Analysis

  • max time kernel
    146s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    16-06-2024 09:13

General

  • Target

    84be276c85bc5dd7555aed0b3b7ae2cde2292a4b9d2d0078e1f8e5ea7d79b709.exe

  • Size

    1.3MB

  • MD5

    7a4c36e4ffe127c1154bf248d7bc83ca

  • SHA1

    c47ef07e0aae59c1d6147ab53b085bc3768607e6

  • SHA256

    84be276c85bc5dd7555aed0b3b7ae2cde2292a4b9d2d0078e1f8e5ea7d79b709

  • SHA512

    799e1d0f498a09d4c6d9101af64366dfbfef3546305e304c2150c404e45f905e6664b3494154677dd46c09876dfb1e9459c904eb989a58e05ae86a4e84064a7d

  • SSDEEP

    24576:XumsuZybQ6ctRHqUdGnF88owNturwQtBaWnBCq8tcLX8BNWG:XumJZytctAUuZoUtKltBaWnt8iLs5

Score
10/10

Malware Config

Extracted

Family

risepro

C2

147.45.47.126:58709

Signatures

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\84be276c85bc5dd7555aed0b3b7ae2cde2292a4b9d2d0078e1f8e5ea7d79b709.exe
    "C:\Users\Admin\AppData\Local\Temp\84be276c85bc5dd7555aed0b3b7ae2cde2292a4b9d2d0078e1f8e5ea7d79b709.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetWindowsHookEx
    PID:1232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1232-0-0x0000000000050000-0x0000000000582000-memory.dmp
    Filesize

    5.2MB

  • memory/1232-2-0x00000000004E4000-0x0000000000582000-memory.dmp
    Filesize

    632KB

  • memory/1232-1-0x0000000000050000-0x0000000000582000-memory.dmp
    Filesize

    5.2MB

  • memory/1232-4-0x0000000000050000-0x0000000000582000-memory.dmp
    Filesize

    5.2MB

  • memory/1232-5-0x0000000000050000-0x0000000000582000-memory.dmp
    Filesize

    5.2MB

  • memory/1232-6-0x0000000000050000-0x0000000000582000-memory.dmp
    Filesize

    5.2MB

  • memory/1232-7-0x0000000000050000-0x0000000000582000-memory.dmp
    Filesize

    5.2MB

  • memory/1232-8-0x0000000000050000-0x0000000000582000-memory.dmp
    Filesize

    5.2MB

  • memory/1232-9-0x0000000000050000-0x0000000000582000-memory.dmp
    Filesize

    5.2MB

  • memory/1232-10-0x0000000000050000-0x0000000000582000-memory.dmp
    Filesize

    5.2MB

  • memory/1232-11-0x0000000000050000-0x0000000000582000-memory.dmp
    Filesize

    5.2MB

  • memory/1232-12-0x0000000000050000-0x0000000000582000-memory.dmp
    Filesize

    5.2MB

  • memory/1232-13-0x0000000000050000-0x0000000000582000-memory.dmp
    Filesize

    5.2MB

  • memory/1232-14-0x0000000000050000-0x0000000000582000-memory.dmp
    Filesize

    5.2MB

  • memory/1232-15-0x0000000000050000-0x0000000000582000-memory.dmp
    Filesize

    5.2MB

  • memory/1232-16-0x0000000000050000-0x0000000000582000-memory.dmp
    Filesize

    5.2MB

  • memory/1232-17-0x0000000000050000-0x0000000000582000-memory.dmp
    Filesize

    5.2MB

  • memory/1232-18-0x0000000000050000-0x0000000000582000-memory.dmp
    Filesize

    5.2MB