • memory/2872-3-0x0000000005120000-0x0000000005370000-memory.dmp

      Filesize

      2.3MB

    • memory/2872-80-0x0000000074690000-0x0000000074D7E000-memory.dmp

      Filesize

      6.9MB

    • memory/2872-35-0x0000000000360000-0x0000000000375000-memory.dmp

      Filesize

      84KB

    • memory/2872-1-0x0000000000C20000-0x000000000113A000-memory.dmp

      Filesize

      5.1MB