risepro | f00960758e817161a35d897afdaffe12ece240e16b5315d0d9aaf7c63e7fd619

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24/03/2024, 22:29

Target

file.exe
Size

2.3MB
MD5

9c32d6bfff2dc20914a7f67c4b3dab5c
SHA1

64e0ac3ed536b7401dbb4eb2ef389f5d26e8d12e
SHA256

f00960758e817161a35d897afdaffe12ece240e16b5315d0d9aaf7c63e7fd619
SHA512

0109a5eb932f80649c679e6e86cd26299f89ce1a36fd52093385bb1b4e5b399351ca9b437a56c9213a6be37cce8909916c47f3d418d84c5f730e574c4717ce66
SSDEEP

49152:6UENWo8koI3hM1FI9LaMAcPmu6/XnZd5e9TXu35YOUoVE2l/nh2JqG:588GRM1FI9La1c+LvZ0TXoUJu/s

Score

10^/10

risepro stealer

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4636 set thread context of 1384	4636	file.exe	90

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 1384	4636	file.exe	90
PID 4636 wrote to memory of 1384	4636	file.exe	90
PID 4636 wrote to memory of 1384	4636	file.exe	90
PID 4636 wrote to memory of 1384	4636	file.exe	90
PID 4636 wrote to memory of 1384	4636	file.exe	90
PID 4636 wrote to memory of 1384	4636	file.exe	90
PID 4636 wrote to memory of 1384	4636	file.exe	90
PID 4636 wrote to memory of 1384	4636	file.exe	90
PID 4636 wrote to memory of 1384	4636	file.exe	90
PID 4636 wrote to memory of 1384	4636	file.exe	90
PID 4636 wrote to memory of 1384	4636	file.exe	90
PID 4636 wrote to memory of 1384	4636	file.exe	90

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1384

memory/1384-4-0x0000000000400000-0x0000000000846000-memory.dmp

Filesize
4.3MB

Download
memory/1384-9-0x0000000000400000-0x0000000000846000-memory.dmp

Filesize
4.3MB

Download
memory/1384-12-0x0000000000400000-0x0000000000846000-memory.dmp

Filesize
4.3MB

Download
memory/1384-16-0x0000000000400000-0x0000000000846000-memory.dmp

Filesize
4.3MB

Download
memory/4636-1-0x0000000075350000-0x0000000075B00000-memory.dmp

Filesize
7.7MB

Download
memory/4636-0-0x0000000000660000-0x00000000008BA000-memory.dmp

Filesize
2.4MB

Download
memory/4636-8-0x0000000075350000-0x0000000075B00000-memory.dmp

Filesize
7.7MB

Download
memory/4636-11-0x0000000002DD0000-0x0000000004DD0000-memory.dmp

Filesize
32.0MB

Download
memory/4636-19-0x0000000002DD0000-0x0000000004DD0000-memory.dmp

Filesize
32.0MB

Download