risepro | 699773d2bcf852aa7bc135e626fe5a08a9b284aac090df12dd754c184c8a2063

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 17:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 2.3MB
Sample240128-vh77haebd2
SHA256 699773d2bcf852aa7bc135e626fe5a08a9b284aac090df12dd754c184c8a2063
MD5 76d4a943f3e5287c78f094237f3562b2
SHA1 33e08d867ef636a3e8f6b5d2d98e55212793e45b
SHA512 07f3d6c07505ac88efb74e935d0e4348c62897482bedde93ee6f0ac4d487a8952597895aae53cc77f85b9f52bd390265fd9c6a71d132e46c0515e8c166d18dad
SSDEEP 49152:AkQTAktLCMiS7dLdIm6RjwZuHB1eWn0N7I4hNVsJZkwoGCURHz:AakZCMF7JC3RMEWy0NdsP+URHz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

risepro stealer

Malware Config

Extracted

Family

risepro

109.107.182.26:50500

Signatures

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

.NET Reactor proctector 3 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/memory/868-2-0x0000000005440000-0x000000000566C000-memory.dmp	net_reactor
behavioral2/memory/868-5-0x0000000005210000-0x000000000543C000-memory.dmp	net_reactor
behavioral2/memory/868-14-0x0000000002C80000-0x0000000004C80000-memory.dmp	net_reactor

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 868 set thread context of 4316	868	file.exe	85

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 5108	868	file.exe	84
PID 868 wrote to memory of 5108	868	file.exe	84
PID 868 wrote to memory of 5108	868	file.exe	84
PID 868 wrote to memory of 4316	868	file.exe	85
PID 868 wrote to memory of 4316	868	file.exe	85
PID 868 wrote to memory of 4316	868	file.exe	85
PID 868 wrote to memory of 4316	868	file.exe	85
PID 868 wrote to memory of 4316	868	file.exe	85
PID 868 wrote to memory of 4316	868	file.exe	85
PID 868 wrote to memory of 4316	868	file.exe	85
PID 868 wrote to memory of 4316	868	file.exe	85
PID 868 wrote to memory of 4316	868	file.exe	85
PID 868 wrote to memory of 4316	868	file.exe	85
PID 868 wrote to memory of 4316	868	file.exe	85
PID 868 wrote to memory of 4316	868	file.exe	85

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:868
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5108
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/868-6-0x0000000005200000-0x0000000005210000-memory.dmp

Download

memory/868-1-0x0000000005200000-0x0000000005210000-memory.dmp

Download

memory/868-2-0x0000000005440000-0x000000000566C000-memory.dmp

Download

memory/868-3-0x0000000005200000-0x0000000005210000-memory.dmp

Download

memory/868-5-0x0000000005210000-0x000000000543C000-memory.dmp

Download

memory/868-4-0x0000000005670000-0x0000000005C14000-memory.dmp

Download

memory/868-0-0x0000000074CB0000-0x0000000075460000-memory.dmp

Download

memory/868-14-0x0000000002C80000-0x0000000004C80000-memory.dmp

Download

memory/868-15-0x0000000074CB0000-0x0000000075460000-memory.dmp

Download

memory/4316-9-0x0000000000400000-0x0000000000800000-memory.dmp

Download

memory/4316-13-0x0000000000400000-0x0000000000800000-memory.dmp

Download

memory/4316-18-0x0000000000400000-0x0000000000800000-memory.dmp

Download

memory/4316-21-0x0000000000400000-0x0000000000800000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads