Analysis
- max time kernel
117s - max time network
123s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
07/06/2024, 00:08
General
- Target 69b20d9d674958d4eb4f5894f9b85931c5c748eb18230c4b314ff7953b87a87d.exe
- Size 4.6MB
- Sample240607-aexldafb94
- SHA256 69b20d9d674958d4eb4f5894f9b85931c5c748eb18230c4b314ff7953b87a87d
Malware Config
Extracted
-
risepro
-
5.42.65.116:50500
Signatures
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\69b20d9d674958d4eb4f5894f9b85931c5c748eb18230c4b314ff7953b87a87d.exe"C:\Users\Admin\AppData\Local\Temp\69b20d9d674958d4eb4f5894f9b85931c5c748eb18230c4b314ff7953b87a87d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2092-66-0x0000000074940000-0x000000007502E000-memory.dmp
memory/2092-46-0x00000000004F0000-0x0000000000505000-memory.dmp
memory/2092-43-0x00000000004F0000-0x0000000000505000-memory.dmp
memory/2092-3-0x00000000051E0000-0x0000000005440000-memory.dmp
memory/2092-4-0x0000000006440000-0x0000000006668000-memory.dmp
memory/2092-5-0x00000000004F0000-0x000000000050C000-memory.dmp
memory/2092-17-0x00000000004F0000-0x0000000000505000-memory.dmp
memory/2092-6-0x00000000004F0000-0x0000000000505000-memory.dmp
memory/2092-7-0x00000000004F0000-0x0000000000505000-memory.dmp
memory/2092-9-0x00000000004F0000-0x0000000000505000-memory.dmp
memory/2092-65-0x00000000004F0000-0x0000000000505000-memory.dmp
memory/2092-63-0x00000000004F0000-0x0000000000505000-memory.dmp
memory/2092-61-0x00000000004F0000-0x0000000000505000-memory.dmp
memory/2092-59-0x00000000004F0000-0x0000000000505000-memory.dmp
memory/2092-57-0x00000000004F0000-0x0000000000505000-memory.dmp
memory/2092-55-0x00000000004F0000-0x0000000000505000-memory.dmp
memory/2092-53-0x00000000004F0000-0x0000000000505000-memory.dmp
memory/2092-51-0x00000000004F0000-0x0000000000505000-memory.dmp
memory/2092-49-0x00000000004F0000-0x0000000000505000-memory.dmp
memory/2092-47-0x00000000004F0000-0x0000000000505000-memory.dmp
memory/2092-1-0x0000000001120000-0x00000000015CA000-memory.dmp
memory/2092-0-0x000000007494E000-0x000000007494F000-memory.dmp
memory/2092-2-0x0000000074940000-0x000000007502E000-memory.dmp
memory/2092-41-0x00000000004F0000-0x0000000000505000-memory.dmp
memory/2092-39-0x00000000004F0000-0x0000000000505000-memory.dmp
memory/2092-37-0x00000000004F0000-0x0000000000505000-memory.dmp
memory/2092-36-0x00000000004F0000-0x0000000000505000-memory.dmp
memory/2092-33-0x00000000004F0000-0x0000000000505000-memory.dmp
memory/2092-31-0x00000000004F0000-0x0000000000505000-memory.dmp
memory/2092-29-0x00000000004F0000-0x0000000000505000-memory.dmp
memory/2092-27-0x00000000004F0000-0x0000000000505000-memory.dmp
memory/2092-25-0x00000000004F0000-0x0000000000505000-memory.dmp
memory/2092-23-0x00000000004F0000-0x0000000000505000-memory.dmp
memory/2092-21-0x00000000004F0000-0x0000000000505000-memory.dmp
memory/2092-19-0x00000000004F0000-0x0000000000505000-memory.dmp
memory/2092-15-0x00000000004F0000-0x0000000000505000-memory.dmp
memory/2092-14-0x00000000004F0000-0x0000000000505000-memory.dmp
memory/2092-11-0x00000000004F0000-0x0000000000505000-memory.dmp
memory/2092-79-0x0000000074940000-0x000000007502E000-memory.dmp
memory/2424-69-0x0000000000400000-0x0000000000596000-memory.dmp
memory/2424-80-0x0000000000400000-0x0000000000596000-memory.dmp
memory/2424-68-0x0000000000400000-0x0000000000596000-memory.dmp