Analysis
- max time kernel
117s - max time network
123s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
07/06/2024, 00:07
General
- Target 66fe515b72f67f47ec945b4428034dd9522e2d7dbb8a3ee3db391aeec3ca31d9.exe
- Size 5.1MB
- Sample240607-aek8caeb2w
- SHA256 66fe515b72f67f47ec945b4428034dd9522e2d7dbb8a3ee3db391aeec3ca31d9
Malware Config
Extracted
-
risepro
-
5.42.65.116:50500
Signatures
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\66fe515b72f67f47ec945b4428034dd9522e2d7dbb8a3ee3db391aeec3ca31d9.exe"C:\Users\Admin\AppData\Local\Temp\66fe515b72f67f47ec945b4428034dd9522e2d7dbb8a3ee3db391aeec3ca31d9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1688-43-0x00000000006C0000-0x00000000006D5000-memory.dmp
memory/1688-39-0x00000000006C0000-0x00000000006D5000-memory.dmp
memory/1688-2-0x0000000074AB0000-0x000000007519E000-memory.dmp
memory/1688-3-0x0000000005270000-0x00000000054C0000-memory.dmp
memory/1688-4-0x00000000067A0000-0x00000000069CA000-memory.dmp
memory/1688-5-0x00000000006C0000-0x00000000006DC000-memory.dmp
memory/1688-9-0x00000000006C0000-0x00000000006D5000-memory.dmp
memory/1688-6-0x00000000006C0000-0x00000000006D5000-memory.dmp
memory/1688-7-0x00000000006C0000-0x00000000006D5000-memory.dmp
memory/1688-63-0x00000000006C0000-0x00000000006D5000-memory.dmp
memory/1688-13-0x00000000006C0000-0x00000000006D5000-memory.dmp
memory/1688-51-0x00000000006C0000-0x00000000006D5000-memory.dmp
memory/1688-59-0x00000000006C0000-0x00000000006D5000-memory.dmp
memory/1688-66-0x0000000074AB0000-0x000000007519E000-memory.dmp
memory/1688-57-0x00000000006C0000-0x00000000006D5000-memory.dmp
memory/1688-56-0x00000000006C0000-0x00000000006D5000-memory.dmp
memory/1688-53-0x00000000006C0000-0x00000000006D5000-memory.dmp
memory/1688-42-0x00000000006C0000-0x00000000006D5000-memory.dmp
memory/1688-47-0x00000000006C0000-0x00000000006D5000-memory.dmp
memory/1688-45-0x00000000006C0000-0x00000000006D5000-memory.dmp
memory/1688-1-0x00000000013D0000-0x00000000018E4000-memory.dmp
memory/1688-0-0x0000000074ABE000-0x0000000074ABF000-memory.dmp
memory/1688-50-0x00000000006C0000-0x00000000006D5000-memory.dmp
memory/1688-38-0x00000000006C0000-0x00000000006D5000-memory.dmp
memory/1688-35-0x00000000006C0000-0x00000000006D5000-memory.dmp
memory/1688-33-0x00000000006C0000-0x00000000006D5000-memory.dmp
memory/1688-31-0x00000000006C0000-0x00000000006D5000-memory.dmp
memory/1688-29-0x00000000006C0000-0x00000000006D5000-memory.dmp
memory/1688-27-0x00000000006C0000-0x00000000006D5000-memory.dmp
memory/1688-25-0x00000000006C0000-0x00000000006D5000-memory.dmp
memory/1688-23-0x00000000006C0000-0x00000000006D5000-memory.dmp
memory/1688-21-0x00000000006C0000-0x00000000006D5000-memory.dmp
memory/1688-19-0x00000000006C0000-0x00000000006D5000-memory.dmp
memory/1688-17-0x00000000006C0000-0x00000000006D5000-memory.dmp
memory/1688-15-0x00000000006C0000-0x00000000006D5000-memory.dmp
memory/1688-11-0x00000000006C0000-0x00000000006D5000-memory.dmp
memory/1688-65-0x00000000006C0000-0x00000000006D5000-memory.dmp
memory/1688-61-0x00000000006C0000-0x00000000006D5000-memory.dmp
memory/1688-80-0x0000000074AB0000-0x000000007519E000-memory.dmp
memory/2524-69-0x0000000000400000-0x0000000000596000-memory.dmp
memory/2524-67-0x0000000000400000-0x0000000000596000-memory.dmp
memory/2524-83-0x0000000000400000-0x0000000000596000-memory.dmp
memory/2524-84-0x0000000000400000-0x0000000000596000-memory.dmp