Analysis
- max time kernel
193s - max time network
297s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
07/06/2024, 00:08
General
- Target 69b20d9d674958d4eb4f5894f9b85931c5c748eb18230c4b314ff7953b87a87d.exe
- Size 4.6MB
- Sample240607-aexldafb94
- SHA256 69b20d9d674958d4eb4f5894f9b85931c5c748eb18230c4b314ff7953b87a87d
Malware Config
Extracted
-
risepro
-
5.42.65.116:50500
Signatures
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\69b20d9d674958d4eb4f5894f9b85931c5c748eb18230c4b314ff7953b87a87d.exe"C:\Users\Admin\AppData\Local\Temp\69b20d9d674958d4eb4f5894f9b85931c5c748eb18230c4b314ff7953b87a87d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/424-24-0x0000000001D10000-0x0000000001D25000-memory.dmp
memory/424-30-0x0000000001D10000-0x0000000001D25000-memory.dmp
memory/424-2-0x0000000005D60000-0x0000000005DFC000-memory.dmp
memory/424-3-0x00000000738A0000-0x0000000073F8E000-memory.dmp
memory/424-4-0x0000000005F00000-0x0000000006160000-memory.dmp
memory/424-5-0x0000000007290000-0x00000000074B8000-memory.dmp
memory/424-6-0x0000000001D10000-0x0000000001D2C000-memory.dmp
memory/424-26-0x0000000001D10000-0x0000000001D25000-memory.dmp
memory/424-66-0x0000000001D10000-0x0000000001D25000-memory.dmp
memory/424-7-0x0000000001D10000-0x0000000001D25000-memory.dmp
memory/424-8-0x0000000001D10000-0x0000000001D25000-memory.dmp
memory/424-22-0x0000000001D10000-0x0000000001D25000-memory.dmp
memory/424-64-0x0000000001D10000-0x0000000001D25000-memory.dmp
memory/424-62-0x0000000001D10000-0x0000000001D25000-memory.dmp
memory/424-61-0x0000000001D10000-0x0000000001D25000-memory.dmp
memory/424-58-0x0000000001D10000-0x0000000001D25000-memory.dmp
memory/424-71-0x00000000738A0000-0x0000000073F8E000-memory.dmp
memory/424-10-0x0000000001D10000-0x0000000001D25000-memory.dmp
memory/424-57-0x0000000001D10000-0x0000000001D25000-memory.dmp
memory/424-54-0x0000000001D10000-0x0000000001D25000-memory.dmp
memory/424-48-0x0000000001D10000-0x0000000001D25000-memory.dmp
memory/424-1-0x0000000000FD0000-0x000000000147A000-memory.dmp
memory/424-51-0x0000000001D10000-0x0000000001D25000-memory.dmp
memory/424-46-0x0000000001D10000-0x0000000001D25000-memory.dmp
memory/424-44-0x0000000001D10000-0x0000000001D25000-memory.dmp
memory/424-42-0x0000000001D10000-0x0000000001D25000-memory.dmp
memory/424-40-0x0000000001D10000-0x0000000001D25000-memory.dmp
memory/424-38-0x0000000001D10000-0x0000000001D25000-memory.dmp
memory/424-36-0x0000000001D10000-0x0000000001D25000-memory.dmp
memory/424-34-0x0000000001D10000-0x0000000001D25000-memory.dmp
memory/424-32-0x0000000001D10000-0x0000000001D25000-memory.dmp
memory/424-52-0x0000000001D10000-0x0000000001D25000-memory.dmp
memory/424-28-0x0000000001D10000-0x0000000001D25000-memory.dmp
memory/424-0-0x00000000738AE000-0x00000000738AF000-memory.dmp
memory/424-21-0x0000000001D10000-0x0000000001D25000-memory.dmp
memory/424-18-0x0000000001D10000-0x0000000001D25000-memory.dmp
memory/424-16-0x0000000001D10000-0x0000000001D25000-memory.dmp
memory/424-14-0x0000000001D10000-0x0000000001D25000-memory.dmp
memory/424-12-0x0000000001D10000-0x0000000001D25000-memory.dmp
memory/4856-72-0x0000000000400000-0x0000000000596000-memory.dmp
memory/4856-67-0x0000000000400000-0x0000000000596000-memory.dmp
memory/4856-68-0x0000000000400000-0x0000000000596000-memory.dmp
memory/4856-69-0x0000000000400000-0x0000000000596000-memory.dmp
memory/4856-73-0x0000000000400000-0x0000000000596000-memory.dmp