| File name: | Cs 2 SkinChanger.zip |
| Full analysis: | https://app.any.run/tasks/eff1a7b9-3d40-45fe-be48-356fcbc59c76 |
| Verdict: | Malicious activity |
| Threats: | RisePro, an information-stealing malware, targets a wide range of sensitive data, including credit cards, passwords, and cryptocurrency wallets. By compromising infected devices, RisePro can steal valuable information and potentially cause significant financial and personal losses for victims. |
| Analysis date: | December 04, 2023, 14:16:41 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v1.0 to extract |
| MD5: | 9EFA4D31D6BE7777F5C104B1C6DF7361 |
| SHA1: | 004DC09F364BC651EEE4C3A378CAE6772087119F |
| SHA256: | 33661CE27FB6A02156CF58124CC03F598B57A01E8AD102B8D5BD6DABD35BCE90 |
| SSDEEP: | 98304:ryWVnLNJnlvQ5kKIRLte0TEbu/SSQeQ6Lz6UfeHUa0Oarq45HqBWZZXBitfEkUwW:Kr3QaJSp5h0Yal/75L6XAziVbQW |
MALICIOUS
RISEPRO has been detected (SURICATA)
- Loader.exe (PID: 3644)
- IEUpdater140.exe (PID: 3272)
Steals credentials from Web Browsers
- Loader.exe (PID: 3644)
Steals credentials
- Loader.exe (PID: 3644)
Create files in the Startup directory
- Loader.exe (PID: 3644)
Uses Task Scheduler to run other applications
- Loader.exe (PID: 3644)
Drops the executable file immediately after the start
- Loader.exe (PID: 3644)
Uses Task Scheduler to autorun other applications
- Loader.exe (PID: 3644)
RISEPRO has been detected (YARA)
- IEUpdater140.exe (PID: 3272)
Actions looks like stealing of personal data
- Loader.exe (PID: 3644)
SUSPICIOUS
Reads settings of System Certificates
- Loader.exe (PID: 3644)
Checks for external IP
- Loader.exe (PID: 3644)
Connects to unusual port
- Loader.exe (PID: 3644)
- IEUpdater140.exe (PID: 3272)
Reads browser cookies
- Loader.exe (PID: 3644)
Accesses Microsoft Outlook profiles
- Loader.exe (PID: 3644)
Searches for installed software
- Loader.exe (PID: 3644)
Starts itself from another location
- Loader.exe (PID: 3644)
Reads the Internet Settings
- Loader.exe (PID: 3644)
INFO
Drops the executable file immediately after the start
- WinRAR.exe (PID: 844)
Manual execution by a user
- WinRAR.exe (PID: 1036)
- Loader.exe (PID: 3644)
- WinRAR.exe (PID: 2920)
- WinRAR.exe (PID: 2072)
- cmd.exe (PID: 2608)
- taskmgr.exe (PID: 2968)
- WinRAR.exe (PID: 2332)
- wmpnscfg.exe (PID: 4076)
Checks supported languages
- Loader.exe (PID: 3644)
- IEUpdater140.exe (PID: 3272)
- wmpnscfg.exe (PID: 4076)
Reads the computer name
- Loader.exe (PID: 3644)
- IEUpdater140.exe (PID: 3272)
- wmpnscfg.exe (PID: 4076)
Reads the machine GUID from the registry
- Loader.exe (PID: 3644)
- IEUpdater140.exe (PID: 3272)
Create files in a temporary directory
- Loader.exe (PID: 3644)
Reads product name
- Loader.exe (PID: 3644)
Reads CPU info
- Loader.exe (PID: 3644)
Creates files in the program directory
- Loader.exe (PID: 3644)
Reads Environment values
- Loader.exe (PID: 3644)
Creates files or folders in the user directory
- Loader.exe (PID: 3644)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
RisePro
(PID) Process(3272) IEUpdater140.exe
C246.4.10.254
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 10 |
|---|---|
| ZipBitFlag: | - |
| ZipCompression: | None |
| ZipModifyDate: | 2023:10:14 16:07:04 |
| ZipCRC: | 0x00000000 |
| ZipCompressedSize: | - |
| ZipUncompressedSize: | - |
| ZipFileName: | Cs 2 SkinChanger/ |
Total processes
63
Monitored processes
13
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 844 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Cs 2 SkinChanger.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 1036 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\New WinRAR archive.rar" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 2072 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\New WinRAR ZIP archive.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 2332 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\New WinRAR archive.rar" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 2608 | "C:\Windows\system32\cmd.exe" | C:\Windows\System32\cmd.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2920 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\New WinRAR ZIP archive.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 2968 | "C:\Windows\system32\taskmgr.exe" /4 | C:\Windows\System32\taskmgr.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Task Manager Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3272 | "C:\ProgramData\IEUpdater140\IEUpdater140.exe" | C:\ProgramData\IEUpdater140\IEUpdater140.exe | Loader.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
RisePro(PID) Process(3272) IEUpdater140.exe C246.4.10.254 | |||||||||||||||
| 3504 | schtasks /create /f /RU "admin" /tr "C:\ProgramData\IEUpdater140\IEUpdater140.exe" /tn "IEUpdater140 LG" /sc ONLOGON /rl HIGHEST | C:\Windows\System32\schtasks.exe | — | Loader.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Manages scheduled tasks Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3644 | "C:\Users\admin\Desktop\Cs 2 SkinChanger\Loader.exe" | C:\Users\admin\Desktop\Cs 2 SkinChanger\Loader.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221225477 Modules
| |||||||||||||||
Total events
10 147
Read events
