Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/06/2024, 16:27 UTC

General

  • Target

    b6491a7ae09e34061861082253113bea087f23b05f109d59638d79a64be5f93a.exe

  • Size

    2.3MB

  • MD5

    e452dc3fcf18169614f2a672ddbf4168

  • SHA1

    72a6d4e5b5804dd62cea87805ecc8ad21faeaa02

  • SHA256

    b6491a7ae09e34061861082253113bea087f23b05f109d59638d79a64be5f93a

  • SHA512

    c34cd2149f93c106ea4d2141c54c5efd05776ac32ee09a34f90fda59f87e4782836f3269c0da68e571eeccbf7ecfd719b0086d4fa4a53dbb8189e6aa915ef3c4

  • SSDEEP

    49152:MZWLnyAFIFhqjqxxkemYH1Y3rbzjzxiQ9KkQfMHk+8yGGz7:MZGnZWhYqxxkQEPdiQ9K/MEmGGz

Score
10/10

Malware Config

Extracted

Family

risepro

C2

77.91.77.66:58709

Signatures

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b6491a7ae09e34061861082253113bea087f23b05f109d59638d79a64be5f93a.exe
    "C:\Users\Admin\AppData\Local\Temp\b6491a7ae09e34061861082253113bea087f23b05f109d59638d79a64be5f93a.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:764

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/764-0-0x00000000008C0000-0x0000000000EB5000-memory.dmp

    Filesize

    6.0MB

  • memory/764-1-0x0000000076F54000-0x0000000076F56000-memory.dmp

    Filesize

    8KB

  • memory/764-2-0x00000000008C1000-0x000000000096D000-memory.dmp

    Filesize

    688KB

  • memory/764-3-0x00000000008C0000-0x0000000000EB5000-memory.dmp

    Filesize

    6.0MB

  • memory/764-4-0x00000000008C0000-0x0000000000EB5000-memory.dmp

    Filesize

    6.0MB

  • memory/764-5-0x00000000008C0000-0x0000000000EB5000-memory.dmp

    Filesize

    6.0MB

  • memory/764-6-0x00000000008C0000-0x0000000000EB5000-memory.dmp

    Filesize

    6.0MB

  • memory/764-7-0x00000000008C0000-0x0000000000EB5000-memory.dmp

    Filesize

    6.0MB

  • memory/764-8-0x00000000008C0000-0x0000000000EB5000-memory.dmp

    Filesize

    6.0MB

  • memory/764-9-0x00000000008C0000-0x0000000000EB5000-memory.dmp

    Filesize

    6.0MB

  • memory/764-10-0x00000000008C0000-0x0000000000EB5000-memory.dmp

    Filesize

    6.0MB

  • memory/764-11-0x00000000008C0000-0x0000000000EB5000-memory.dmp

    Filesize

    6.0MB

  • memory/764-12-0x00000000008C0000-0x0000000000EB5000-memory.dmp

    Filesize

    6.0MB

  • memory/764-13-0x00000000008C0000-0x0000000000EB5000-memory.dmp

    Filesize

    6.0MB

  • memory/764-14-0x00000000008C0000-0x0000000000EB5000-memory.dmp

    Filesize

    6.0MB

  • memory/764-15-0x00000000008C0000-0x0000000000EB5000-memory.dmp

    Filesize

    6.0MB

  • memory/764-16-0x00000000008C0000-0x0000000000EB5000-memory.dmp

    Filesize

    6.0MB

  • memory/764-17-0x00000000008C0000-0x0000000000EB5000-memory.dmp

    Filesize

    6.0MB

  • memory/764-18-0x00000000008C0000-0x0000000000EB5000-memory.dmp

    Filesize

    6.0MB

  • memory/764-19-0x00000000008C0000-0x0000000000EB5000-memory.dmp

    Filesize

    6.0MB

  • memory/764-20-0x00000000008C0000-0x0000000000EB5000-memory.dmp

    Filesize

    6.0MB

  • memory/764-21-0x00000000008C0000-0x0000000000EB5000-memory.dmp

    Filesize

    6.0MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.