risepro | 1e612571131d0b3cbfa9b5b60865815e1ec79703920d6834509e6792d068a49a

Analysis

max time kernel
129s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09-02-2024 08:02

Target

file.exe
Size

2.4MB
MD5

78381401bb3b7d0af0d2c7896003f7bf
SHA1

b7684564b7ede67faae6773030960a1f3e68737a
SHA256

1e612571131d0b3cbfa9b5b60865815e1ec79703920d6834509e6792d068a49a
SHA512

68e613b966346f09245502a995127b476a0456d772248987718a76dd59109829c6836191b416263de7942528da3c0260a6f489c9fdd5fe2c52eb3597af422ecc
SSDEEP

49152:fPd3Q5c3zVS10KM+q7mXgFLK6lmluHQPNaATXG63btgjaTqM:dQ5cpS1Hqe/NaAK63BgjaTqM

Score

10^/10

risepro stealer

Family

risepro

193.233.132.67:5000

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2064 set thread context of 3100	2064	file.exe	84

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 3100	2064	file.exe	84
PID 2064 wrote to memory of 3100	2064	file.exe	84
PID 2064 wrote to memory of 3100	2064	file.exe	84
PID 2064 wrote to memory of 3100	2064	file.exe	84
PID 2064 wrote to memory of 3100	2064	file.exe	84
PID 2064 wrote to memory of 3100	2064	file.exe	84
PID 2064 wrote to memory of 3100	2064	file.exe	84
PID 2064 wrote to memory of 3100	2064	file.exe	84
PID 2064 wrote to memory of 3100	2064	file.exe	84
PID 2064 wrote to memory of 3100	2064	file.exe	84
PID 2064 wrote to memory of 3100	2064	file.exe	84
PID 2064 wrote to memory of 3100	2064	file.exe	84

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3100

memory/2064-0-0x0000000074DD0000-0x0000000075580000-memory.dmp

Filesize
7.7MB

Download
memory/2064-1-0x0000000000030000-0x0000000000292000-memory.dmp

Filesize
2.4MB

Download
memory/2064-2-0x0000000004BF0000-0x0000000004C00000-memory.dmp

Filesize
64KB

Download
memory/2064-9-0x0000000074DD0000-0x0000000075580000-memory.dmp

Filesize
7.7MB

Download
memory/2064-12-0x00000000026A0000-0x00000000046A0000-memory.dmp

Filesize
32.0MB

Download
memory/2064-17-0x00000000026A0000-0x00000000046A0000-memory.dmp

Filesize
32.0MB

Download
memory/3100-5-0x0000000000400000-0x0000000000841000-memory.dmp

Filesize
4.3MB

Download
memory/3100-10-0x0000000000400000-0x0000000000841000-memory.dmp

Filesize
4.3MB

Download
memory/3100-14-0x0000000000400000-0x0000000000841000-memory.dmp

Filesize
4.3MB

Download
memory/3100-18-0x0000000000400000-0x0000000000841000-memory.dmp

Filesize
4.3MB

Download