risepro | f00960758e817161a35d897afdaffe12ece240e16b5315d0d9aaf7c63e7fd619

Analysis

max time kernel
145s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
24/03/2024, 22:27

Target

file.exe
Size

2.3MB
MD5

9c32d6bfff2dc20914a7f67c4b3dab5c
SHA1

64e0ac3ed536b7401dbb4eb2ef389f5d26e8d12e
SHA256

f00960758e817161a35d897afdaffe12ece240e16b5315d0d9aaf7c63e7fd619
SHA512

0109a5eb932f80649c679e6e86cd26299f89ce1a36fd52093385bb1b4e5b399351ca9b437a56c9213a6be37cce8909916c47f3d418d84c5f730e574c4717ce66
SSDEEP

49152:6UENWo8koI3hM1FI9LaMAcPmu6/XnZd5e9TXu35YOUoVE2l/nh2JqG:588GRM1FI9La1c+LvZ0TXoUJu/s

Score

10^/10

risepro stealer

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2084 set thread context of 3116	2084	file.exe	97

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 3116	2084	file.exe	97
PID 2084 wrote to memory of 3116	2084	file.exe	97
PID 2084 wrote to memory of 3116	2084	file.exe	97
PID 2084 wrote to memory of 3116	2084	file.exe	97
PID 2084 wrote to memory of 3116	2084	file.exe	97
PID 2084 wrote to memory of 3116	2084	file.exe	97
PID 2084 wrote to memory of 3116	2084	file.exe	97
PID 2084 wrote to memory of 3116	2084	file.exe	97
PID 2084 wrote to memory of 3116	2084	file.exe	97
PID 2084 wrote to memory of 3116	2084	file.exe	97
PID 2084 wrote to memory of 3116	2084	file.exe	97
PID 2084 wrote to memory of 3116	2084	file.exe	97

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4084 --field-trial-handle=2276,i,5672504106535478802,17394903851940863593,262144 --variations-seed-version /prefetch:8
1⤵
PID:4512

memory/2084-0-0x00000000000A0000-0x00000000002FA000-memory.dmp

Filesize
2.4MB

Download
memory/2084-1-0x0000000075180000-0x0000000075930000-memory.dmp

Filesize
7.7MB

Download
memory/2084-8-0x0000000075180000-0x0000000075930000-memory.dmp

Filesize
7.7MB

Download
memory/2084-9-0x00000000027D0000-0x00000000047D0000-memory.dmp

Filesize
32.0MB

Download
memory/2084-19-0x00000000027D0000-0x00000000047D0000-memory.dmp

Filesize
32.0MB

Download
memory/3116-4-0x0000000000400000-0x0000000000846000-memory.dmp

Filesize
4.3MB

Download
memory/3116-10-0x0000000000400000-0x0000000000846000-memory.dmp

Filesize
4.3MB

Download
memory/3116-12-0x0000000000400000-0x0000000000846000-memory.dmp

Filesize
4.3MB

Download
memory/3116-16-0x0000000000400000-0x0000000000846000-memory.dmp

Filesize
4.3MB

Download