Analysis
- max time kernel
195s - max time network
300s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
07/06/2024, 00:07
General
- Target 66fe515b72f67f47ec945b4428034dd9522e2d7dbb8a3ee3db391aeec3ca31d9.exe
- Size 5.1MB
- Sample240607-aek8caeb2w
- SHA256 66fe515b72f67f47ec945b4428034dd9522e2d7dbb8a3ee3db391aeec3ca31d9
Malware Config
Signatures
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\66fe515b72f67f47ec945b4428034dd9522e2d7dbb8a3ee3db391aeec3ca31d9.exe"C:\Users\Admin\AppData\Local\Temp\66fe515b72f67f47ec945b4428034dd9522e2d7dbb8a3ee3db391aeec3ca31d9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3380-30-0x00000000029D0000-0x00000000029E5000-memory.dmp
memory/3380-49-0x00000000029D0000-0x00000000029E5000-memory.dmp
memory/3380-46-0x00000000029D0000-0x00000000029E5000-memory.dmp
memory/3380-3-0x00000000737D0000-0x0000000073EBE000-memory.dmp
memory/3380-4-0x0000000005370000-0x00000000055C0000-memory.dmp
memory/3380-5-0x00000000066F0000-0x000000000691A000-memory.dmp
memory/3380-6-0x00000000029D0000-0x00000000029EC000-memory.dmp
memory/3380-14-0x00000000029D0000-0x00000000029E5000-memory.dmp
memory/3380-66-0x00000000029D0000-0x00000000029E5000-memory.dmp
memory/3380-64-0x00000000029D0000-0x00000000029E5000-memory.dmp
memory/3380-7-0x00000000029D0000-0x00000000029E5000-memory.dmp
memory/3380-73-0x00000000737D0000-0x0000000073EBE000-memory.dmp
memory/3380-8-0x00000000029D0000-0x00000000029E5000-memory.dmp
memory/3380-10-0x00000000029D0000-0x00000000029E5000-memory.dmp
memory/3380-62-0x00000000029D0000-0x00000000029E5000-memory.dmp
memory/3380-61-0x00000000029D0000-0x00000000029E5000-memory.dmp
memory/3380-58-0x00000000029D0000-0x00000000029E5000-memory.dmp
memory/3380-56-0x00000000029D0000-0x00000000029E5000-memory.dmp
memory/3380-54-0x00000000029D0000-0x00000000029E5000-memory.dmp
memory/3380-52-0x00000000029D0000-0x00000000029E5000-memory.dmp
memory/3380-1-0x0000000000370000-0x0000000000884000-memory.dmp
memory/3380-50-0x00000000029D0000-0x00000000029E5000-memory.dmp
memory/3380-2-0x0000000005140000-0x00000000051DC000-memory.dmp
memory/3380-44-0x00000000029D0000-0x00000000029E5000-memory.dmp
memory/3380-42-0x00000000029D0000-0x00000000029E5000-memory.dmp
memory/3380-40-0x00000000029D0000-0x00000000029E5000-memory.dmp
memory/3380-38-0x00000000029D0000-0x00000000029E5000-memory.dmp
memory/3380-36-0x00000000029D0000-0x00000000029E5000-memory.dmp
memory/3380-34-0x00000000029D0000-0x00000000029E5000-memory.dmp
memory/3380-32-0x00000000029D0000-0x00000000029E5000-memory.dmp
memory/3380-0-0x00000000737DE000-0x00000000737DF000-memory.dmp
memory/3380-29-0x00000000029D0000-0x00000000029E5000-memory.dmp
memory/3380-26-0x00000000029D0000-0x00000000029E5000-memory.dmp
memory/3380-25-0x00000000029D0000-0x00000000029E5000-memory.dmp
memory/3380-22-0x00000000029D0000-0x00000000029E5000-memory.dmp
memory/3380-20-0x00000000029D0000-0x00000000029E5000-memory.dmp
memory/3380-18-0x00000000029D0000-0x00000000029E5000-memory.dmp
memory/3380-16-0x00000000029D0000-0x00000000029E5000-memory.dmp
memory/3380-12-0x00000000029D0000-0x00000000029E5000-memory.dmp
memory/3888-67-0x0000000000400000-0x0000000000596000-memory.dmp
memory/3888-71-0x0000000000400000-0x0000000000596000-memory.dmp
memory/3888-69-0x0000000000400000-0x0000000000596000-memory.dmp