risepro | 557c5b6678b5b3badb6a7703e4491a9b354a353cdef83c4f6415b422cd17a999

General

Target

61266f99271cd5605d384c2953ac4fbf.bin.exe
Size

7.0MB
MD5

61266f99271cd5605d384c2953ac4fbf
SHA1

7fcb8f33884fb424f1a5851f6ed68362997aa884
SHA256

557c5b6678b5b3badb6a7703e4491a9b354a353cdef83c4f6415b422cd17a999
SHA512

0bd15724bfa7e76cdb60117c19ad9f42eb6a0416dff2ead7137ddbb2d4d81ad30d5eb66bc305401e6433009a44b79c0c11a5112bf8540ac9a4d9c399421d2262
SSDEEP

196608:It8PV1rMoVGrX5PhPLLsGu7uni07ix9MENvpdd:ISV1rMoO5ZPcGxi0w+Gpdd

Score

10^/10

risepro zgrat rat stealer

Malware Config

Extracted

Family

risepro

C2

195.20.16.210:50500

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral1/memory/2172-1-0x0000000000110000-0x0000000000818000-memory.dmp	family_zgrat_v1

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/memory/2172-1-0x0000000000110000-0x0000000000818000-memory.dmp	net_reactor

Loads dropped DLL 1 IoCs

pid	Process
2172	61266f99271cd5605d384c2953ac4fbf.bin.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2172 set thread context of 2796	2172	61266f99271cd5605d384c2953ac4fbf.bin.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2796	2172	61266f99271cd5605d384c2953ac4fbf.bin.exe	28
PID 2172 wrote to memory of 2796	2172	61266f99271cd5605d384c2953ac4fbf.bin.exe	28
PID 2172 wrote to memory of 2796	2172	61266f99271cd5605d384c2953ac4fbf.bin.exe	28
PID 2172 wrote to memory of 2796	2172	61266f99271cd5605d384c2953ac4fbf.bin.exe	28
PID 2172 wrote to memory of 2796	2172	61266f99271cd5605d384c2953ac4fbf.bin.exe	28
PID 2172 wrote to memory of 2796	2172	61266f99271cd5605d384c2953ac4fbf.bin.exe	28
PID 2172 wrote to memory of 2796	2172	61266f99271cd5605d384c2953ac4fbf.bin.exe	28
PID 2172 wrote to memory of 2796	2172	61266f99271cd5605d384c2953ac4fbf.bin.exe	28
PID 2172 wrote to memory of 2796	2172	61266f99271cd5605d384c2953ac4fbf.bin.exe	28
PID 2172 wrote to memory of 2796	2172	61266f99271cd5605d384c2953ac4fbf.bin.exe	28
PID 2172 wrote to memory of 2796	2172	61266f99271cd5605d384c2953ac4fbf.bin.exe	28

C:\Users\Admin\AppData\Local\Temp\61266f99271cd5605d384c2953ac4fbf.bin.exe
"C:\Users\Admin\AppData\Local\Temp\61266f99271cd5605d384c2953ac4fbf.bin.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  2⤵
  PID:2796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\Protect544cd51a.dll

Filesize
742KB

MD5
544cd51a596619b78e9b54b70088307d

SHA1
4769ddd2dbc1dc44b758964ed0bd231b85880b65

SHA256
dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd

SHA512
f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719

Download Submit
memory/2172-16-0x0000000001030000-0x0000000001070000-memory.dmp

Filesize
256KB

Download
memory/2172-11-0x0000000001030000-0x0000000001070000-memory.dmp

Filesize
256KB

Download
memory/2172-3-0x0000000001030000-0x0000000001070000-memory.dmp

Filesize
256KB

Download
memory/2172-4-0x0000000006BA0000-0x0000000006EA4000-memory.dmp

Filesize
3.0MB

Download
memory/2172-5-0x0000000008110000-0x00000000082A2000-memory.dmp

Filesize
1.6MB

Download
memory/2172-1-0x0000000000110000-0x0000000000818000-memory.dmp

Filesize
7.0MB

Download
memory/2172-10-0x0000000001030000-0x0000000001070000-memory.dmp

Filesize
256KB

Download
memory/2172-17-0x0000000001030000-0x0000000001070000-memory.dmp

Filesize
256KB

Download
memory/2172-12-0x00000000009C0000-0x00000000009D0000-memory.dmp

Filesize
64KB

Download
memory/2172-14-0x0000000001030000-0x0000000001070000-memory.dmp

Filesize
256KB

Download
memory/2172-13-0x0000000001030000-0x0000000001070000-memory.dmp

Filesize
256KB

Download
memory/2172-0-0x0000000073D00000-0x00000000743EE000-memory.dmp

Filesize
6.9MB

Download
memory/2172-2-0x0000000073D00000-0x00000000743EE000-memory.dmp

Filesize
6.9MB

Download
memory/2172-34-0x0000000073D00000-0x00000000743EE000-memory.dmp

Filesize
6.9MB

Download
memory/2172-15-0x0000000008400000-0x0000000008500000-memory.dmp

Filesize
1024KB

Download
memory/2796-31-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download
memory/2796-22-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download
memory/2796-24-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download
memory/2796-26-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download
memory/2796-28-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download
memory/2796-30-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2796-20-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download
memory/2796-33-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download
memory/2796-18-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download
memory/2796-35-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing