Analysis
- max time kernel
195s - max time network
255s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
07/06/2024, 00:07
General
- Target 68f6621724d46e104f5689c82fae6cd7f3b8913aa64cf2297f073abfd0eb68d9.exe
- Size 4.6MB
- Sample240607-aet59aeb2z
- SHA256 68f6621724d46e104f5689c82fae6cd7f3b8913aa64cf2297f073abfd0eb68d9
Malware Config
Extracted
-
risepro
-
5.42.67.8:50500
Signatures
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\68f6621724d46e104f5689c82fae6cd7f3b8913aa64cf2297f073abfd0eb68d9.exe"C:\Users\Admin\AppData\Local\Temp\68f6621724d46e104f5689c82fae6cd7f3b8913aa64cf2297f073abfd0eb68d9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/704-70-0x0000000000400000-0x0000000000596000-memory.dmp
memory/704-74-0x0000000000400000-0x0000000000596000-memory.dmp
memory/704-68-0x0000000000400000-0x0000000000596000-memory.dmp
memory/704-73-0x0000000000400000-0x0000000000596000-memory.dmp
memory/704-69-0x0000000000400000-0x0000000000596000-memory.dmp
memory/2220-53-0x0000000001C30000-0x0000000001C45000-memory.dmp
memory/2220-46-0x0000000001C30000-0x0000000001C45000-memory.dmp
memory/2220-7-0x0000000001C30000-0x0000000001C45000-memory.dmp
memory/2220-20-0x0000000001C30000-0x0000000001C45000-memory.dmp
memory/2220-66-0x0000000001C30000-0x0000000001C45000-memory.dmp
memory/2220-67-0x0000000073D30000-0x000000007441E000-memory.dmp
memory/2220-5-0x00000000070A0000-0x00000000072CA000-memory.dmp
memory/2220-4-0x0000000005D10000-0x0000000005F72000-memory.dmp
memory/2220-3-0x0000000073D30000-0x000000007441E000-memory.dmp
memory/2220-72-0x0000000073D30000-0x000000007441E000-memory.dmp
memory/2220-2-0x0000000005B20000-0x0000000005BBC000-memory.dmp
memory/2220-64-0x0000000001C30000-0x0000000001C45000-memory.dmp
memory/2220-62-0x0000000001C30000-0x0000000001C45000-memory.dmp
memory/2220-60-0x0000000001C30000-0x0000000001C45000-memory.dmp
memory/2220-58-0x0000000001C30000-0x0000000001C45000-memory.dmp
memory/2220-56-0x0000000001C30000-0x0000000001C45000-memory.dmp
memory/2220-54-0x0000000001C30000-0x0000000001C45000-memory.dmp
memory/2220-0-0x0000000073D3E000-0x0000000073D3F000-memory.dmp
memory/2220-49-0x0000000001C30000-0x0000000001C45000-memory.dmp
memory/2220-6-0x0000000001C30000-0x0000000001C4C000-memory.dmp
memory/2220-44-0x0000000001C30000-0x0000000001C45000-memory.dmp
memory/2220-43-0x0000000001C30000-0x0000000001C45000-memory.dmp
memory/2220-40-0x0000000001C30000-0x0000000001C45000-memory.dmp
memory/2220-38-0x0000000001C30000-0x0000000001C45000-memory.dmp
memory/2220-37-0x0000000001C30000-0x0000000001C45000-memory.dmp
memory/2220-35-0x0000000001C30000-0x0000000001C45000-memory.dmp
memory/2220-33-0x0000000001C30000-0x0000000001C45000-memory.dmp
memory/2220-30-0x0000000001C30000-0x0000000001C45000-memory.dmp
memory/2220-28-0x0000000001C30000-0x0000000001C45000-memory.dmp
memory/2220-26-0x0000000001C30000-0x0000000001C45000-memory.dmp
memory/2220-24-0x0000000001C30000-0x0000000001C45000-memory.dmp
memory/2220-22-0x0000000001C30000-0x0000000001C45000-memory.dmp
memory/2220-18-0x0000000001C30000-0x0000000001C45000-memory.dmp
memory/2220-16-0x0000000001C30000-0x0000000001C45000-memory.dmp
memory/2220-14-0x0000000001C30000-0x0000000001C45000-memory.dmp
memory/2220-12-0x0000000001C30000-0x0000000001C45000-memory.dmp
memory/2220-51-0x0000000001C30000-0x0000000001C45000-memory.dmp
memory/2220-10-0x0000000001C30000-0x0000000001C45000-memory.dmp
memory/2220-8-0x0000000001C30000-0x0000000001C45000-memory.dmp
memory/2220-1-0x0000000000DE0000-0x000000000128A000-memory.dmp