risepro | 3878a0e50206a6d660b7234483c9d79c8db99c23d2fc281f09435bee25edd577

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 11:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-07-03_bf07f7fb52f00bb1e5d170c5377fcbff_magniber.exe
Size

10.0MB
MD5

bf07f7fb52f00bb1e5d170c5377fcbff
SHA1

29ce5e56c455c6d2e206660de97ee2929d3635e6
SHA256

3878a0e50206a6d660b7234483c9d79c8db99c23d2fc281f09435bee25edd577
SHA512

9127b7926014f0482dbdc70df5b58fb1106312a2b307de00f911a880d7fc6cdc5c18cb5ce45626c539bc92e5250325ea1017b3a913dd50e3eeffced1aba2c45e
SSDEEP

98304:lBbQ2H/oEMjghbO76uAqrngBNXsH7zMdDwPgQcM3qn8V/cwduNJKf+tLN9Lxy:PRf/JTNXsH7z0DwPgdvwduGf6HL

Score

10^/10

risepro persistence stealer

Malware Config

Signatures

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SmokerLtd = "C:\\Users\\Admin\\Documents\\Notriniton\\Puola.exe"	2024-07-03_bf07f7fb52f00bb1e5d170c5377fcbff_magniber.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1500	2024-07-03_bf07f7fb52f00bb1e5d170c5377fcbff_magniber.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2944	1500	WerFault.exe	79

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 4140	1500	2024-07-03_bf07f7fb52f00bb1e5d170c5377fcbff_magniber.exe	88
PID 1500 wrote to memory of 4140	1500	2024-07-03_bf07f7fb52f00bb1e5d170c5377fcbff_magniber.exe	88
PID 1500 wrote to memory of 4140	1500	2024-07-03_bf07f7fb52f00bb1e5d170c5377fcbff_magniber.exe	88
PID 1500 wrote to memory of 4140	1500	2024-07-03_bf07f7fb52f00bb1e5d170c5377fcbff_magniber.exe	88
PID 1500 wrote to memory of 4140	1500	2024-07-03_bf07f7fb52f00bb1e5d170c5377fcbff_magniber.exe	88
PID 1500 wrote to memory of 4140	1500	2024-07-03_bf07f7fb52f00bb1e5d170c5377fcbff_magniber.exe	88

C:\Users\Admin\AppData\Local\Temp\2024-07-03_bf07f7fb52f00bb1e5d170c5377fcbff_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-03_bf07f7fb52f00bb1e5d170c5377fcbff_magniber.exe"
1⤵
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Users\Admin\AppData\Local\Temp\2024-07-03_bf07f7fb52f00bb1e5d170c5377fcbff_magniber.exe
  "C:\Users\Admin\AppData\Local\Temp\2024-07-03_bf07f7fb52f00bb1e5d170c5377fcbff_magniber.exe"
  2⤵
  PID:4140
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 140
  2⤵
  - Program crash
  PID:2944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1500 -ip 1500
1⤵
PID:3344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1500-1-0x0000000000408000-0x0000000000421000-memory.dmp

Filesize
100KB

Download
memory/1500-2-0x0000000000400000-0x0000000000A09000-memory.dmp

Filesize
6.0MB

Download
memory/1500-0-0x0000000000400000-0x0000000000A09000-memory.dmp

Filesize
6.0MB

Download
memory/1500-9-0x0000000000400000-0x0000000000A09000-memory.dmp

Filesize
6.0MB

Download
memory/1500-10-0x0000000000408000-0x0000000000421000-memory.dmp

Filesize
100KB

Download
memory/4140-3-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/4140-6-0x00000000000D0000-0x0000000000128000-memory.dmp

Filesize
352KB

Download
memory/4140-5-0x00000000000D0000-0x0000000000128000-memory.dmp

Filesize
352KB

Download
memory/4140-7-0x0000000000400000-0x0000000000A09000-memory.dmp

Filesize
6.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads