risepro | fcd80c754b610021ea32a499102db0adaedc807cb9a77cf1424ac82084b63d8e

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
31/03/2024, 06:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3b4e7104765744e1089f0bf6b6007e9c.exe
Size 1.6MB
Sample240331-he9jyaga49
SHA256 fcd80c754b610021ea32a499102db0adaedc807cb9a77cf1424ac82084b63d8e
MD5 3b4e7104765744e1089f0bf6b6007e9c
SHA1 ca23c91db4af3edc3ffa8cd64a35691372fb5f99
SHA512 55d874780a912baf52d6d0dde4f2d6c3f8a4803c4a6608847aa17dd75d9b886c28712740d894740f9707cb8998e56e9c912990a1f3770e7e73149211011c46dc
SSDEEP 24576:jbknCTBN5WBO+vsgvkbXqpNo+abgfzc0ynUy1458JZOLtipMXIH4vaXz9SVFd:3t5WMKsg8kB9rc0Ty1FJZO6VCaXSFd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

risepro stealer

Malware Config

Signatures

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 3920 created 3464	3920	Circuit.pif	57
PID 3920 created 3464	3920	Circuit.pif	57
PID 3920 created 3464	3920	Circuit.pif	57

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	3b4e7104765744e1089f0bf6b6007e9c.exe

Executes dropped EXE 4 IoCs

pid	Process
3920	Circuit.pif
2100	Circuit.pif
3304	Circuit.pif
2156	Circuit.pif

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3920 set thread context of 2156	3920	Circuit.pif	108

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
3128	tasklist.exe
3320	tasklist.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2924	PING.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3920	Circuit.pif
3920	Circuit.pif
3920	Circuit.pif
3920	Circuit.pif
3920	Circuit.pif
3920	Circuit.pif
3920	Circuit.pif
3920	Circuit.pif
3920	Circuit.pif
3920	Circuit.pif
3920	Circuit.pif
3920	Circuit.pif

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3128	tasklist.exe
Token: SeDebugPrivilege	3320	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3920	Circuit.pif
3920	Circuit.pif
3920	Circuit.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3920	Circuit.pif
3920	Circuit.pif
3920	Circuit.pif

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 1568	2736	3b4e7104765744e1089f0bf6b6007e9c.exe	88
PID 2736 wrote to memory of 1568	2736	3b4e7104765744e1089f0bf6b6007e9c.exe	88
PID 2736 wrote to memory of 1568	2736	3b4e7104765744e1089f0bf6b6007e9c.exe	88
PID 1568 wrote to memory of 3128	1568	cmd.exe	90
PID 1568 wrote to memory of 3128	1568	cmd.exe	90
PID 1568 wrote to memory of 3128	1568	cmd.exe	90
PID 1568 wrote to memory of 1252	1568	cmd.exe	91
PID 1568 wrote to memory of 1252	1568	cmd.exe	91
PID 1568 wrote to memory of 1252	1568	cmd.exe	91
PID 1568 wrote to memory of 3320	1568	cmd.exe	93
PID 1568 wrote to memory of 3320	1568	cmd.exe	93
PID 1568 wrote to memory of 3320	1568	cmd.exe	93
PID 1568 wrote to memory of 4848	1568	cmd.exe	94
PID 1568 wrote to memory of 4848	1568	cmd.exe	94
PID 1568 wrote to memory of 4848	1568	cmd.exe	94
PID 1568 wrote to memory of 5052	1568	cmd.exe	97
PID 1568 wrote to memory of 5052	1568	cmd.exe	97
PID 1568 wrote to memory of 5052	1568	cmd.exe	97
PID 1568 wrote to memory of 1148	1568	cmd.exe	98
PID 1568 wrote to memory of 1148	1568	cmd.exe	98
PID 1568 wrote to memory of 1148	1568	cmd.exe	98
PID 1568 wrote to memory of 4728	1568	cmd.exe	99
PID 1568 wrote to memory of 4728	1568	cmd.exe	99
PID 1568 wrote to memory of 4728	1568	cmd.exe	99
PID 1568 wrote to memory of 3920	1568	cmd.exe	100
PID 1568 wrote to memory of 3920	1568	cmd.exe	100
PID 1568 wrote to memory of 3920	1568	cmd.exe	100
PID 1568 wrote to memory of 2924	1568	cmd.exe	101
PID 1568 wrote to memory of 2924	1568	cmd.exe	101
PID 1568 wrote to memory of 2924	1568	cmd.exe	101
PID 3920 wrote to memory of 2100	3920	Circuit.pif	106
PID 3920 wrote to memory of 2100	3920	Circuit.pif	106
PID 3920 wrote to memory of 2100	3920	Circuit.pif	106
PID 3920 wrote to memory of 3304	3920	Circuit.pif	107
PID 3920 wrote to memory of 3304	3920	Circuit.pif	107
PID 3920 wrote to memory of 3304	3920	Circuit.pif	107
PID 3920 wrote to memory of 2156	3920	Circuit.pif	108
PID 3920 wrote to memory of 2156	3920	Circuit.pif	108
PID 3920 wrote to memory of 2156	3920	Circuit.pif	108
PID 3920 wrote to memory of 2156	3920	Circuit.pif	108
PID 3920 wrote to memory of 2156	3920	Circuit.pif	108

