risepro | 2c30b853aadcc6c4821835cd9e2f696dc7896a1aaa1309327e12482fdd34a67e

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 11:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-07-01_40e19acc75cbbf0f18fcc1f45cf0e358_magniber.exe
Size

5.9MB
MD5

40e19acc75cbbf0f18fcc1f45cf0e358
SHA1

f97f7920902b379fa5caed2d619fba3f7fb67789
SHA256

2c30b853aadcc6c4821835cd9e2f696dc7896a1aaa1309327e12482fdd34a67e
SHA512

48b73213665bb31b769bc0a01519ebc162523f57eb9ba9fafa2fdfff988ea295cc68d38fe47f0d3d6c7bbc53e4086a22d06dd6b73f5bfd688c902109f20b421e
SSDEEP

98304:lBbQ2H/oEMjghbO76uAqrngBNXsH7zMdDwPgQcM3qn8V/cwduNJKf+tLN9Lxy:PRf/JTNXsH7z0DwPgdvwduGf6HL

Score

10^/10

risepro persistence stealer

Malware Config

Signatures

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\SmokerLtd = "C:\\Users\\Admin\\Documents\\Notriniton\\Puola.exe"	2024-07-01_40e19acc75cbbf0f18fcc1f45cf0e358_magniber.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2844	2024-07-01_40e19acc75cbbf0f18fcc1f45cf0e358_magniber.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2668	2844	2024-07-01_40e19acc75cbbf0f18fcc1f45cf0e358_magniber.exe	28
PID 2844 wrote to memory of 2668	2844	2024-07-01_40e19acc75cbbf0f18fcc1f45cf0e358_magniber.exe	28
PID 2844 wrote to memory of 2668	2844	2024-07-01_40e19acc75cbbf0f18fcc1f45cf0e358_magniber.exe	28
PID 2844 wrote to memory of 2668	2844	2024-07-01_40e19acc75cbbf0f18fcc1f45cf0e358_magniber.exe	28
PID 2844 wrote to memory of 2668	2844	2024-07-01_40e19acc75cbbf0f18fcc1f45cf0e358_magniber.exe	28
PID 2844 wrote to memory of 2668	2844	2024-07-01_40e19acc75cbbf0f18fcc1f45cf0e358_magniber.exe	28
PID 2844 wrote to memory of 2668	2844	2024-07-01_40e19acc75cbbf0f18fcc1f45cf0e358_magniber.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-07-01_40e19acc75cbbf0f18fcc1f45cf0e358_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-01_40e19acc75cbbf0f18fcc1f45cf0e358_magniber.exe"
1⤵
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Users\Admin\AppData\Local\Temp\2024-07-01_40e19acc75cbbf0f18fcc1f45cf0e358_magniber.exe
  "C:\Users\Admin\AppData\Local\Temp\2024-07-01_40e19acc75cbbf0f18fcc1f45cf0e358_magniber.exe"
  2⤵
  PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2668-14-0x00000000000C0000-0x0000000000118000-memory.dmp

Filesize
352KB

Download
memory/2668-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2668-9-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2668-8-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2668-4-0x00000000000C0000-0x0000000000118000-memory.dmp

Filesize
352KB

Download
memory/2668-12-0x00000000000C0000-0x0000000000118000-memory.dmp

Filesize
352KB

Download
memory/2668-11-0x00000000000C0000-0x0000000000118000-memory.dmp

Filesize
352KB

Download
memory/2844-0-0x0000000000400000-0x0000000000A09000-memory.dmp

Filesize
6.0MB

Download
memory/2844-2-0x0000000000400000-0x0000000000A09000-memory.dmp

Filesize
6.0MB

Download
memory/2844-3-0x0000000000400000-0x0000000000A09000-memory.dmp

Filesize
6.0MB

Download
memory/2844-1-0x0000000000408000-0x0000000000421000-memory.dmp

Filesize
100KB

Download
memory/2844-16-0x0000000000408000-0x0000000000421000-memory.dmp

Filesize
100KB

Download
memory/2844-17-0x0000000000400000-0x0000000000A09000-memory.dmp

Filesize
6.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads