risepro | b738f809b45daff1063fd94c781940911d3d099152085a0c647c793aa90da8be

Analysis

max time kernel
118s
max time network
130s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 04:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-29_c0d22d7b5a12b6a178475eaf780bb9fc_avoslocker_magniber_metamorfo.exe
Size

13.1MB
MD5

c0d22d7b5a12b6a178475eaf780bb9fc
SHA1

4616427d0c54d7db480f7988b402775ce825aa87
SHA256

b738f809b45daff1063fd94c781940911d3d099152085a0c647c793aa90da8be
SHA512

17d4b80594a979feccb31a374b31aca60011913fd1cf23d08209a866851c13990570abe105e4541e372e8588f06aa5c42cc37d08610124389a3d8c9eb7b540bb
SSDEEP

196608:316y1UicZXDmaEKCqtf6PaaLCtx+zFUlBbLrqNUaUQGXT2RK8:3rp0hUPaSfUBbLrqNN/GXj8

Score

10^/10

risepro stealer

Malware Config

Signatures

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
Executes dropped EXE 1 IoCs

Processes:

SodaPDFDesktop14.exe

pid process

2496 SodaPDFDesktop14.exe
Loads dropped DLL 1 IoCs

Processes:

2024-06-29_c0d22d7b5a12b6a178475eaf780bb9fc_avoslocker_magniber_metamorfo.exe

pid process

2948 2024-06-29_c0d22d7b5a12b6a178475eaf780bb9fc_avoslocker_magniber_metamorfo.exe

pid	process
2496	SodaPDFDesktop14.exe

pid	process
2948	2024-06-29_c0d22d7b5a12b6a178475eaf780bb9fc_avoslocker_magniber_metamorfo.exe

Modifies registry class 3 IoCs

Processes:

SodaPDFDesktop14.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{3369AF1C-BCC1-4977-89E8-F8B79497C982}	SodaPDFDesktop14.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{3369AF1C-BCC1-4977-89E8-F8B79497C982}\LaunchPermission = 010014804c0000005c000000140000003000000002001c0001000000110014000400000001010000000000100010000002001c0001000000000014000b0000000101000000000001000000000102000000000005200000002002000001020000000000052000000020020000	SodaPDFDesktop14.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{3369AF1C-BCC1-4977-89E8-F8B79497C982}\AccessPermission = 010014804c0000005c000000140000003000000002001c0001000000110014000400000001010000000000100010000002001c0001000000000014000b0000000101000000000001000000000102000000000005200000002002000001020000000000052000000020020000	SodaPDFDesktop14.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

SodaPDFDesktop14.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	SodaPDFDesktop14.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	SodaPDFDesktop14.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	SodaPDFDesktop14.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	SodaPDFDesktop14.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

SodaPDFDesktop14.exe

pid process

2496 SodaPDFDesktop14.exe
2496 SodaPDFDesktop14.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

SodaPDFDesktop14.exe

pid process

2496 SodaPDFDesktop14.exe
2496 SodaPDFDesktop14.exe
2496 SodaPDFDesktop14.exe

pid	process
2496	SodaPDFDesktop14.exe
2496	SodaPDFDesktop14.exe

pid	process
2496	SodaPDFDesktop14.exe
2496	SodaPDFDesktop14.exe
2496	SodaPDFDesktop14.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

2024-06-29_c0d22d7b5a12b6a178475eaf780bb9fc_avoslocker_magniber_metamorfo.exe

description	pid	process	target process
PID 2948 wrote to memory of 2496	2948	2024-06-29_c0d22d7b5a12b6a178475eaf780bb9fc_avoslocker_magniber_metamorfo.exe	SodaPDFDesktop14.exe
PID 2948 wrote to memory of 2496	2948	2024-06-29_c0d22d7b5a12b6a178475eaf780bb9fc_avoslocker_magniber_metamorfo.exe	SodaPDFDesktop14.exe
PID 2948 wrote to memory of 2496	2948	2024-06-29_c0d22d7b5a12b6a178475eaf780bb9fc_avoslocker_magniber_metamorfo.exe	SodaPDFDesktop14.exe
PID 2948 wrote to memory of 2496	2948	2024-06-29_c0d22d7b5a12b6a178475eaf780bb9fc_avoslocker_magniber_metamorfo.exe	SodaPDFDesktop14.exe
PID 2948 wrote to memory of 2496	2948	2024-06-29_c0d22d7b5a12b6a178475eaf780bb9fc_avoslocker_magniber_metamorfo.exe	SodaPDFDesktop14.exe
PID 2948 wrote to memory of 2496	2948	2024-06-29_c0d22d7b5a12b6a178475eaf780bb9fc_avoslocker_magniber_metamorfo.exe	SodaPDFDesktop14.exe
PID 2948 wrote to memory of 2496	2948	2024-06-29_c0d22d7b5a12b6a178475eaf780bb9fc_avoslocker_magniber_metamorfo.exe	SodaPDFDesktop14.exe

