risepro | ff6d1e2e67efbf5eae5a6814c8655423e67f48fc8c2375d158e0c1f8e3e9e144

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
18-01-2024 21:33

Target

b716baea0866421f013912e77e5db815.exe
Size

1.5MB
MD5

b716baea0866421f013912e77e5db815
SHA1

bb1f3c97e58729b476f19d4c70a825eeaacdb9cd
SHA256

ff6d1e2e67efbf5eae5a6814c8655423e67f48fc8c2375d158e0c1f8e3e9e144
SHA512

29fbf96d747405fe72035fe50e308f3238ba2576d1cf24a51b09c67b1081c33dfe2ece6e78f5232b69150b132be17b27b79066be64d7b6365d7db7ffec96a11b
SSDEEP

24576:Zj9bjkIP9yCNPPZW1XCzQ4J0vbl9bK/0NfmafPpLrloEJzU1WwlIiYTJiOV2Exwu:1ZBZrq1DusNfxPpJJzUceRYTXgEuu

Score

10^/10

risepro stealer

Family

risepro

193.233.132.62:50500

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1732 set thread context of 2440	1732	b716baea0866421f013912e77e5db815.exe	28

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2440	1732	b716baea0866421f013912e77e5db815.exe	28
PID 1732 wrote to memory of 2440	1732	b716baea0866421f013912e77e5db815.exe	28
PID 1732 wrote to memory of 2440	1732	b716baea0866421f013912e77e5db815.exe	28
PID 1732 wrote to memory of 2440	1732	b716baea0866421f013912e77e5db815.exe	28
PID 1732 wrote to memory of 2440	1732	b716baea0866421f013912e77e5db815.exe	28
PID 1732 wrote to memory of 2440	1732	b716baea0866421f013912e77e5db815.exe	28
PID 1732 wrote to memory of 2440	1732	b716baea0866421f013912e77e5db815.exe	28
PID 1732 wrote to memory of 2440	1732	b716baea0866421f013912e77e5db815.exe	28
PID 1732 wrote to memory of 2440	1732	b716baea0866421f013912e77e5db815.exe	28
PID 1732 wrote to memory of 2440	1732	b716baea0866421f013912e77e5db815.exe	28
PID 1732 wrote to memory of 2440	1732	b716baea0866421f013912e77e5db815.exe	28
PID 1732 wrote to memory of 2440	1732	b716baea0866421f013912e77e5db815.exe	28
PID 1732 wrote to memory of 2440	1732	b716baea0866421f013912e77e5db815.exe	28
PID 1732 wrote to memory of 2440	1732	b716baea0866421f013912e77e5db815.exe	28

C:\Users\Admin\AppData\Local\Temp\b716baea0866421f013912e77e5db815.exe
"C:\Users\Admin\AppData\Local\Temp\b716baea0866421f013912e77e5db815.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2440

memory/1732-0-0x0000000000860000-0x00000000009DC000-memory.dmp

Filesize
1.5MB

Download
memory/1732-1-0x0000000074730000-0x0000000074E1E000-memory.dmp

Filesize
6.9MB

Download
memory/1732-4-0x0000000002300000-0x0000000004300000-memory.dmp

Filesize
32.0MB

Download
memory/1732-18-0x0000000074730000-0x0000000074E1E000-memory.dmp

Filesize
6.9MB

Download
memory/2440-9-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download
memory/2440-7-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download
memory/2440-6-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download
memory/2440-10-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download
memory/2440-11-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download
memory/2440-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2440-14-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download
memory/2440-17-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download
memory/2440-5-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download
memory/2440-20-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download