analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | line.exe |
| Full analysis: | https://app.any.run/tasks/15a2655d-5ad7-4944-a2e1-afd853b16602 |
| Verdict: | Malicious activity |
| Threats: | RisePro, an information-stealing malware, targets a wide range of sensitive data, including credit cards, passwords, and cryptocurrency wallets. By compromising infected devices, RisePro can steal valuable information and potentially cause significant financial and personal losses for victims. |
| Analysis date: | December 19, 2023 at 00:00:57 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | C3A03AB196EE086BD46B97B6D69EB0C7 |
| SHA1: | 96E0EC827C33C4C97313754E8D3D9DF4B25B1F0C |
| SHA256: | 7CFA46DFB53C0EFEE3D57AF2AA83F9513C27C91E569E952C22E4B022D16E6E27 |
| SSDEEP: | 49152:PLnemIH2fhzq6GWYg3D/xX1mATReFahd6MGerfuh9ddjKy82b9xndaacs3xb4krC:Tn2H2fhzuWLTxz4Fosyru9dduV2b9xng |
MALICIOUS
Drops the executable file immediately after the start
- line.exe (PID: 124)
- NJ9by71.exe (PID: 1432)
- AppLaunch.exe (PID: 3100)
Create files in the Startup directory
- AppLaunch.exe (PID: 3100)
Uses Task Scheduler to autorun other applications
- cmd.exe (PID: 2800)
RISEPRO has been detected (SURICATA)
- AppLaunch.exe (PID: 3100)
Connects to the CnC server
- AppLaunch.exe (PID: 3100)
RISEPRO has been detected (YARA)
- AppLaunch.exe (PID: 3100)
Steals credentials from Web Browsers
- AppLaunch.exe (PID: 3100)
Steals credentials
- AppLaunch.exe (PID: 3100)
Uses Task Scheduler to run other applications
- cmd.exe (PID: 1844)
Actions looks like stealing of personal data
- AppLaunch.exe (PID: 3100)
SUSPICIOUS
Process drops legitimate windows executable
- line.exe (PID: 124)
- AppLaunch.exe (PID: 3100)
Reads the Internet Settings
- 1un50xH4.exe (PID: 1356)
- AppLaunch.exe (PID: 3100)
Connects to unusual port
- AppLaunch.exe (PID: 3100)
Reads settings of System Certificates
- AppLaunch.exe (PID: 3100)
Checks for external IP
- AppLaunch.exe (PID: 3100)
Reads browser cookies
- AppLaunch.exe (PID: 3100)
Accesses Microsoft Outlook profiles
- AppLaunch.exe (PID: 3100)
Starts CMD.EXE for commands execution
- AppLaunch.exe (PID: 3100)
Searches for installed software
- AppLaunch.exe (PID: 3100)
INFO
Checks supported languages
- line.exe (PID: 124)
- NJ9by71.exe (PID: 1432)
- 1un50xH4.exe (PID: 1356)
- AppLaunch.exe (PID: 3100)
- 6Yf9oV3.exe (PID: 784)
- 4vt722nL.exe (PID: 1848)
Create files in a temporary directory
- line.exe (PID: 124)
- NJ9by71.exe (PID: 1432)
- AppLaunch.exe (PID: 3100)
Reads mouse settings
- 1un50xH4.exe (PID: 1356)
Reads the computer name
- 1un50xH4.exe (PID: 1356)
- AppLaunch.exe (PID: 3100)
Application launched itself
- msedge.exe (PID: 2068)
- msedge.exe (PID: 2080)
- msedge.exe (PID: 2032)
- msedge.exe (PID: 2208)
- msedge.exe (PID: 1056)
- msedge.exe (PID: 2408)
- msedge.exe (PID: 764)
- msedge.exe (PID: 1604)
- msedge.exe (PID: 1936)
Reads Environment values
- AppLaunch.exe (PID: 3100)
Reads the machine GUID from the registry
- AppLaunch.exe (PID: 3100)
Creates files or folders in the user directory
- AppLaunch.exe (PID: 3100)
Creates files in the program directory
- AppLaunch.exe (PID: 3100)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (42.2) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (37.3) |
| .dll | | | Win32 Dynamic Link Library (generic) (8.8) |
| .exe | | | Win32 Executable (generic) (6) |
| .exe | | | Generic Win/DOS Executable (2.7) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2022:05:25 00:49:06+02:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 14.13 |
| CodeSize: | 25600 |
| InitializedDataSize: | 989184 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x6a60 |
| OSVersion: | 10 |
| ImageVersion: | 10 |
| SubsystemVersion: | 6 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 11.0.17763.1 |
| ProductVersionNumber: | 11.0.17763.1 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Windows NT 32-bit |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| CompanyName: | Microsoft Corporation |
| FileDescription: | Win32 Cabinet Self-Extractor |
| FileVersion: | 11.00.17763.1 (WinBuild.160101.0800) |
| InternalName: | Wextract |
| LegalCopyright: | © Microsoft Corporation. All rights reserved. |
| OriginalFileName: | WEXTRACT.EXE .MUI |
| ProductName: | Internet Explorer |
| ProductVersion: | 11.00.17763.1 |
Total processes
117
Monitored processes
79
Malicious processes
4
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 124 | "C:\Users\admin\Desktop\line.exe" | C:\Users\admin\Desktop\line.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Win32 Cabinet Self-Extractor Exit code: 0 Version: 11.00.17763.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1432 | C:\Users\admin\AppData\Local\Temp\IXP000.TMP\NJ9by71.exe | C:\Users\admin\AppData\Local\Temp\IXP000.TMP\NJ9by71.exe | — | line.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Win32 Cabinet Self-Extractor Exit code: 0 Version: 11.00.17763.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1356 | C:\Users\admin\AppData\Local\Temp\IXP001.TMP\1un50xH4.exe | C:\Users\admin\AppData\Local\Temp\IXP001.TMP\1un50xH4.exe | — | NJ9by71.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 1056 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/ | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | 1un50xH4.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 2032 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | 1un50xH4.