Analysis

  • max time kernel
    94s
  • max time network
    98s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-09-2024 02:23

General

  • Target

    99971917023891412.exe

  • Size

    6.5MB

  • MD5

    6c445fd49061f4c9849fa6fecb3ecea8

  • SHA1

    d7cd4c01cd9afc838a1e657925153bf219eee41d

  • SHA256

    9e303948d961216b83748b22811d3f0b287d8c22040ae24f5a618b5866d96719

  • SHA512

    4958c04e6b201d0dfed9a72235dddb8752becbebd53ecdc79878abf5a4e72939d09ce504c44b6cd6ce0a740bf0c793e21bef330a94ec0e9443c4d3a12287e181

  • SSDEEP

    98304:KG7JJLb33yLkX0JlTVWZVr76RDBY4ScF/VbBYZKrrd+TDfcOCbhxNGYOQ2fx:K+Jp3wkETTV0wRDByc9YZSrd+TDD

Score
10/10

Malware Config

Extracted

Family

risepro

C2

193.233.132.49:50500

Signatures

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\99971917023891412.exe
    "C:\Users\Admin\AppData\Local\Temp\99971917023891412.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:3816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3816-0-0x00000000004C0000-0x00000000011D2000-memory.dmp

    Filesize

    13.1MB

  • memory/3816-7-0x0000000003420000-0x0000000003421000-memory.dmp

    Filesize

    4KB

  • memory/3816-10-0x0000000003460000-0x0000000003461000-memory.dmp

    Filesize

    4KB

  • memory/3816-11-0x0000000003470000-0x0000000003471000-memory.dmp

    Filesize

    4KB

  • memory/3816-9-0x00000000005F8000-0x0000000000879000-memory.dmp

    Filesize

    2.5MB

  • memory/3816-8-0x0000000003450000-0x0000000003451000-memory.dmp

    Filesize

    4KB

  • memory/3816-6-0x0000000003310000-0x0000000003311000-memory.dmp

    Filesize

    4KB

  • memory/3816-12-0x0000000003480000-0x0000000003481000-memory.dmp

    Filesize

    4KB

  • memory/3816-13-0x00000000004C0000-0x00000000011D2000-memory.dmp

    Filesize

    13.1MB

  • memory/3816-15-0x00000000005F8000-0x0000000000879000-memory.dmp

    Filesize

    2.5MB