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3464
- C:\Users\Admin\AppData\Local\Temp\3b4e7104765744e1089f0bf6b6007e9c.exe
  "C:\Users\Admin\AppData\Local\Temp\3b4e7104765744e1089f0bf6b6007e9c.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move Geographic Geographic.bat & Geographic.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1568
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3128
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa.exe opssvc.exe"
      4⤵
      PID:1252
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3320
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
      4⤵
      PID:4848
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 17265
      4⤵
      PID:5052
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Rx + Both + Interactive + Shakespeare + Not 17265\Circuit.pif
      4⤵
      PID:1148
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Abandoned + Computer + Certified + Psychological + Moderator + Highland + Contamination + Techniques 17265\u
      4⤵
      PID:4728
  - - C:\Users\Admin\AppData\Local\Temp\17265\Circuit.pif
      17265\Circuit.pif 17265\u
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3920
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 5 127.0.0.1
      4⤵
      Runs ping.exe
      PID:2924
- C:\Users\Admin\AppData\Local\Temp\17265\Circuit.pif
  C:\Users\Admin\AppData\Local\Temp\17265\Circuit.pif
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Users\Admin\AppData\Local\Temp\17265\Circuit.pif
  C:\Users\Admin\AppData\Local\Temp\17265\Circuit.pif
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Users\Admin\AppData\Local\Temp\17265\Circuit.pif
  C:\Users\Admin\AppData\Local\Temp\17265\Circuit.pif
  2⤵
  - Executes dropped EXE
  PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Circuit.pif

Path C:\Users\Admin\AppData\Local\Temp\17265\Circuit.pif
Size 925KB
SHA256 1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49
MD5 62d09f076e6e0240548c2f837536a46a
SHA1 26bdbc63af8abae9a8fb6ec0913a307ef6614cf2
SHA512 32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f
SSDEEP 24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\17265\u
Size 2.0MB
SHA256 64123e52c0e817c58b501479253e6ba2d8a19335e86b6521b1d87e0ba857f6ac
MD5 295d37f28714827646f756f54b5420c3
SHA1 cff6d820b570ff7950b002a3e25da3c9ac6fe528
SHA512 3f69d9293dba4e24b71dfaa6d36dfb093a86b458d125110012f33d09a556ee287d9792ebdb58a6d8b4bdd274b8f455aa23d891a65d0bdea189673f74c780e484
SSDEEP 24576:qMPMxHDpyQ4/MadHsubTdYKY9UozJkKElmqSIQpQ8X:Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