C:\Users\Admin\AppData\Local\Temp\2024-06-29_c0d22d7b5a12b6a178475eaf780bb9fc_avoslocker_magniber_metamorfo.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-29_c0d22d7b5a12b6a178475eaf780bb9fc_avoslocker_magniber_metamorfo.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2948

C:\Users\Admin\AppData\Local\Temp\SodaPDFDesktop14\14.0.356.3146\EE78A3D4-814E-4528-A36E-A2A59B8DCBE9\SodaPDFDesktop14.exe
"C:\Users\Admin\AppData\Local\Temp\SodaPDFDesktop14\14.0.356.3146\EE78A3D4-814E-4528-A36E-A2A59B8DCBE9\SodaPDFDesktop14.exe" /update=start /welcome
2⤵
- Executes dropped EXE
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2496

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
1KB

MD5
c8597fb65a7a004cb22e09fa5a9409cc

SHA1
7c65ec586b2341626cace015b4d597f1eba2154f

SHA256
53f831bcd51fb96eacc19710541775915b8ee191d8b8a00c8284fcc4b85a57f6

SHA512
96741ba79e209d0276a7053b9a9a33712d84c51a77b38eac9b74ef94e541bb9c81508b86feaed37db2f4546f1fa81db62608a4ffb9cfb8e5b47f4a6879184b9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
410B

MD5
6d96f7449f3b97d2658cdf2e79d495e8

SHA1
3bd739717b8b43893b6e11af9c23373de5cefce9

SHA256
6a42f651ab266a559397e14d555f3e18f0cceba0dc24e0587a0804502db24d39

SHA512
98b9a2a62284c5395e3b09f28cdb2a5702283846d90daaf254dcbcf410a4bf0d8f9ac417f5eb380ad4a0c71363fa30b5f0cd198f82f9555de207161d3f0c7744

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
bd293b65e4726b8ad10e0e140e39838e

SHA1
acc09f0c7bc39d69f7cb083431f572997b7330ed

SHA256
a59f33880fdb133d3d49fa401e64a1cd8e1ab1a793a91e7e4929f0bb39d6ac13

SHA512
ac92537f909ef875e1b8fc4d3756c9865d13ce4ab3a1c5e41e04d30b02a0194d16621bb149188dc33fce037f8d55779f66b193d974eb400c61eb66859fef0b30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize
392B

MD5
ca2c1140790ca66ca7edab8be4758ee5

SHA1
6cd31724827dea864ed0d30108adfde882f0e967

SHA256
54b6b07eaceeb0baa6bf6962fc1361084ba2dcc6c20d6079415dfdb4713b55e3

SHA512
8f1ca4a550615ebbc75e7d363853aee664953e6d54e0526dd14586207fdd1288174b5451471a597c02f874e36c0ee2dcf7c736c118d0fdedcd57c728867fa795

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8565.tmp
Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8FC4.tmp
Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Users\Admin\AppData\Local\Temp\SodaPDFDesktop14\14.0.356.3146\EE78A3D4-814E-4528-A36E-A2A59B8DCBE9\SodaPDFDesktop14.exe
Filesize
13.1MB

MD5
c0d22d7b5a12b6a178475eaf780bb9fc

SHA1
4616427d0c54d7db480f7988b402775ce825aa87

SHA256
b738f809b45daff1063fd94c781940911d3d099152085a0c647c793aa90da8be

SHA512
17d4b80594a979feccb31a374b31aca60011913fd1cf23d08209a866851c13990570abe105e4541e372e8588f06aa5c42cc37d08610124389a3d8c9eb7b540bb

Download Submit