Analysis
- max time kernel
147s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20240426-en - resource tags
- submitted
07/06/2024, 03:31
General
- Target 56646177e745d0aee40964b14fe96328ba2c9717d005b13e95846e14cf6e775d.exe
- Size 2.3MB
- Sample240607-d3g3daha4s
- SHA256 56646177e745d0aee40964b14fe96328ba2c9717d005b13e95846e14cf6e775d
Malware Config
Extracted
-
risepro
-
147.45.47.126:58709
Signatures
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\56646177e745d0aee40964b14fe96328ba2c9717d005b13e95846e14cf6e775d.exe"C:\Users\Admin\AppData\Local\Temp\56646177e745d0aee40964b14fe96328ba2c9717d005b13e95846e14cf6e775d.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2892-0-0x0000000000CC0000-0x0000000001292000-memory.dmp
memory/2892-1-0x0000000077766000-0x0000000077768000-memory.dmp
memory/2892-2-0x0000000005790000-0x0000000005791000-memory.dmp
memory/2892-4-0x00000000057C0000-0x00000000057C1000-memory.dmp
memory/2892-11-0x00000000057E0000-0x00000000057E1000-memory.dmp
memory/2892-10-0x0000000005780000-0x0000000005781000-memory.dmp
memory/2892-9-0x00000000057F0000-0x00000000057F1000-memory.dmp
memory/2892-8-0x00000000057D0000-0x00000000057D1000-memory.dmp
memory/2892-7-0x00000000057A0000-0x00000000057A1000-memory.dmp
memory/2892-6-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2892-5-0x0000000005750000-0x0000000005751000-memory.dmp
memory/2892-3-0x0000000005760000-0x0000000005761000-memory.dmp
memory/2892-12-0x0000000005810000-0x0000000005812000-memory.dmp
memory/2892-13-0x0000000000CC0000-0x0000000001292000-memory.dmp
memory/2892-14-0x0000000000CC0000-0x0000000001292000-memory.dmp
memory/2892-15-0x0000000000CC0000-0x0000000001292000-memory.dmp
memory/2892-16-0x0000000000CC0000-0x0000000001292000-memory.dmp
memory/2892-17-0x0000000000CC0000-0x0000000001292000-memory.dmp
memory/2892-18-0x0000000000CC0000-0x0000000001292000-memory.dmp
memory/2892-19-0x0000000000CC0000-0x0000000001292000-memory.dmp
memory/2892-20-0x0000000000CC0000-0x0000000001292000-memory.dmp
memory/2892-21-0x0000000000CC0000-0x0000000001292000-memory.dmp
memory/2892-22-0x0000000000CC0000-0x0000000001292000-memory.dmp
memory/2892-23-0x0000000000CC0000-0x0000000001292000-memory.dmp
memory/2892-24-0x0000000000CC0000-0x0000000001292000-memory.dmp
memory/2892-25-0x0000000000CC0000-0x0000000001292000-memory.dmp
memory/2892-26-0x0000000000CC0000-0x0000000001292000-memory.dmp
memory/2892-27-0x0000000000CC0000-0x0000000001292000-memory.dmp