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 2068 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | 1un50xH4.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 2080 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | 1un50xH4.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 2208 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | 1un50xH4.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 2408 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | 1un50xH4.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 492 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=109.0.5414.149 "--annotation=exe=C:\Program Files\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win32 "--annotation=prod=Microsoft Edge" --annotation=ver=109.0.1518.115 --initial-client-data=0x178,0x17c,0x180,0x14c,0x188,0x6e2af598,0x6e2af5a8,0x6e2af5b4 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
Total events
12 469
Read events
12 327
Write events
141
Delete events
1
Modification events
| (PID) Process: | (2068) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (1056) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (1056) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | state |
Value: 1 | |||
| (PID) Process: | (1056) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: 01000000 | |||
| (PID) Process: | (2032) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 1 | |||
| (PID) Process: | (2032) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
| (PID) Process: | (2080) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 2 | |||
| (PID) Process: | (2080) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | state |
Value: 3 | |||
| (PID) Process: | (2208) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 3 | |||
| (PID) Process: | (2208) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | state |
Value: 3 | |||
Executable files
14
Suspicious files
1 154
Text files
88
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 480 | msedge.exe | — | ||
MD5:— | SHA256:— | |||
| 1864 | msedge.exe | — | ||
MD5:— | SHA256:— | |||
| 1504 | msedge.exe | — | ||
MD5:— | SHA256:— | |||
| 1536 | msedge.exe | — | ||
MD5:— | SHA256:— | |||
| 2308 | msedge.exe | — | ||
MD5:— | SHA256:— | |||
| 1728 | msedge.exe | — | ||
MD5:— | SHA256:— | |||
| 1936 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RFdfd4c.TMP | — | |
MD5:— | SHA256:— | |||
| 1936 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 124 | line.exe | C:\Users\admin\AppData\Local\Temp\IXP000.TMP\NJ9by71.exe | executable | |
MD5:832F2019F75789ECCBE6CE360AF449D8 | SHA256:C95B3A8091A3F493C9E70875D4828E73B1DEB2E1C5F1A9EA56484D1E92324827 | |||
| 1432 | NJ9by71.exe | C:\Users\admin\AppData\Local\Temp\IXP001.TMP\4vt722nL.exe | executable | |
MD5:7A7493B4560D5312F0D0DBDD14083567 | SHA256:950750280F0959D3F7EF6971966236993A3E454047D7E1B3E013EB98F711F998 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
131
DNS requests
148
Threats
30
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3100 | AppLaunch.exe | GET | 200 | 184.24.77.194:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?3ae1a0e81c3c71c8 | unknown | compressed | 65.2 Kb | — |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | unknown |
— | — | 224.0.0.252:5355 | — | — | — | unknown |
4 | System | 192.168.100.255:137 | — | — | — | unknown |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
1936 | msedge.exe | 239.255.255.250:1900 | — | — | — | unknown |
3672 | msedge.exe | 20.105.95.163:443 | nav-edge.smartscreen.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
3672 | msedge.exe | 13.107.42.14:443 | www.linkedin.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | unknown |
3672 | msedge.exe | 157.240.0.35:443 | www.facebook.com | FACEBOOK | US | unknown |
3672 | msedge.exe | 92.122.104.90:443 | steamcommunity.com | AKAMAI-AS | DE | unknown |
3672 | msedge.exe | 151.101.129.21:443 | www.paypal.com | FASTLY | US | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
nav-edge.smartscreen.microsoft.com |
| unknown |
www.facebook.com |
| unknown |
steamcommunity.com |
| unknown |
www.linkedin.com |
| unknown |
www.paypal.com |
| unknown |
accounts.google.com |
| unknown |
store.steampowered.com |
| unknown |
edge.microsoft.com |
| unknown |
twitter.com |
| unknown |
www.youtube.com |
| unknown |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Malware Command and Control Activity Detected | ET MALWARE [ANY.RUN] RisePro TCP (Token) |
— | — | Malware Command and Control Activity Detected | STEALER [ANY.RUN] RisePro TCP (Token) |
— | — | A Network Trojan was detected | ET MALWARE jynxLoaderV2 CnC Activity (Outbound) |
— | — | A Network Trojan was detected | ET MALWARE jynxLoaderV2 CnC Activity (Outbound) |
— | — | A Network Trojan was detected | ET MALWARE Suspected RisePro TCP Heartbeat Packet |
— | — | Misc activity | ET INFO Session Traversal Utilities for NAT (STUN Binding Request On Non-Standard High Port) |
— | — | Misc activity | ET INFO Session Traversal Utilities for NAT (STUN Binding Request On Non-Standard High Port) |
— | — | Misc activity | ET INFO Session Traversal Utilities for NAT (STUN Binding Request On Non-Standard High Port) |
— | — | Misc activity | ET INFO Session Traversal Utilities for NAT (STUN Binding Request On Non-Standard High Port) |
— | — | Misc activity | ET INFO Session Traversal Utilities for NAT (STUN Binding Request On Non-Standard High Port) |