General
-
Target
231210-12-RisePro-aa35d9.exe
-
Size
2.7MB
-
Sample
240724-pdr2tsycjf
-
MD5
9bd7b73254811f7180bde59df0521ffe
-
SHA1
8cc949fb81939a0d1b66246c859f8a04e26fe0fc
-
SHA256
5403268ea1575083dab2c9f9bc47c18da59014732302beed406a0a47e74a3d9b
-
SHA512
9ae809d8715f96bf8990c6ea7c12a4ac6ab11deea910d927c073a29664d0d020c312a4c37ea72a48d4732efe32f63556425a85b9a1bac7c916bcff769377df46
-
SSDEEP
49152:8EPJi6PIs6mU+ygzfEJNveiQRQHceofAkYeLob13vH+tTxjF6:nABhgzi3WSvofAkYeIHoT2
Static task
static1
Behavioral task
behavioral1
Sample
231210-12-RisePro-aa35d9.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
risepro
193.233.132.51
Targets
-
-
Target
231210-12-RisePro-aa35d9.exe
-
Size
2.7MB
-
MD5
9bd7b73254811f7180bde59df0521ffe
-
SHA1
8cc949fb81939a0d1b66246c859f8a04e26fe0fc
-
SHA256
5403268ea1575083dab2c9f9bc47c18da59014732302beed406a0a47e74a3d9b
-
SHA512
9ae809d8715f96bf8990c6ea7c12a4ac6ab11deea910d927c073a29664d0d020c312a4c37ea72a48d4732efe32f63556425a85b9a1bac7c916bcff769377df46
-
SSDEEP
49152:8EPJi6PIs6mU+ygzfEJNveiQRQHceofAkYeLob13vH+tTxjF6:nABhgzi3WSvofAkYeIHoT2
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1