risepro | 1e612571131d0b3cbfa9b5b60865815e1ec79703920d6834509e6792d068a49a

Analysis

max time kernel
90s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09-02-2024 08:00

Target

file.exe
Size

2.4MB
MD5

78381401bb3b7d0af0d2c7896003f7bf
SHA1

b7684564b7ede67faae6773030960a1f3e68737a
SHA256

1e612571131d0b3cbfa9b5b60865815e1ec79703920d6834509e6792d068a49a
SHA512

68e613b966346f09245502a995127b476a0456d772248987718a76dd59109829c6836191b416263de7942528da3c0260a6f489c9fdd5fe2c52eb3597af422ecc
SSDEEP

49152:fPd3Q5c3zVS10KM+q7mXgFLK6lmluHQPNaATXG63btgjaTqM:dQ5cpS1Hqe/NaAK63BgjaTqM

Score

10^/10

risepro stealer

Family

risepro

193.233.132.67:5000

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2964 set thread context of 4496	2964	file.exe	87

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 4496	2964	file.exe	87
PID 2964 wrote to memory of 4496	2964	file.exe	87
PID 2964 wrote to memory of 4496	2964	file.exe	87
PID 2964 wrote to memory of 4496	2964	file.exe	87
PID 2964 wrote to memory of 4496	2964	file.exe	87
PID 2964 wrote to memory of 4496	2964	file.exe	87
PID 2964 wrote to memory of 4496	2964	file.exe	87
PID 2964 wrote to memory of 4496	2964	file.exe	87
PID 2964 wrote to memory of 4496	2964	file.exe	87
PID 2964 wrote to memory of 4496	2964	file.exe	87
PID 2964 wrote to memory of 4496	2964	file.exe	87
PID 2964 wrote to memory of 4496	2964	file.exe	87

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4496

memory/2964-0-0x0000000000740000-0x00000000009A2000-memory.dmp

Filesize
2.4MB

Download
memory/2964-1-0x0000000074B40000-0x00000000752F0000-memory.dmp

Filesize
7.7MB

Download
memory/2964-2-0x0000000002DE0000-0x0000000002DF0000-memory.dmp

Filesize
64KB

Download
memory/2964-10-0x0000000074B40000-0x00000000752F0000-memory.dmp

Filesize
7.7MB

Download
memory/2964-13-0x0000000002FE0000-0x0000000004FE0000-memory.dmp

Filesize
32.0MB

Download
memory/2964-18-0x0000000002FE0000-0x0000000004FE0000-memory.dmp

Filesize
32.0MB

Download
memory/4496-5-0x0000000000400000-0x0000000000841000-memory.dmp

Filesize
4.3MB

Download
memory/4496-9-0x0000000000400000-0x0000000000841000-memory.dmp

Filesize
4.3MB

Download
memory/4496-14-0x0000000000400000-0x0000000000841000-memory.dmp

Filesize
4.3MB

Download
memory/4496-15-0x0000000000400000-0x0000000000841000-memory.dmp

Filesize
4.3MB

Download
memory/4496-19-0x0000000000400000-0x0000000000841000-memory.dmp

Filesize
4.3MB

Download