Analysis
-
max time kernel
141s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16-06-2024 00:54
Static task
static1
Behavioral task
behavioral1
Sample
60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exe
Resource
win7-20240611-en
General
-
Target
60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exe
-
Size
1.3MB
-
MD5
170639b71e099423644d4c6210b3f366
-
SHA1
dcbbc9708cffbbf0da0f06d8ceeb2619a0ca37f6
-
SHA256
60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193
-
SHA512
d32b3bc58e5f48125922eee378a458851c7b7ddeed86ad2c604d861f23d610457b6594171c171f206dee5223ac5a03c9c9517b43f2bee92b9508b4971680a7a2
-
SSDEEP
24576:PscFvtuIKsMyxsPS+XR+5QIFSfOUaay0Sh9wQcRHW/nSy2KQ77CxZbmNrU5j11NP:b8O9+h+5bSjrA9lcR2/SLT7CxZSg5jTu
Malware Config
Extracted
risepro
147.45.47.126:58709
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
Processes:
60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exepid process 4584 60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exe 4584 60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exe 4584 60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exe 4584 60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exe 4584 60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exe 4584 60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exe 4584 60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exe 4584 60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exe 4584 60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exe 4584 60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exe 4584 60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exe 4584 60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exe 4584 60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exe 4584 60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exepid process 4584 60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exe"C:\Users\Admin\AppData\Local\Temp\60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:4584
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4584-0-0x0000000000330000-0x0000000000862000-memory.dmpFilesize
5.2MB
-
memory/4584-1-0x00000000007C4000-0x0000000000862000-memory.dmpFilesize
632KB
-
memory/4584-3-0x0000000000330000-0x0000000000862000-memory.dmpFilesize
5.2MB
-
memory/4584-4-0x0000000000330000-0x0000000000862000-memory.dmpFilesize
5.2MB
-
memory/4584-5-0x0000000000330000-0x0000000000862000-memory.dmpFilesize
5.2MB
-
memory/4584-6-0x0000000000330000-0x0000000000862000-memory.dmpFilesize
5.2MB
-
memory/4584-7-0x0000000000330000-0x0000000000862000-memory.dmpFilesize
5.2MB
-
memory/4584-8-0x0000000000330000-0x0000000000862000-memory.dmpFilesize
5.2MB
-
memory/4584-9-0x0000000000330000-0x0000000000862000-memory.dmpFilesize
5.2MB
-
memory/4584-10-0x0000000000330000-0x0000000000862000-memory.dmpFilesize
5.2MB
-
memory/4584-11-0x0000000000330000-0x0000000000862000-memory.dmpFilesize
5.2MB
-
memory/4584-12-0x0000000000330000-0x0000000000862000-memory.dmpFilesize
5.2MB
-
memory/4584-13-0x0000000000330000-0x0000000000862000-memory.dmpFilesize
5.2MB
-
memory/4584-14-0x0000000000330000-0x0000000000862000-memory.dmpFilesize
5.2MB
-
memory/4584-15-0x0000000000330000-0x0000000000862000-memory.dmpFilesize
5.2MB
-
memory/4584-16-0x0000000000330000-0x0000000000862000-memory.dmpFilesize
5.2MB
-
memory/4584-17-0x0000000000330000-0x0000000000862000-memory.dmpFilesize
5.2MB