General
-
Target
fee76384c8607145aea5e8e60f00feebe357e404202460c5a0bdb01718bc1db7.exe
-
Size
3.1MB
-
Sample
240727-cmhtaszhrj
-
MD5
40c43f0a02f466b319a8ad5fbeaab17a
-
SHA1
0b340dfc80a47a514fd244977159b59d71904abe
-
SHA256
fee76384c8607145aea5e8e60f00feebe357e404202460c5a0bdb01718bc1db7
-
SHA512
244fc2b4fd3d87f3c59741f84005c33d892d47d5bfea3c2ba75beb275073bac14ca87a2882d9a9264c0de2b6136c767c10313247a13fa3eb85e055e96537e0fa
-
SSDEEP
98304:oANQHzuCU4F/hTCePAWFnZRctdxrxXgY6pN:oPHTVhTNAonZetHhgBpN
Behavioral task
behavioral1
Sample
fee76384c8607145aea5e8e60f00feebe357e404202460c5a0bdb01718bc1db7.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
fee76384c8607145aea5e8e60f00feebe357e404202460c5a0bdb01718bc1db7.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
risepro
147.45.47.169
194.110.13.70
Targets
-
-
Target
fee76384c8607145aea5e8e60f00feebe357e404202460c5a0bdb01718bc1db7.exe
-
Size
3.1MB
-
MD5
40c43f0a02f466b319a8ad5fbeaab17a
-
SHA1
0b340dfc80a47a514fd244977159b59d71904abe
-
SHA256
fee76384c8607145aea5e8e60f00feebe357e404202460c5a0bdb01718bc1db7
-
SHA512
244fc2b4fd3d87f3c59741f84005c33d892d47d5bfea3c2ba75beb275073bac14ca87a2882d9a9264c0de2b6136c767c10313247a13fa3eb85e055e96537e0fa
-
SSDEEP
98304:oANQHzuCU4F/hTCePAWFnZRctdxrxXgY6pN:oPHTVhTNAonZetHhgBpN
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1