risepro | 699773d2bcf852aa7bc135e626fe5a08a9b284aac090df12dd754c184c8a2063

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 17:00

Target

file.exe
Size

2.3MB
MD5

76d4a943f3e5287c78f094237f3562b2
SHA1

33e08d867ef636a3e8f6b5d2d98e55212793e45b
SHA256

699773d2bcf852aa7bc135e626fe5a08a9b284aac090df12dd754c184c8a2063
SHA512

07f3d6c07505ac88efb74e935d0e4348c62897482bedde93ee6f0ac4d487a8952597895aae53cc77f85b9f52bd390265fd9c6a71d132e46c0515e8c166d18dad
SSDEEP

49152:AkQTAktLCMiS7dLdIm6RjwZuHB1eWn0N7I4hNVsJZkwoGCURHz:AakZCMF7JC3RMEWy0NdsP+URHz

Score

10^/10

risepro stealer

Family

risepro

109.107.182.26:50500

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

.NET Reactor proctector 3 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/memory/868-2-0x0000000005440000-0x000000000566C000-memory.dmp	net_reactor
behavioral2/memory/868-5-0x0000000005210000-0x000000000543C000-memory.dmp	net_reactor
behavioral2/memory/868-14-0x0000000002C80000-0x0000000004C80000-memory.dmp	net_reactor

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 868 set thread context of 4316	868	file.exe	85

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 5108	868	file.exe	84
PID 868 wrote to memory of 5108	868	file.exe	84
PID 868 wrote to memory of 5108	868	file.exe	84
PID 868 wrote to memory of 4316	868	file.exe	85
PID 868 wrote to memory of 4316	868	file.exe	85
PID 868 wrote to memory of 4316	868	file.exe	85
PID 868 wrote to memory of 4316	868	file.exe	85
PID 868 wrote to memory of 4316	868	file.exe	85
PID 868 wrote to memory of 4316	868	file.exe	85
PID 868 wrote to memory of 4316	868	file.exe	85
PID 868 wrote to memory of 4316	868	file.exe	85
PID 868 wrote to memory of 4316	868	file.exe	85
PID 868 wrote to memory of 4316	868	file.exe	85
PID 868 wrote to memory of 4316	868	file.exe	85
PID 868 wrote to memory of 4316	868	file.exe	85

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:868
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5108
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4316

memory/868-6-0x0000000005200000-0x0000000005210000-memory.dmp

Filesize
64KB

Download
memory/868-1-0x0000000005200000-0x0000000005210000-memory.dmp

Filesize
64KB

Download
memory/868-2-0x0000000005440000-0x000000000566C000-memory.dmp

Filesize
2.2MB

Download
memory/868-3-0x0000000005200000-0x0000000005210000-memory.dmp

Filesize
64KB

Download
memory/868-5-0x0000000005210000-0x000000000543C000-memory.dmp

Filesize
2.2MB

Download
memory/868-4-0x0000000005670000-0x0000000005C14000-memory.dmp

Filesize
5.6MB

Download
memory/868-0-0x0000000074CB0000-0x0000000075460000-memory.dmp

Filesize
7.7MB

Download
memory/868-14-0x0000000002C80000-0x0000000004C80000-memory.dmp

Filesize
32.0MB

Download
memory/868-15-0x0000000074CB0000-0x0000000075460000-memory.dmp

Filesize
7.7MB

Download
memory/4316-9-0x0000000000400000-0x0000000000800000-memory.dmp

Filesize
4.0MB

Download
memory/4316-13-0x0000000000400000-0x0000000000800000-memory.dmp

Filesize
4.0MB

Download
memory/4316-18-0x0000000000400000-0x0000000000800000-memory.dmp

Filesize
4.0MB

Download
memory/4316-21-0x0000000000400000-0x0000000000800000-memory.dmp

Filesize
4.0MB

Download