risepro | 6b006b6d6efa3dd15b6c1bfdda117ea3b8da58b6bc78470b5991ef130f0c5302

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 06:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6b006b6d6efa3dd15b6c1bfdda117ea3b8da58b6bc78470b5991ef130f0c5302.exe
Size 9.7MB
Sample240612-gs2wkssepc
SHA256 6b006b6d6efa3dd15b6c1bfdda117ea3b8da58b6bc78470b5991ef130f0c5302
MD5 4f0575a90391c5108252e93327e9243f
SHA1 707aabb7d8d9d7db6442a305e3b013272d1c57e8
SHA512 44faa4e0fecfd5fd5e6c6420027c973e794d92b216b5249936e08eb3369a123ee76963e2f6d86a19713e8e1a1bad5abd8acf7a97755f974e90f827be7d1c68a6
SSDEEP 196608:HZ1nyiyEdqy5y5KgqIjieAtBT5etD61Byat+7z9YYdvYEjFhL86NqeHQ07mKaqVW:HHDq5KgqIjipd5ID61BXgFzimC6N5wRV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

risepro stealer

Malware Config

Signatures

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
4972	6b006b6d6efa3dd15b6c1bfdda117ea3b8da58b6bc78470b5991ef130f0c5302.exe
4972	6b006b6d6efa3dd15b6c1bfdda117ea3b8da58b6bc78470b5991ef130f0c5302.exe
4972	6b006b6d6efa3dd15b6c1bfdda117ea3b8da58b6bc78470b5991ef130f0c5302.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	6b006b6d6efa3dd15b6c1bfdda117ea3b8da58b6bc78470b5991ef130f0c5302.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	6b006b6d6efa3dd15b6c1bfdda117ea3b8da58b6bc78470b5991ef130f0c5302.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	6b006b6d6efa3dd15b6c1bfdda117ea3b8da58b6bc78470b5991ef130f0c5302.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	6b006b6d6efa3dd15b6c1bfdda117ea3b8da58b6bc78470b5991ef130f0c5302.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	6b006b6d6efa3dd15b6c1bfdda117ea3b8da58b6bc78470b5991ef130f0c5302.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4972	6b006b6d6efa3dd15b6c1bfdda117ea3b8da58b6bc78470b5991ef130f0c5302.exe
4972	6b006b6d6efa3dd15b6c1bfdda117ea3b8da58b6bc78470b5991ef130f0c5302.exe
4972	6b006b6d6efa3dd15b6c1bfdda117ea3b8da58b6bc78470b5991ef130f0c5302.exe
4972	6b006b6d6efa3dd15b6c1bfdda117ea3b8da58b6bc78470b5991ef130f0c5302.exe

C:\Users\Admin\AppData\Local\Temp\6b006b6d6efa3dd15b6c1bfdda117ea3b8da58b6bc78470b5991ef130f0c5302.exe
"C:\Users\Admin\AppData\Local\Temp\6b006b6d6efa3dd15b6c1bfdda117ea3b8da58b6bc78470b5991ef130f0c5302.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:4972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3920,i,1067197275908310731,12785105794523264014,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:8
1⤵
PID:1456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6b006b6d6efa3dd15b6c1bfdda117ea3b8da58b6bc78470b5991ef130f0c5302.exe.trace.log

Path C:\Users\Admin\AppData\Local\Temp\6b006b6d6efa3dd15b6c1bfdda117ea3b8da58b6bc78470b5991ef130f0c5302.exe.trace.log
Size 1KB
SHA256 17344651be31d6c059baf0225ad569c47739fef3a6ec6d7cde4b1506fbd536b4
MD5 633a6f36d79deed52312fb5088700308
SHA1 baafca27074f3c207df393370538fa6bcb8e1e56
SHA512 e3693a00fa2c89052b42cb0553a1399adbe133fb117681bdd10b33be40b8966d5ec6a74dd69ea6eface32e257a28db5807308526e9f4b3cf6236d68586d4ddc5
MD5 SHA1 SHA512

Submit Download

6b006b6d6efa3dd15b6c1bfdda117ea3b8da58b6bc78470b5991ef130f0c5302.exe.trace.log

Path C:\Users\Admin\AppData\Local\Temp\6b006b6d6efa3dd15b6c1bfdda117ea3b8da58b6bc78470b5991ef130f0c5302.exe.trace.log
Size 6KB
SHA256 2eb1f89d0e2c883fad10873f81927365b9f808119c46ca8eed9addff66e5dbf2
MD5 51aed43264b19f3e00817c18e7efbcd1
SHA1 5e0a9298a86fd59544724549bb0afe598d7542ba
SHA512 a1c2ecfea6fa80d1c1da39fbfca1b4c0a19cae9f2e114275d2bf89ffee6c8f6c58b81de1e278d00afbdd412903b4884e14d64c62e4f70289b20de3db5345db53
SSDEEP 96:U07MJxYR5R+s3LQoUKNXC106FUOVHOzK8L9J8L0oR0aop:UdJCR5R37QoUKNXC106JVHMa0omp
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4972-0-0x0000000000D95000-0x0000000001260000-memory.dmp

Download

memory/4972-3-0x0000000000400000-0x0000000001C13000-memory.dmp

Download

memory/4972-2-0x0000000001D90000-0x0000000001D91000-memory.dmp

Download

memory/4972-1-0x0000000001D80000-0x0000000001D81000-memory.dmp

Download

memory/4972-4-0x0000000000400000-0x0000000001C13000-memory.dmp

Download

memory/4972-79-0x0000000000D95000-0x0000000001260000-memory.dmp

Download

memory/4972-80-0x0000000000400000-0x0000000001C13000-memory.dmp

Download