Analysis
-
max time kernel
146s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16-06-2024 09:13
Static task
static1
Behavioral task
behavioral1
Sample
84be276c85bc5dd7555aed0b3b7ae2cde2292a4b9d2d0078e1f8e5ea7d79b709.exe
Resource
win7-20240508-en
General
-
Target
84be276c85bc5dd7555aed0b3b7ae2cde2292a4b9d2d0078e1f8e5ea7d79b709.exe
-
Size
1.3MB
-
MD5
7a4c36e4ffe127c1154bf248d7bc83ca
-
SHA1
c47ef07e0aae59c1d6147ab53b085bc3768607e6
-
SHA256
84be276c85bc5dd7555aed0b3b7ae2cde2292a4b9d2d0078e1f8e5ea7d79b709
-
SHA512
799e1d0f498a09d4c6d9101af64366dfbfef3546305e304c2150c404e45f905e6664b3494154677dd46c09876dfb1e9459c904eb989a58e05ae86a4e84064a7d
-
SSDEEP
24576:XumsuZybQ6ctRHqUdGnF88owNturwQtBaWnBCq8tcLX8BNWG:XumJZytctAUuZoUtKltBaWnt8iLs5
Malware Config
Extracted
risepro
147.45.47.126:58709
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
Processes:
84be276c85bc5dd7555aed0b3b7ae2cde2292a4b9d2d0078e1f8e5ea7d79b709.exepid process 1232 84be276c85bc5dd7555aed0b3b7ae2cde2292a4b9d2d0078e1f8e5ea7d79b709.exe 1232 84be276c85bc5dd7555aed0b3b7ae2cde2292a4b9d2d0078e1f8e5ea7d79b709.exe 1232 84be276c85bc5dd7555aed0b3b7ae2cde2292a4b9d2d0078e1f8e5ea7d79b709.exe 1232 84be276c85bc5dd7555aed0b3b7ae2cde2292a4b9d2d0078e1f8e5ea7d79b709.exe 1232 84be276c85bc5dd7555aed0b3b7ae2cde2292a4b9d2d0078e1f8e5ea7d79b709.exe 1232 84be276c85bc5dd7555aed0b3b7ae2cde2292a4b9d2d0078e1f8e5ea7d79b709.exe 1232 84be276c85bc5dd7555aed0b3b7ae2cde2292a4b9d2d0078e1f8e5ea7d79b709.exe 1232 84be276c85bc5dd7555aed0b3b7ae2cde2292a4b9d2d0078e1f8e5ea7d79b709.exe 1232 84be276c85bc5dd7555aed0b3b7ae2cde2292a4b9d2d0078e1f8e5ea7d79b709.exe 1232 84be276c85bc5dd7555aed0b3b7ae2cde2292a4b9d2d0078e1f8e5ea7d79b709.exe 1232 84be276c85bc5dd7555aed0b3b7ae2cde2292a4b9d2d0078e1f8e5ea7d79b709.exe 1232 84be276c85bc5dd7555aed0b3b7ae2cde2292a4b9d2d0078e1f8e5ea7d79b709.exe 1232 84be276c85bc5dd7555aed0b3b7ae2cde2292a4b9d2d0078e1f8e5ea7d79b709.exe 1232 84be276c85bc5dd7555aed0b3b7ae2cde2292a4b9d2d0078e1f8e5ea7d79b709.exe 1232 84be276c85bc5dd7555aed0b3b7ae2cde2292a4b9d2d0078e1f8e5ea7d79b709.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
84be276c85bc5dd7555aed0b3b7ae2cde2292a4b9d2d0078e1f8e5ea7d79b709.exepid process 1232 84be276c85bc5dd7555aed0b3b7ae2cde2292a4b9d2d0078e1f8e5ea7d79b709.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\84be276c85bc5dd7555aed0b3b7ae2cde2292a4b9d2d0078e1f8e5ea7d79b709.exe"C:\Users\Admin\AppData\Local\Temp\84be276c85bc5dd7555aed0b3b7ae2cde2292a4b9d2d0078e1f8e5ea7d79b709.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:1232
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1232-0-0x0000000000050000-0x0000000000582000-memory.dmpFilesize
5.2MB
-
memory/1232-2-0x00000000004E4000-0x0000000000582000-memory.dmpFilesize
632KB
-
memory/1232-1-0x0000000000050000-0x0000000000582000-memory.dmpFilesize
5.2MB
-
memory/1232-4-0x0000000000050000-0x0000000000582000-memory.dmpFilesize
5.2MB
-
memory/1232-5-0x0000000000050000-0x0000000000582000-memory.dmpFilesize
5.2MB
-
memory/1232-6-0x0000000000050000-0x0000000000582000-memory.dmpFilesize
5.2MB
-
memory/1232-7-0x0000000000050000-0x0000000000582000-memory.dmpFilesize
5.2MB
-
memory/1232-8-0x0000000000050000-0x0000000000582000-memory.dmpFilesize
5.2MB
-
memory/1232-9-0x0000000000050000-0x0000000000582000-memory.dmpFilesize
5.2MB
-
memory/1232-10-0x0000000000050000-0x0000000000582000-memory.dmpFilesize
5.2MB
-
memory/1232-11-0x0000000000050000-0x0000000000582000-memory.dmpFilesize
5.2MB
-
memory/1232-12-0x0000000000050000-0x0000000000582000-memory.dmpFilesize
5.2MB
-
memory/1232-13-0x0000000000050000-0x0000000000582000-memory.dmpFilesize
5.2MB
-
memory/1232-14-0x0000000000050000-0x0000000000582000-memory.dmpFilesize
5.2MB
-
memory/1232-15-0x0000000000050000-0x0000000000582000-memory.dmpFilesize
5.2MB
-
memory/1232-16-0x0000000000050000-0x0000000000582000-memory.dmpFilesize
5.2MB
-
memory/1232-17-0x0000000000050000-0x0000000000582000-memory.dmpFilesize
5.2MB
-
memory/1232-18-0x0000000000050000-0x0000000000582000-memory.dmpFilesize
5.2MB