risepro | ff6d1e2e67efbf5eae5a6814c8655423e67f48fc8c2375d158e0c1f8e3e9e144

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2024, 21:33

Target

b716baea0866421f013912e77e5db815.exe
Size

1.5MB
MD5

b716baea0866421f013912e77e5db815
SHA1

bb1f3c97e58729b476f19d4c70a825eeaacdb9cd
SHA256

ff6d1e2e67efbf5eae5a6814c8655423e67f48fc8c2375d158e0c1f8e3e9e144
SHA512

29fbf96d747405fe72035fe50e308f3238ba2576d1cf24a51b09c67b1081c33dfe2ece6e78f5232b69150b132be17b27b79066be64d7b6365d7db7ffec96a11b
SSDEEP

24576:Zj9bjkIP9yCNPPZW1XCzQ4J0vbl9bK/0NfmafPpLrloEJzU1WwlIiYTJiOV2Exwu:1ZBZrq1DusNfxPpJJzUceRYTXgEuu

Score

10^/10

risepro stealer

Family

risepro

193.233.132.62:50500

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2496 set thread context of 5012	2496	b716baea0866421f013912e77e5db815.exe	40

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 5012	2496	b716baea0866421f013912e77e5db815.exe	40
PID 2496 wrote to memory of 5012	2496	b716baea0866421f013912e77e5db815.exe	40
PID 2496 wrote to memory of 5012	2496	b716baea0866421f013912e77e5db815.exe	40
PID 2496 wrote to memory of 5012	2496	b716baea0866421f013912e77e5db815.exe	40
PID 2496 wrote to memory of 5012	2496	b716baea0866421f013912e77e5db815.exe	40
PID 2496 wrote to memory of 5012	2496	b716baea0866421f013912e77e5db815.exe	40
PID 2496 wrote to memory of 5012	2496	b716baea0866421f013912e77e5db815.exe	40
PID 2496 wrote to memory of 5012	2496	b716baea0866421f013912e77e5db815.exe	40
PID 2496 wrote to memory of 5012	2496	b716baea0866421f013912e77e5db815.exe	40
PID 2496 wrote to memory of 5012	2496	b716baea0866421f013912e77e5db815.exe	40

C:\Users\Admin\AppData\Local\Temp\b716baea0866421f013912e77e5db815.exe
"C:\Users\Admin\AppData\Local\Temp\b716baea0866421f013912e77e5db815.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5012

memory/2496-1-0x0000000074440000-0x0000000074BF0000-memory.dmp

Filesize
7.7MB

Download
memory/2496-0-0x0000000000C50000-0x0000000000DCC000-memory.dmp

Filesize
1.5MB

Download
memory/2496-2-0x00000000057C0000-0x00000000057D0000-memory.dmp

Filesize
64KB

Download
memory/2496-8-0x0000000003200000-0x0000000005200000-memory.dmp

Filesize
32.0MB

Download
memory/2496-11-0x0000000074440000-0x0000000074BF0000-memory.dmp

Filesize
7.7MB

Download
memory/5012-5-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download
memory/5012-7-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download
memory/5012-13-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download
memory/5012-10-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download