Abandoned

Path C:\Users\Admin\AppData\Local\Temp\Abandoned
Size 279KB
SHA256 3b370cabc241c47dc7e0a657d45b46fa3f5e7bbf7565ffbcab0d64668edaa00b
MD5 630c8571bb0e5bc092a0e58e89625296
SHA1 c8ceaf71c44cd9fa5e926687c77c0d03cb94cc9c
SHA512 886ab8840ad5d6d81f4fff866a92b26ee9f365b6bcefb7722f647d6dd97ccd14ce46f3852a0bd65a787c5ffa4eb422c2debb8d0ad58d6f35fdefb817f8343a1a
SSDEEP 3072:bqTj0idlG9N1KXVxLyd0peHdx68sD+9+v0HG7HucLMVhvJG9b9tsLLYHwML99xVw:T+6x33dncC2MxCZqs98CWK8KQ8oECcWV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Both

Path C:\Users\Admin\AppData\Local\Temp\Both
Size 271KB
SHA256 b7c1eec3c033f05ebf11d5dde48b1e7bf4a82aaca9a62075094805bafaa5e5f9
MD5 f39d5c9bafa4e361d0f9b97c62ca0a83
SHA1 2f91bcd59fcc2a0de6a791a98dfae3f23c332c8f
SHA512 5dcfe176000932ad718d72e23020bf74a0fd0587e13a3602e56a4622ecd4629f7b1b9ba2286bacb22d9bb3465c225626a7fdf46be51ed0f4272b8b7d8f2b91f3
SSDEEP 6144:1bfSCOMVIPPL/sZ7HS3zcNPj0nEo3tb2j6AUkB0CThp6vmVnV:1bz7y3zcNPjmlGUkiCTD6vmVnV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Certified

Path C:\Users\Admin\AppData\Local\Temp\Certified
Size 242KB
SHA256 45d6721cb66ae810ce09b6a8afcca4151db790675123baa4bd576daa71c50c04
MD5 197e43426459e306400b83c4d17e72dc
SHA1 42bf66b7c6fee4fabe38b952cf9ce445eff9cad7
SHA512 a51a6a01b4dc03cc69d67b81609d085873836334dcec4727673b537625c5e448f65513be8fd0bb48e08b7375cab9f79df93ee9cd4a5f33c1052593907d7cf0fa
SSDEEP 3072:iWMxnDdNqqhlUcp5uStfWQji7/X7bcgp4kMWvglP:PMxnBoIlDp5dfWQ4/ZufWvglP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Computer

Path C:\Users\Admin\AppData\Local\Temp\Computer
Size 257KB
SHA256 cc4a4afb94970ed96a8f299599530dcf57655decfc7f6371e2f3e08549aa0b73
MD5 5aad7c657a389f9df617ee885c3e0837
SHA1 1151635b791c42f5291b911ef59450d7cc54d7bb
SHA512 16fc829d1f0542a4deecc16d6c08028fc5ef92f7953f54ea825ae360e6f75c716b29f7db6df38de284287f8c4b594950e695ae30971657bb21f3a2b6b990e1cc
SSDEEP 3072:XVjIgjoXeDL54pL7VzUPZjcEAa8J0XbOL4fMx0VkTm7rDzSDXt9/eT8hxnsVCS8Q:M2a87rbVQTMwtRYM2x
MD5 SHA1 SHA512 SSDEEP

Submit Download

Contamination

Path C:\Users\Admin\AppData\Local\Temp\Contamination
Size 249KB
SHA256 a381ea111bcc86d026d01cd369e8d69106a78dc9174cfd9461fdfeaa226b2ebf
MD5 13dd187f4e5b7eb0f2b66b9efd5d2da9
SHA1 e9b37981d3931ebfff56966bee6986adf8d15610
SHA512 3c07b09cbc6e1e70dda2a4307b811400cfe7ce7638e532a3ba1990deb3782dd91723b0389befb358bdc13d0acfac84ad590d6384a12708416e1aa7b4d287639f
SSDEEP 3072:V6nF0CXCxVrF9z7E3vsXRffn1GWACrkjrp3YFPLNfw8ZIor:cnOCyfrDzA/k18jypZfwan
MD5 SHA1 SHA512 SSDEEP

