Overview

overview

10

Static

static

7

9e2a3d673b...38.exe

windows7-x64

10

9e2a3d673b...38.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9e2a3d673b97bbb4b879907a6de4217907800192401dc404af51953e59765838.exe

  • Size

    3.4MB

  • Sample

    240726-fe7dgazhlb

  • MD5

    910182267ab297ced9fa6cac86f93c3e

  • SHA1

    ba9d0f067c51fa7ab9e2c3af128d4e3a9f2c28b9

  • SHA256

    9e2a3d673b97bbb4b879907a6de4217907800192401dc404af51953e59765838

  • SHA512

    92c313640fddf3ddf0dd6491de8182597df5848240f8791543459240bcf2ceeb8f76e98add171831aaa9fea1001625bbc68f7c5a2f6aebb232f536c1acca0d2a

  • SSDEEP

    49152:J1UHC6vWZtnxJB9qBBmAAcuXshmk2sP4gNi1KEj39tpz7vDZvtNUZRMYDiTYwEqe:J1+WZtzDqBScuXKmk2RXKi17NteXW6S0

Score
10/10
riseprodiscoveryevasionstealerthemidatrojan

Malware Config

Extracted

Family

risepro

C2

5.42.65.117:50500

Targets

    • Target

      9e2a3d673b97bbb4b879907a6de4217907800192401dc404af51953e59765838.exe

    • Size

      3.4MB

    • MD5

      910182267ab297ced9fa6cac86f93c3e

    • SHA1

      ba9d0f067c51fa7ab9e2c3af128d4e3a9f2c28b9

    • SHA256

      9e2a3d673b97bbb4b879907a6de4217907800192401dc404af51953e59765838

    • SHA512

      92c313640fddf3ddf0dd6491de8182597df5848240f8791543459240bcf2ceeb8f76e98add171831aaa9fea1001625bbc68f7c5a2f6aebb232f536c1acca0d2a

    • SSDEEP

      49152:J1UHC6vWZtnxJB9qBBmAAcuXshmk2sP4gNi1KEj39tpz7vDZvtNUZRMYDiTYwEqe:J1+WZtzDqBScuXKmk2RXKi17NteXW6S0

    Score
    10/10
    riseprodiscoveryevasionstealerthemidatrojan

    • RisePro

      RisePro stealer is an infostealer distributed by PrivateLoader.

      stealerrisepro

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks