Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows11-21h2_x64 -
resource
win11-20240611-en -
resource tags
-
submitted
23/06/2024, 10:46 UTC
General
-
Target
4aca1be03112e87584d9ac9ae0f8279ba272ff5c0daa12f409b2dc00b3c521ad.exe
-
Size
3.2MB
-
MD5
85ced2db3844ef1f2845ecdcc5d7abd7
-
SHA1
e8d6caa8dea7ea66461be21d57216e623fe1ab88
-
SHA256
4aca1be03112e87584d9ac9ae0f8279ba272ff5c0daa12f409b2dc00b3c521ad
-
SHA512
f3ab409e3cd62fe00a5252c6feaad504fcd2a4f1bbbb57946bf811e0c5a66442942302ee69f58f5ae2170aed7d0c26eff553fa0f342ea76783edb3df7a720662
-
SSDEEP
98304:iogtbKcIJSMG/4U7Qc6dVktuSreHWm8K8U:1gNKn8MG/4U94mtuSrsl8U
Score
10/10
Malware Config
Extracted
Family
risepro
C2
77.91.77.66:58709
Signatures
-
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer 5 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4aca1be03112e87584d9ac9ae0f8279ba272ff5c0daa12f409b2dc00b3c521ad.exe"C:\Users\Admin\AppData\Local\Temp\4aca1be03112e87584d9ac9ae0f8279ba272ff5c0daa12f409b2dc00b3c521ad.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
Network
-
DNS22.236.111.52.in-addr.arpaRemote address:8.8.8.8:53Request22.236.111.52.in-addr.arpaIN PTRResponse
-
52.111.243.30:443
-
8.8.8.8:5322.236.111.52.in-addr.arpadns
DNS Request
22.236.111.52.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.0MB
-
Filesize
8.0MB
-
Filesize
8.0MB
-
Filesize
8.0MB
-
Filesize
8.0MB