Analysis
-
max time kernel
145s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
03-07-2024 11:50
General
-
Target
archive/setup.exe
-
Size
795.4MB
-
MD5
91f540bb6689c4cd88d4336a0164d52c
-
SHA1
95561e3dbc6e8334a7fb17057683811bdfb0812d
-
SHA256
c1c100bfd2ccbe90489a0d6a961c928776e0b8ea6d4252f17d681183ae7bdd9f
-
SHA512
15f5091fd03711f21ee15b8c2c23167c182927b73a61541358970d5634578c65c2561869d76c7606beff350133ddc573a9d2282c7befea7bf843ba5124cd76d8
-
SSDEEP
98304:fq4qkxXgnZDkE3DsMCUrUSGgykKoDJkrht130JADnKf53eooUALG5:ygX0gYsMVVGHoDa713+InKkooUMO
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 1 IoCs
-
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\archive\setup.exe"C:\Users\Admin\AppData\Local\Temp\archive\setup.exe"1⤵
- Modifies firewall policy service
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/348-4-0x0000000001850000-0x0000000001851000-memory.dmpFilesize
4KB
-
memory/348-7-0x0000000001960000-0x0000000001961000-memory.dmpFilesize
4KB
-
memory/348-6-0x0000000001870000-0x0000000001871000-memory.dmpFilesize
4KB
-
memory/348-5-0x0000000001860000-0x0000000001861000-memory.dmpFilesize
4KB
-
memory/348-3-0x0000000001820000-0x0000000001821000-memory.dmpFilesize
4KB
-
memory/348-1-0x0000000000D47000-0x0000000001024000-memory.dmpFilesize
2.9MB
-
memory/348-0-0x0000000001800000-0x0000000001801000-memory.dmpFilesize
4KB
-
memory/348-2-0x0000000001810000-0x0000000001811000-memory.dmpFilesize
4KB
-
memory/348-11-0x0000000000BB0000-0x0000000001588000-memory.dmpFilesize
9.8MB
-
memory/348-12-0x0000000000BB0000-0x0000000001588000-memory.dmpFilesize
9.8MB
-
memory/348-19-0x0000000000D47000-0x0000000001024000-memory.dmpFilesize
2.9MB
-
memory/348-20-0x0000000000BB0000-0x0000000001588000-memory.dmpFilesize
9.8MB