Analysis

  • max time kernel
    141s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    28-06-2024 15:27

General

  • Target

    9e9ea9c197938879aa75f476dfae4b28805e79035d1b79da9d336a8d3a48f057_NeikiAnalytics.exe

  • Size

    2.3MB

  • MD5

    b33a8d92363326931620a15917ac0930

  • SHA1

    e4dbc660fe6b17288e24d18a860567d33b3a1fb6

  • SHA256

    9e9ea9c197938879aa75f476dfae4b28805e79035d1b79da9d336a8d3a48f057

  • SHA512

    cb03e789c1ad4d87e73791f364f96b7c0486f9776be0ecfdf7a3b5624f21a1de17b89ee140ae3e87fa2d14dce2ca52415d11aab809e0027f63c3d3b3b9e8eb78

  • SSDEEP

    49152:PjBAcrrWRJZE1kRy8388Au4fbi8gAhNE5gdpSGgCB5O07BM:OQWfuKIbKHydpfbd2

Score
10/10

Malware Config

Extracted

Family

risepro

C2

77.91.77.66:58709

Signatures

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9e9ea9c197938879aa75f476dfae4b28805e79035d1b79da9d336a8d3a48f057_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\9e9ea9c197938879aa75f476dfae4b28805e79035d1b79da9d336a8d3a48f057_NeikiAnalytics.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:3008

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3008-0-0x0000000000A80000-0x0000000001073000-memory.dmp

    Filesize

    5.9MB

  • memory/3008-1-0x0000000077880000-0x0000000077882000-memory.dmp

    Filesize

    8KB

  • memory/3008-3-0x0000000000A80000-0x0000000001073000-memory.dmp

    Filesize

    5.9MB

  • memory/3008-2-0x0000000000A81000-0x0000000000B2D000-memory.dmp

    Filesize

    688KB

  • memory/3008-4-0x0000000000A80000-0x0000000001073000-memory.dmp

    Filesize

    5.9MB

  • memory/3008-5-0x0000000000A80000-0x0000000001073000-memory.dmp

    Filesize

    5.9MB

  • memory/3008-6-0x0000000000A80000-0x0000000001073000-memory.dmp

    Filesize

    5.9MB

  • memory/3008-7-0x0000000000A80000-0x0000000001073000-memory.dmp

    Filesize

    5.9MB

  • memory/3008-8-0x0000000000A80000-0x0000000001073000-memory.dmp

    Filesize

    5.9MB

  • memory/3008-9-0x0000000000A80000-0x0000000001073000-memory.dmp

    Filesize

    5.9MB

  • memory/3008-10-0x0000000000A80000-0x0000000001073000-memory.dmp

    Filesize

    5.9MB

  • memory/3008-11-0x0000000000A80000-0x0000000001073000-memory.dmp

    Filesize

    5.9MB

  • memory/3008-12-0x0000000000A80000-0x0000000001073000-memory.dmp

    Filesize

    5.9MB

  • memory/3008-13-0x0000000000A80000-0x0000000001073000-memory.dmp

    Filesize

    5.9MB

  • memory/3008-14-0x0000000000A80000-0x0000000001073000-memory.dmp

    Filesize

    5.9MB

  • memory/3008-15-0x0000000000A80000-0x0000000001073000-memory.dmp

    Filesize

    5.9MB

  • memory/3008-16-0x0000000000A80000-0x0000000001073000-memory.dmp

    Filesize

    5.9MB

  • memory/3008-17-0x0000000000A80000-0x0000000001073000-memory.dmp

    Filesize

    5.9MB

  • memory/3008-18-0x0000000000A80000-0x0000000001073000-memory.dmp

    Filesize

    5.9MB

  • memory/3008-19-0x0000000000A80000-0x0000000001073000-memory.dmp

    Filesize

    5.9MB

  • memory/3008-20-0x0000000000A80000-0x0000000001073000-memory.dmp

    Filesize

    5.9MB

  • memory/3008-21-0x0000000000A80000-0x0000000001073000-memory.dmp

    Filesize

    5.9MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.