9 954
Write events
188
Delete events
5
Modification events
| (PID) Process: | (844) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (844) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip | |||
| (PID) Process: | (844) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
| (PID) Process: | (844) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\phacker.zip | |||
| (PID) Process: | (844) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (844) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (844) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (844) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (844) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin |
| Operation: | write | Name: | Placement |
Value: 2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000 | |||
| (PID) Process: | (844) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\General |
| Operation: | write | Name: | LastFolder |
Value: C:\Users\admin\Desktop | |||
Executable files
7
Suspicious files
41
Text files
12
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 844 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb844.40742\Cs 2 SkinChanger\bin\UbuilderB.dll | executable | |
MD5:F474BAF2F922F8485752170CC261A72B | SHA256:2F9A39635D6A379577B073945477609C3AB3656C4ADC54A0D7CCE23C4432C04F | |||
| 844 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb844.40742\Cs 2 SkinChanger\bin\scv.jar | text | |
MD5:8D94FB4EF8D7ABCB571F4A0C40BC8600 | SHA256:4C49A4774B4185035A923FA4585E5A9B469A4A1CEB115DA738C62D3D0EBF299E | |||
| 844 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb844.40742\Cs 2 SkinChanger\xNet.dll | binary | |
MD5:E50D4C24DDFB38D5C8779346A9266D8D | SHA256:80B5B9A2A344BC99CFDA96E4EB87DED45484FA1E3C31FC6F4BC332F60923A398 | |||
| 844 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb844.40742\Cs 2 SkinChanger\packages\settingss | binary | |
MD5:72AC596D894D392F128D420BD9EFB8C1 | SHA256:21035CA1D402FEE0DC9ADF2907FA7C98627D0E89054C04712470129CCE4F7A63 | |||
| 3644 | Loader.exe | C:\Users\admin\AppData\Local\Temp\posterBoxzQUxG0Nz1Yc87\D87fZN3R3jFeWeb Data | binary | |
MD5:F47EB60CDF981C17722D0CE740129927 | SHA256:0210071DF12CA42D70DCB679926668AE072264705AC139A24F94BBC5A129DD8F | |||
| 3644 | Loader.exe | C:\Users\admin\AppData\Local\Temp\posterBoxzQUxG0Nz1Yc87\8ghN89CsjOW1key4.db | binary | |
MD5:F62D8E993EA9C3B3A89DA19E4012638D | SHA256:0971230A77EE2C3531E8B97E14954692713D5F7C8684788F4A823BBC05AD377A | |||
| 3644 | Loader.exe | C:\Users\admin\AppData\Local\Temp\posterBoxzQUxG0Nz1Yc87\02zdBXl47cvzkey4.db | binary | |
MD5:F62D8E993EA9C3B3A89DA19E4012638D | SHA256:0971230A77EE2C3531E8B97E14954692713D5F7C8684788F4A823BBC05AD377A | |||
| 3644 | Loader.exe | C:\Users\admin\AppData\Local\Temp\posterBoxzQUxG0Nz1Yc87\02zdBXl47cvzHistory | binary | |
MD5:FBD34F0AB5E3F18371CF71395F40C3C5 | SHA256:17C9F4CB0FA71685013A864174352D87B1FE35CC3F3B499DF92EEDA3ABB8F862 | |||
| 3644 | Loader.exe | C:\Users\admin\AppData\Local\Temp\posterBoxzQUxG0Nz1Yc87\D87fZN3R3jFekey4.db | binary | |
MD5:F62D8E993EA9C3B3A89DA19E4012638D | SHA256:0971230A77EE2C3531E8B97E14954692713D5F7C8684788F4A823BBC05AD377A | |||
| 3644 | Loader.exe | C:\Users\admin\AppData\Local\Temp\posterBoxzQUxG0Nz1Yc87\8ghN89CsjOW1Login Data For Account | binary | |
MD5:02D2C46697E3714E49F46B680B9A6B83 | SHA256:522CAD95D3FA6EBB3274709B8D09BBB1CA37389D0A924CD29E934A75AA04C6C9 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
11
DNS requests
2
Threats
15
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2588 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
3644 | Loader.exe | 46.4.10.254:50500 | — | Hetzner Online GmbH | DE | malicious |
3644 | Loader.exe | 34.117.59.81:443 | ipinfo.io | GOOGLE-CLOUD-PLATFORM | US | whitelisted |
3644 | Loader.exe | 104.26.4.15:443 | db-ip.com | CLOUDFLARENET | US | unknown |
3272 | IEUpdater140.exe | 46.4.10.254:50500 | — | Hetzner Online GmbH | DE | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
ipinfo.io |
| shared |
db-ip.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
3644 | Loader.exe | Malware Command and Control Activity Detected | ET MALWARE [ANY.RUN] RisePro TCP (Token) |
3644 | Loader.exe | Malware Command and Control Activity Detected | STEALER [ANY.RUN] RisePro TCP (Token) |
3644 | Loader.exe | Malware Command and Control Activity Detected | ET MALWARE [ANY.RUN] RisePro TCP (External IP) |
3644 | Loader.exe | Malware Command and Control Activity Detected | STEALER [ANY.RUN] RisePro TCP (External IP Check) |
3644 | Loader.exe | A Network Trojan was detected | ET MALWARE Suspected RisePro TCP Heartbeat Packet |
3644 | Loader.exe | Device Retrieving External IP Address Detected | ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) |
3644 | Loader.exe | Malware Command and Control Activity Detected | STEALER [ANY.RUN] RisePro TCP (get_settings) |
3644 | Loader.exe | Malware Command and Control Activity Detected | ET MALWARE [ANY.RUN] RisePro TCP (Exfiltration) |
3644 | Loader.exe | Successful Credential Theft Detected | STEALER [ANY.RUN] RisePro TCP (exfiltration) |
3272 | IEUpdater140.exe | Malware Command and Control Activity Detected | ET MALWARE [ANY.RUN] RisePro TCP (Token) |