risepro | 82e1a2bf56bf88007f83c52216c7f730aa8526cf4c164f6996d48bd8577eb914

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 16:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
613fdc04ffdcb927ce9d48dec7c59538.exe
Size 2.5MB
Sample240204-vcs6dsefa2
SHA256 82e1a2bf56bf88007f83c52216c7f730aa8526cf4c164f6996d48bd8577eb914
MD5 613fdc04ffdcb927ce9d48dec7c59538
SHA1 3c11a3ad2972f59d019a75a8d1ae4fe384eea956
SHA512 5ea0ffb320d3ce50e00e6e0262eceed30133790ae811282c7b97b8c97e822b4d51a2c17e66d77839aab53f1861cb5d92a4765eeac50bc6cb73e80a3f06c76ab9
SSDEEP 24576:Tzmzt8lm28n4BX1BFqO/h1SKrw7d/FWOWKjPBrT8+Vz+oLux4GvWfj3ysdBC3zrp:TsFHjPJJzwKwEyzilfP0r98Cfo/0GUF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

risepro stealer

Malware Config

Extracted

Family

risepro

193.233.132.37:50500

Signatures

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Executes dropped EXE 1 IoCs

pid	Process
3056	䙸㙣㠶䙢扢3

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2360 set thread context of 3056	2360	613fdc04ffdcb927ce9d48dec7c59538.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 3056	2360	613fdc04ffdcb927ce9d48dec7c59538.exe	29
PID 2360 wrote to memory of 3056	2360	613fdc04ffdcb927ce9d48dec7c59538.exe	29
PID 2360 wrote to memory of 3056	2360	613fdc04ffdcb927ce9d48dec7c59538.exe	29
PID 2360 wrote to memory of 3056	2360	613fdc04ffdcb927ce9d48dec7c59538.exe	29
PID 2360 wrote to memory of 3056	2360	613fdc04ffdcb927ce9d48dec7c59538.exe	29
PID 2360 wrote to memory of 3056	2360	613fdc04ffdcb927ce9d48dec7c59538.exe	29
PID 2360 wrote to memory of 3056	2360	613fdc04ffdcb927ce9d48dec7c59538.exe	29
PID 2360 wrote to memory of 3056	2360	613fdc04ffdcb927ce9d48dec7c59538.exe	29
PID 2360 wrote to memory of 3056	2360	613fdc04ffdcb927ce9d48dec7c59538.exe	29
PID 2360 wrote to memory of 3056	2360	613fdc04ffdcb927ce9d48dec7c59538.exe	29
PID 2360 wrote to memory of 3056	2360	613fdc04ffdcb927ce9d48dec7c59538.exe	29

C:\Users\Admin\AppData\Local\Temp\613fdc04ffdcb927ce9d48dec7c59538.exe
"C:\Users\Admin\AppData\Local\Temp\613fdc04ffdcb927ce9d48dec7c59538.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Users\Admin\AppData\Local\Temp\䙸㙣㠶䙢扢3
  "C:\Users\Admin\AppData\Local\Temp\䙸㙣㠶䙢扢3"
  2⤵
  - Executes dropped EXE
  PID:3056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

䙸㙣㠶䙢扢3

Path C:\Users\Admin\AppData\Local\Temp\䙸㙣㠶䙢扢3
Size 36KB
SHA256 4c81f83280a54278e3f9c75f898d67e15dfcfc8c3ed71cc4c8e684a14b5fe1b9
MD5 d167bc2af3b4b2e9c02cb8d87c04918b
SHA1 9aacf8250cf07a0240ec759734b6f24df6516f2c
SHA512 01bd37b631f37c8f55c48e1dd645b1f7d9aaf4b09604a1842eb140d9699ea044d121bc20713c3107e1da4fd446335f07d8ff9dfb0b580471d324be8f84e5dea9
SSDEEP 768:4ergstvpiFAFYaIylkOZMwRCNLcbeG/Hq6g3xJTy/jRU:4eUmxIyYclkOZB4NgbeG/HCxJTy/FU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3056-5-0x0000000000400000-0x0000000000544000-memory.dmp

Download

memory/3056-7-0x0000000000400000-0x0000000000544000-memory.dmp

Download

memory/3056-12-0x0000000000400000-0x0000000000544000-memory.dmp

Download

memory/3056-11-0x0000000000400000-0x0000000000544000-memory.dmp

Download

memory/3056-10-0x0000000000400000-0x0000000000544000-memory.dmp

Download

memory/3056-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/3056-9-0x0000000000400000-0x0000000000544000-memory.dmp

Download

memory/3056-14-0x0000000000400000-0x0000000000544000-memory.dmp

Download

memory/3056-17-0x0000000000400000-0x0000000000544000-memory.dmp

Download

memory/3056-18-0x0000000000400000-0x0000000000544000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads