risepro | 2c30b853aadcc6c4821835cd9e2f696dc7896a1aaa1309327e12482fdd34a67e

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 11:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-07-01_40e19acc75cbbf0f18fcc1f45cf0e358_magniber.exe
Size

5.9MB
MD5

40e19acc75cbbf0f18fcc1f45cf0e358
SHA1

f97f7920902b379fa5caed2d619fba3f7fb67789
SHA256

2c30b853aadcc6c4821835cd9e2f696dc7896a1aaa1309327e12482fdd34a67e
SHA512

48b73213665bb31b769bc0a01519ebc162523f57eb9ba9fafa2fdfff988ea295cc68d38fe47f0d3d6c7bbc53e4086a22d06dd6b73f5bfd688c902109f20b421e
SSDEEP

98304:lBbQ2H/oEMjghbO76uAqrngBNXsH7zMdDwPgQcM3qn8V/cwduNJKf+tLN9Lxy:PRf/JTNXsH7z0DwPgdvwduGf6HL

Score

10^/10

risepro persistence stealer

Malware Config

Signatures

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SmokerLtd = "C:\\Users\\Admin\\Documents\\Notriniton\\Puola.exe"	2024-07-01_40e19acc75cbbf0f18fcc1f45cf0e358_magniber.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
5108	2024-07-01_40e19acc75cbbf0f18fcc1f45cf0e358_magniber.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1840	5108	WerFault.exe	80

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 3576	5108	2024-07-01_40e19acc75cbbf0f18fcc1f45cf0e358_magniber.exe	88
PID 5108 wrote to memory of 3576	5108	2024-07-01_40e19acc75cbbf0f18fcc1f45cf0e358_magniber.exe	88
PID 5108 wrote to memory of 3576	5108	2024-07-01_40e19acc75cbbf0f18fcc1f45cf0e358_magniber.exe	88
PID 5108 wrote to memory of 3576	5108	2024-07-01_40e19acc75cbbf0f18fcc1f45cf0e358_magniber.exe	88
PID 5108 wrote to memory of 3576	5108	2024-07-01_40e19acc75cbbf0f18fcc1f45cf0e358_magniber.exe	88
PID 5108 wrote to memory of 3576	5108	2024-07-01_40e19acc75cbbf0f18fcc1f45cf0e358_magniber.exe	88

C:\Users\Admin\AppData\Local\Temp\2024-07-01_40e19acc75cbbf0f18fcc1f45cf0e358_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-01_40e19acc75cbbf0f18fcc1f45cf0e358_magniber.exe"
1⤵
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Users\Admin\AppData\Local\Temp\2024-07-01_40e19acc75cbbf0f18fcc1f45cf0e358_magniber.exe
  "C:\Users\Admin\AppData\Local\Temp\2024-07-01_40e19acc75cbbf0f18fcc1f45cf0e358_magniber.exe"
  2⤵
  PID:3576
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5108 -s 640
  2⤵
  - Program crash
  PID:1840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 5108 -ip 5108
1⤵
PID:4108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3576-6-0x00000000000D0000-0x0000000000128000-memory.dmp

Filesize
352KB

Download
memory/3576-5-0x00000000000D0000-0x0000000000128000-memory.dmp

Filesize
352KB

Download
memory/3576-3-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/3576-7-0x0000000000400000-0x0000000000A09000-memory.dmp

Filesize
6.0MB

Download
memory/5108-1-0x0000000000408000-0x0000000000421000-memory.dmp

Filesize
100KB

Download
memory/5108-0-0x0000000000400000-0x0000000000A09000-memory.dmp

Filesize
6.0MB

Download
memory/5108-2-0x0000000000400000-0x0000000000A09000-memory.dmp

Filesize
6.0MB

Download
memory/5108-9-0x0000000000400000-0x0000000000A09000-memory.dmp

Filesize
6.0MB

Download
memory/5108-10-0x0000000000408000-0x0000000000421000-memory.dmp

Filesize
100KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads