Analysis
- max time kernel
248s - max time network
298s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
06/06/2024, 23:06
General
- Target 2df2ff176196ec4fa48618db8bab360be69405ac1da1a0cd8ce3db77390312ca.exe
- Size 4.6MB
- Sample240606-23s2msdc9s
- SHA256 2df2ff176196ec4fa48618db8bab360be69405ac1da1a0cd8ce3db77390312ca
Malware Config
Extracted
-
risepro
-
5.42.65.116:50500
Signatures
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 19 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2df2ff176196ec4fa48618db8bab360be69405ac1da1a0cd8ce3db77390312ca.exe"C:\Users\Admin\AppData\Local\Temp\2df2ff176196ec4fa48618db8bab360be69405ac1da1a0cd8ce3db77390312ca.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4676-22-0x00000000014F0000-0x0000000001505000-memory.dmp
memory/4676-18-0x00000000014F0000-0x0000000001505000-memory.dmp
memory/4676-2-0x00000000054F0000-0x000000000558C000-memory.dmp
memory/4676-3-0x00000000736F0000-0x0000000073DDE000-memory.dmp
memory/4676-4-0x00000000056F0000-0x0000000005952000-memory.dmp
memory/4676-5-0x0000000006A80000-0x0000000006CA8000-memory.dmp
memory/4676-6-0x00000000014F0000-0x000000000150C000-memory.dmp
memory/4676-66-0x00000000014F0000-0x0000000001505000-memory.dmp
memory/4676-73-0x00000000736F0000-0x0000000073DDE000-memory.dmp
memory/4676-7-0x00000000014F0000-0x0000000001505000-memory.dmp
memory/4676-8-0x00000000014F0000-0x0000000001505000-memory.dmp
memory/4676-10-0x00000000014F0000-0x0000000001505000-memory.dmp
memory/4676-12-0x00000000014F0000-0x0000000001505000-memory.dmp
memory/4676-44-0x00000000014F0000-0x0000000001505000-memory.dmp
memory/4676-64-0x00000000014F0000-0x0000000001505000-memory.dmp
memory/4676-46-0x00000000014F0000-0x0000000001505000-memory.dmp
memory/4676-60-0x00000000014F0000-0x0000000001505000-memory.dmp
memory/4676-58-0x00000000014F0000-0x0000000001505000-memory.dmp
memory/4676-56-0x00000000014F0000-0x0000000001505000-memory.dmp
memory/4676-54-0x00000000014F0000-0x0000000001505000-memory.dmp
memory/4676-52-0x00000000014F0000-0x0000000001505000-memory.dmp
memory/4676-50-0x00000000014F0000-0x0000000001505000-memory.dmp
memory/4676-1-0x0000000000720000-0x0000000000BC4000-memory.dmp
memory/4676-62-0x00000000014F0000-0x0000000001505000-memory.dmp
memory/4676-67-0x00000000736F0000-0x0000000073DDE000-memory.dmp
memory/4676-42-0x00000000014F0000-0x0000000001505000-memory.dmp
memory/4676-40-0x00000000014F0000-0x0000000001505000-memory.dmp
memory/4676-38-0x00000000014F0000-0x0000000001505000-memory.dmp
memory/4676-35-0x00000000014F0000-0x0000000001505000-memory.dmp
memory/4676-31-0x00000000014F0000-0x0000000001505000-memory.dmp
memory/4676-28-0x00000000014F0000-0x0000000001505000-memory.dmp
memory/4676-26-0x00000000014F0000-0x0000000001505000-memory.dmp
memory/4676-24-0x00000000014F0000-0x0000000001505000-memory.dmp
memory/4676-0-0x00000000736FE000-0x00000000736FF000-memory.dmp
memory/4676-48-0x00000000014F0000-0x0000000001505000-memory.dmp
memory/4676-14-0x00000000014F0000-0x0000000001505000-memory.dmp
memory/4676-36-0x00000000014F0000-0x0000000001505000-memory.dmp
memory/4676-32-0x00000000014F0000-0x0000000001505000-memory.dmp
memory/4676-20-0x00000000014F0000-0x0000000001505000-memory.dmp
memory/4676-16-0x00000000014F0000-0x0000000001505000-memory.dmp
memory/4956-68-0x0000000000400000-0x0000000000596000-memory.dmp
memory/4956-69-0x0000000000400000-0x0000000000596000-memory.dmp
memory/4956-70-0x0000000000400000-0x0000000000596000-memory.dmp
memory/4956-72-0x0000000000400000-0x0000000000596000-memory.dmp
memory/4956-74-0x0000000000400000-0x0000000000596000-memory.dmp