Submit Download

Geographic

Path C:\Users\Admin\AppData\Local\Temp\Geographic
Size 11KB
SHA256 fb2b42ddf04586d3409115cb818df5aa05aae0566448aacf62736b92c7238de8
MD5 6b30bc28de5e5556291fdcb0cdd6123f
SHA1 569d9295784a2bef6a864e315c8e6b3d90131243
SHA512 9ca385270cfb90bbb235c03d08f9ae9a3e2a45df171d505d5b7f658514a83cb8fac97d7564bff569acf7846a35a680d29ba941ac5d5c44890c90e75dbc59d77d
SSDEEP 192:yYqG/xfk0zFGhIHgK5a2ZFbppfegtBmnPqZzhafLNweAOd7aWNYsz4PnOQf2J3wx:cqFk6GGHgK5fZlfeNnSaLdOWNYsz4fvn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Highland

Path C:\Users\Admin\AppData\Local\Temp\Highland
Size 254KB
SHA256 ec0060e15fc61fc23d352e4dc353ddddffcd3361739970d1dd70c1e6dd6c5323
MD5 69bbd6e1c4c7202f6cf9231aeafe066c
SHA1 b5d0ffd05465babd705f8a0aa8ba3d9de70ce532
SHA512 4966a1236ae56ec3c0e83f25f812507a08564d8939db432aad7fd27a0b004d51bb96b1b46fb35de13c695606b0f42cc0d47f4a3cccc731e6ceb7f4ff86ff5289
SSDEEP 3072:kUVrEgkE/p2rmo02xQvRO703m+Oct3AjagozyrmVW:pVbHorm5tvyoOakmVW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Interactive

Path C:\Users\Admin\AppData\Local\Temp\Interactive
Size 156KB
SHA256 aea396b3b971e3e49d3399e25a85561990bc6eb208c6ca2e715935803c166d2a
MD5 2b2a308fd185d11f50b8a163a4b46b22
SHA1 fa6582daaae92131749e2083390dc72265432de2
SHA512 b1053e31be7e81d0ae97e1f315afabd03ef7bcaab2c6d22824c26857ee42211cd3d5e76febfeecba6d8a3b2a42a0b97ec37ed1c4b428176f46adc460c8059d0f
SSDEEP 3072:SpIbv18mLthfhnueoMmOqDoioO5bLezW9FfTut/Dde6u640ewy4Za9coRC2jfTqd:dphfhnvO5bLezWWt/Dd314V14ZgP0Jai
MD5 SHA1 SHA512 SSDEEP

Submit Download

Moderator

Path C:\Users\Admin\AppData\Local\Temp\Moderator
Size 220KB
SHA256 bac6fabf48f869d3829198b2e26975ea35865300e3c1bffd4abae8492ff58e3e
MD5 f698abd3830b9d4c526cd238c1c6cc88
SHA1 984f3c262accdef9f23436820d75e4e82b78b0c0
SHA512 40f92f2476eb9cd309af4dcddd554785d1667738fd5b1922feac317039fce8b1e05f9b5fd82a1267d2162c5070535e4d2a9db8257a6a724a694cad2a81a02ee7
SSDEEP 3072:524BRjbLmnrftNE90QLUkg2mNjIvi/i7kLioLw242FhGWTWkDP7cu:52oRj3mQYkZmNe57sd9hTW8cu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Not

Path C:\Users\Admin\AppData\Local\Temp\Not
Size 51KB
SHA256 75141d082e18214a0e601b07e3d51ee65184fe000f5d397c240d44dc910f5755
MD5 33d95bea2afc8316dc564e0fa66f5cbd
SHA1 906fdec97170cbb8ebaa08710f39d5913b7e55e5
SHA512 ec53133e5cd87be68b682a8970f28961380f857240cabc46c6bb19a6a9b9c3822effc6d7c57c7272a0daa461849ee79ae3c0671c68e90da482c982b59e86631a
SSDEEP 768:z2+9BGmd9OTGQ1Dv7sMvLHfR/ZByLiFuO/ChgZ45VatJVEV3GPkjF:z2+9BGmdATGODv7xvTphAiPChgZ2kOE6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Psychological

