risepro | 1e612571131d0b3cbfa9b5b60865815e1ec79703920d6834509e6792d068a49a

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09-02-2024 08:00

Target

file.exe
Size

2.4MB
MD5

78381401bb3b7d0af0d2c7896003f7bf
SHA1

b7684564b7ede67faae6773030960a1f3e68737a
SHA256

1e612571131d0b3cbfa9b5b60865815e1ec79703920d6834509e6792d068a49a
SHA512

68e613b966346f09245502a995127b476a0456d772248987718a76dd59109829c6836191b416263de7942528da3c0260a6f489c9fdd5fe2c52eb3597af422ecc
SSDEEP

49152:fPd3Q5c3zVS10KM+q7mXgFLK6lmluHQPNaATXG63btgjaTqM:dQ5cpS1Hqe/NaAK63BgjaTqM

Score

10^/10

risepro stealer

Family

risepro

193.233.132.67:5000

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 456 set thread context of 2724	456	file.exe	29

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 2724	456	file.exe	29
PID 456 wrote to memory of 2724	456	file.exe	29
PID 456 wrote to memory of 2724	456	file.exe	29
PID 456 wrote to memory of 2724	456	file.exe	29
PID 456 wrote to memory of 2724	456	file.exe	29
PID 456 wrote to memory of 2724	456	file.exe	29
PID 456 wrote to memory of 2724	456	file.exe	29
PID 456 wrote to memory of 2724	456	file.exe	29
PID 456 wrote to memory of 2724	456	file.exe	29
PID 456 wrote to memory of 2724	456	file.exe	29
PID 456 wrote to memory of 2724	456	file.exe	29
PID 456 wrote to memory of 2724	456	file.exe	29

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:456
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2724

memory/456-9-0x00000000023F0000-0x00000000043F0000-memory.dmp

Filesize
32.0MB

Download
memory/456-1-0x0000000073E90000-0x000000007457E000-memory.dmp

Filesize
6.9MB

Download
memory/456-17-0x0000000073E90000-0x000000007457E000-memory.dmp

Filesize
6.9MB

Download
memory/456-0-0x0000000000D80000-0x0000000000FE2000-memory.dmp

Filesize
2.4MB

Download
memory/2724-8-0x0000000000400000-0x0000000000841000-memory.dmp

Filesize
4.3MB

Download
memory/2724-7-0x0000000000400000-0x0000000000841000-memory.dmp

Filesize
4.3MB

Download
memory/2724-6-0x0000000000400000-0x0000000000841000-memory.dmp

Filesize
4.3MB

Download
memory/2724-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2724-13-0x0000000000400000-0x0000000000841000-memory.dmp

Filesize
4.3MB

Download
memory/2724-16-0x0000000000400000-0x0000000000841000-memory.dmp

Filesize
4.3MB

Download
memory/2724-4-0x0000000000400000-0x0000000000841000-memory.dmp

Filesize
4.3MB

Download
memory/2724-19-0x0000000000400000-0x0000000000841000-memory.dmp

Filesize
4.3MB

Download
memory/2724-23-0x0000000000400000-0x0000000000841000-memory.dmp

Filesize
4.3MB

Download