risepro | 3878a0e50206a6d660b7234483c9d79c8db99c23d2fc281f09435bee25edd577

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03-07-2024 11:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-07-03_bf07f7fb52f00bb1e5d170c5377fcbff_magniber.exe
Size

10.0MB
MD5

bf07f7fb52f00bb1e5d170c5377fcbff
SHA1

29ce5e56c455c6d2e206660de97ee2929d3635e6
SHA256

3878a0e50206a6d660b7234483c9d79c8db99c23d2fc281f09435bee25edd577
SHA512

9127b7926014f0482dbdc70df5b58fb1106312a2b307de00f911a880d7fc6cdc5c18cb5ce45626c539bc92e5250325ea1017b3a913dd50e3eeffced1aba2c45e
SSDEEP

98304:lBbQ2H/oEMjghbO76uAqrngBNXsH7zMdDwPgQcM3qn8V/cwduNJKf+tLN9Lxy:PRf/JTNXsH7z0DwPgdvwduGf6HL

Score

10^/10

risepro persistence stealer

Malware Config

Signatures

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\SmokerLtd = "C:\\Users\\Admin\\Documents\\Notriniton\\Puola.exe"	2024-07-03_bf07f7fb52f00bb1e5d170c5377fcbff_magniber.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1792	2024-07-03_bf07f7fb52f00bb1e5d170c5377fcbff_magniber.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 1228	1792	2024-07-03_bf07f7fb52f00bb1e5d170c5377fcbff_magniber.exe	28
PID 1792 wrote to memory of 1228	1792	2024-07-03_bf07f7fb52f00bb1e5d170c5377fcbff_magniber.exe	28
PID 1792 wrote to memory of 1228	1792	2024-07-03_bf07f7fb52f00bb1e5d170c5377fcbff_magniber.exe	28
PID 1792 wrote to memory of 1228	1792	2024-07-03_bf07f7fb52f00bb1e5d170c5377fcbff_magniber.exe	28
PID 1792 wrote to memory of 1228	1792	2024-07-03_bf07f7fb52f00bb1e5d170c5377fcbff_magniber.exe	28
PID 1792 wrote to memory of 1228	1792	2024-07-03_bf07f7fb52f00bb1e5d170c5377fcbff_magniber.exe	28
PID 1792 wrote to memory of 1228	1792	2024-07-03_bf07f7fb52f00bb1e5d170c5377fcbff_magniber.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-07-03_bf07f7fb52f00bb1e5d170c5377fcbff_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-03_bf07f7fb52f00bb1e5d170c5377fcbff_magniber.exe"
1⤵
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Users\Admin\AppData\Local\Temp\2024-07-03_bf07f7fb52f00bb1e5d170c5377fcbff_magniber.exe
  "C:\Users\Admin\AppData\Local\Temp\2024-07-03_bf07f7fb52f00bb1e5d170c5377fcbff_magniber.exe"
  2⤵
  PID:1228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1228-3-0x00000000000C0000-0x0000000000118000-memory.dmp

Filesize
352KB

Download
memory/1228-9-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/1228-7-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/1228-5-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1228-14-0x00000000000C0000-0x0000000000118000-memory.dmp

Filesize
352KB

Download
memory/1228-12-0x00000000000C0000-0x0000000000118000-memory.dmp

Filesize
352KB

Download
memory/1228-11-0x00000000000C0000-0x0000000000118000-memory.dmp

Filesize
352KB

Download
memory/1792-0-0x0000000000400000-0x0000000000A09000-memory.dmp

Filesize
6.0MB

Download
memory/1792-1-0x0000000000400000-0x0000000000A09000-memory.dmp

Filesize
6.0MB

Download
memory/1792-2-0x0000000000400000-0x0000000000A09000-memory.dmp

Filesize
6.0MB

Download
memory/1792-15-0x0000000000400000-0x0000000000A09000-memory.dmp

Filesize
6.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads