Overview

overview

10

Static

static

10

2024-06-23...er.exe

windows7-x64

10

2024-06-23...er.exe

windows10-2004-x64

4

Analysis

  • max time kernel
    149s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    23-06-2024 06:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-06-23_a4741d21cbd2ac23cfd11b143f4a288e_magniber.exe

  • Size

    23.1MB

  • MD5

    a4741d21cbd2ac23cfd11b143f4a288e

  • SHA1

    078d9dab533c3ea24b4622909f9ac9ecec1fb1d7

  • SHA256

    738ba9ad185ebc2429791be6436e180238c2d24ad8ee3cd562fb09b101c58195

  • SHA512

    f466350dcfc6ffab9a36d11a7d2dc11e8e74d34515dcd88c32cc3201182e439b97c2447603663a3cf8f6ce77b12cb3edfb3dc9e4b77fbefaf7838f48f16ade18

  • SSDEEP

    393216:0rwDwWmYifwDwWmT/NnIz3fSc/4VZk4a2rqN+T:0z0W+k/

Score
10/10
riseprostealer

Malware Config

Signatures

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-23_a4741d21cbd2ac23cfd11b143f4a288e_magniber.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-23_a4741d21cbd2ac23cfd11b143f4a288e_magniber.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1740
    • C:\Users\Admin\AppData\Local\Temp\e81dfe5a-3f19-4586-ac60-58328cbcf9a5\crash-handler.exe
      "C:\Users\Admin\AppData\Local\Temp\e81dfe5a-3f19-4586-ac60-58328cbcf9a5\crash-handler.exe" --crash-uuid=41f62afa-1db5-4bbc-870e-759e539d3c32 --product="PC Cleaner Installer" --version="9.3.58016.3697"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:2392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\e81dfe5a-3f19-4586-ac60-58328cbcf9a5\crash-handler.exe
    Filesize

    8.0MB

    MD5

    f6a445ded2309055d6f211458217d43c

    SHA1

    755558bcc93edaa1ee280a3ed0d29bbe0a21bb26

    SHA256

    57459a03ce64189557513e11b83a848fb21f031296e8a79f13f441f4601cd8e2

    SHA512

    b9a07e7512ec69d8a79ff2323eaf30ffbe15f8690fde09e19d8e0c060a12a98343c30dbef1be5015d13283e3cf06e34d44666ad7170039972a24e11be75fed90

    Download Submit

  • \Users\Admin\AppData\Local\Temp\e81dfe5a-3f19-4586-ac60-58328cbcf9a5\sciter.dll
    Filesize

    6.3MB

    MD5

    014dd1d0ca3cf45058c1cff243de1f64

    SHA1

    8f6262d246cf52a9db9f9ae58161e302eaf94c4a

    SHA256

    a99eb6f8b94bb47db6edd8dc797d6e24c43c88ff5be3fbde83123160892a93c0

    SHA512

    41c6b883d20bed55c764a2026c8e3b880eb32b624745fd9495a05b39e35f58e55f7834cc802261163a07428a2d52b07d6d1d8f58aa0b6e1f0296b8ff52635db7

    Download Submit