Analysis
- max time kernel
140s - max time network
119s - platform
windows7_x64 - resource
win7-20240419-en - resource tags
- submitted
22/06/2024, 10:23
General
- Target 911f5bdf7c312a8701bd9d7d4673cfee9b6b1bf3c2f390a1d69e94edebf5bc4f_NeikiAnalytics.exe
- Size 1.3MB
- Sample240622-merrcateqa
- SHA256 911f5bdf7c312a8701bd9d7d4673cfee9b6b1bf3c2f390a1d69e94edebf5bc4f
Malware Config
Extracted
-
risepro
-
147.45.47.126:58709
Signatures
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\911f5bdf7c312a8701bd9d7d4673cfee9b6b1bf3c2f390a1d69e94edebf5bc4f_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\911f5bdf7c312a8701bd9d7d4673cfee9b6b1bf3c2f390a1d69e94edebf5bc4f_NeikiAnalytics.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1764-0-0x0000000000120000-0x0000000000652000-memory.dmp
memory/1764-2-0x00000000005B4000-0x0000000000652000-memory.dmp
memory/1764-1-0x0000000000120000-0x0000000000652000-memory.dmp
memory/1764-4-0x0000000000120000-0x0000000000652000-memory.dmp
memory/1764-5-0x0000000000120000-0x0000000000652000-memory.dmp
memory/1764-6-0x0000000000120000-0x0000000000652000-memory.dmp
memory/1764-7-0x0000000000120000-0x0000000000652000-memory.dmp
memory/1764-8-0x0000000000120000-0x0000000000652000-memory.dmp
memory/1764-9-0x0000000000120000-0x0000000000652000-memory.dmp
memory/1764-10-0x0000000000120000-0x0000000000652000-memory.dmp
memory/1764-11-0x0000000000120000-0x0000000000652000-memory.dmp
memory/1764-12-0x0000000000120000-0x0000000000652000-memory.dmp
memory/1764-13-0x0000000000120000-0x0000000000652000-memory.dmp
memory/1764-14-0x0000000000120000-0x0000000000652000-memory.dmp
memory/1764-15-0x0000000000120000-0x0000000000652000-memory.dmp
memory/1764-16-0x0000000000120000-0x0000000000652000-memory.dmp
memory/1764-17-0x0000000000120000-0x0000000000652000-memory.dmp
memory/1764-18-0x0000000000120000-0x0000000000652000-memory.dmp