Analysis
- max time kernel
298s - max time network
257s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
20/06/2024, 23:23
General
- Target da5c2743fa8f230d8a2b6c4a34d27b7d01b8478ed18c8386b40382110b59d9a4.exe
- Size 1.3MB
- Sample240620-3c619ascpb
- SHA256 da5c2743fa8f230d8a2b6c4a34d27b7d01b8478ed18c8386b40382110b59d9a4
Malware Config
Extracted
-
risepro
-
147.45.47.126:58709
Signatures
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- Suspicious use of NtSetInformationThreadHideFromDebugger 30 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\da5c2743fa8f230d8a2b6c4a34d27b7d01b8478ed18c8386b40382110b59d9a4.exe"C:\Users\Admin\AppData\Local\Temp\da5c2743fa8f230d8a2b6c4a34d27b7d01b8478ed18c8386b40382110b59d9a4.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3652-0-0x0000000000850000-0x0000000000D82000-memory.dmp
memory/3652-2-0x0000000000CE4000-0x0000000000D82000-memory.dmp
memory/3652-1-0x0000000000850000-0x0000000000D82000-memory.dmp
memory/3652-4-0x0000000000850000-0x0000000000D82000-memory.dmp
memory/3652-5-0x0000000000850000-0x0000000000D82000-memory.dmp
memory/3652-6-0x0000000000850000-0x0000000000D82000-memory.dmp
memory/3652-7-0x0000000000850000-0x0000000000D82000-memory.dmp
memory/3652-8-0x0000000000850000-0x0000000000D82000-memory.dmp
memory/3652-9-0x0000000000850000-0x0000000000D82000-memory.dmp
memory/3652-10-0x0000000000850000-0x0000000000D82000-memory.dmp
memory/3652-11-0x0000000000850000-0x0000000000D82000-memory.dmp
memory/3652-12-0x0000000000850000-0x0000000000D82000-memory.dmp
memory/3652-13-0x0000000000850000-0x0000000000D82000-memory.dmp
memory/3652-14-0x0000000000850000-0x0000000000D82000-memory.dmp
memory/3652-15-0x0000000000850000-0x0000000000D82000-memory.dmp
memory/3652-16-0x0000000000850000-0x0000000000D82000-memory.dmp
memory/3652-17-0x0000000000850000-0x0000000000D82000-memory.dmp
memory/3652-18-0x0000000000850000-0x0000000000D82000-memory.dmp
memory/3652-19-0x0000000000850000-0x0000000000D82000-memory.dmp
memory/3652-20-0x0000000000850000-0x0000000000D82000-memory.dmp
memory/3652-21-0x0000000000850000-0x0000000000D82000-memory.dmp
memory/3652-22-0x0000000000850000-0x0000000000D82000-memory.dmp
memory/3652-23-0x0000000000850000-0x0000000000D82000-memory.dmp
memory/3652-24-0x0000000000850000-0x0000000000D82000-memory.dmp
memory/3652-25-0x0000000000850000-0x0000000000D82000-memory.dmp
memory/3652-26-0x0000000000850000-0x0000000000D82000-memory.dmp
memory/3652-27-0x0000000000850000-0x0000000000D82000-memory.dmp
memory/3652-28-0x0000000000850000-0x0000000000D82000-memory.dmp
memory/3652-29-0x0000000000850000-0x0000000000D82000-memory.dmp
memory/3652-30-0x0000000000850000-0x0000000000D82000-memory.dmp
memory/3652-31-0x0000000000850000-0x0000000000D82000-memory.dmp
memory/3652-32-0x0000000000850000-0x0000000000D82000-memory.dmp
memory/3652-33-0x0000000000850000-0x0000000000D82000-memory.dmp