Path C:\Users\Admin\AppData\Local\Temp\Psychological
Size 298KB
SHA256 9a36e83135f921e6e6f852a16386ad908aefc133481a130f492231846c5cff5c
MD5 a11a9ba8a69a7dd27b56ab36af542cb5
SHA1 8344be39d96572e32e7bc76e3262e2d97a51f4f7
SHA512 125d3b5288f4b5ec69918099d9025402ea86a90a2d3c5e6388e298f2cf9dd750b5c04cfa56a08b33bc85059a0843d6084375275884df41025ed09af4eec55144
SSDEEP 3072:FDbvCe7aTpdIGHmgyLQjy1Nrb83jGnhjROKCOEpeC8JQ4B2fmHY:Jbv1aTpHm0mr3g6nlRVietRkeHY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\Rx
Size 242KB
SHA256 5a501dd03486ce13dcea82079c84764d2866687615349414a10904f58bc7a353
MD5 4e900043cb7e229cc250c1e3bd6e3ec8
SHA1 ff09f97f0cf814710227cccd7e04e806e5504c81
SHA512 eda7b86b5dcfeaf2226b6e56c926e1a0ac62c5713011465794c0e538faae44b29c8bf96882a8068ddfcc4b4c52581a69fc6367ff516b2840ffc81d5d787877f3
SSDEEP 6144:1K5vPeDkjGgQaE/loUDtf0accB3gBmmLsiS+SAhC3:uvG4waEqOfFfB3gBTQ+SAS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Shakespeare

Path C:\Users\Admin\AppData\Local\Temp\Shakespeare
Size 205KB
SHA256 ce4c1eedf51c83ef274413d7ab0924a0105d12c542ce783bb453805986091c27
MD5 852be807aca85db68eba568a2ad45710
SHA1 ac313e4f668ba88a50fb66f5f06272904413ab07
SHA512 06837cd22590392ef11b84beba7c5dbc5a9b2efeb73fcf33e371af4aa3b9501ef0e5e8ae1b1c578911163aaaedb898642c7c25d89d81b0f4a560b342c17c189e
SSDEEP 3072:7Fuz08XvBNbjaAtsPh6whxjgarB/5elDWy4ZW:Ez04phdyp6ggarZ8aBZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Techniques

Path C:\Users\Admin\AppData\Local\Temp\Techniques
Size 263KB
SHA256 4441bee3b0ac1c26230621485d0f232633bb2d22c67f0c4e11005f1b7c0cd605
MD5 bd50be150bddf93c9ab69c736662cbb6
SHA1 6285220ba346bb4326d3705869a31c71f675062c
SHA512 a278b4f4d7fdc66677716638e5c1a0bfebe3e4c14bb0f05c6fd01930a75815ad2600f14a44021fbc5242dce2aea8be61a59a5616111ca9ba9c487e73fa340dae
SSDEEP 6144:4z832W8TIZfsoNoXhqQpXgmsxEI/wKYCcB7N:4ImspSIQpQmsKX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2156-40-0x0000000000E00000-0x0000000000F41000-memory.dmp

Download

memory/2156-41-0x0000000000E00000-0x0000000000F41000-memory.dmp

Download

memory/2156-43-0x0000000000E00000-0x0000000000F41000-memory.dmp

Download

memory/2156-44-0x0000000000E00000-0x0000000000F41000-memory.dmp

Download

memory/2156-45-0x0000000000E00000-0x0000000000F41000-memory.dmp

Download

memory/2156-46-0x0000000000E00000-0x0000000000F41000-memory.dmp

Download

memory/3920-33-0x0000000077621000-0x0000000077741000-memory.dmp

Download

memory/3920-34-0x0000000003E10000-0x0000000003E11000-memory.dmp

Download