risepro | 80cc10923bcba090e2ef7507eb54bdc444d238ed41c7a15f42648733538ad01d

Analysis

max time kernel
142s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 01:52

Target

80cc10923bcba090e2ef7507eb54bdc444d238ed41c7a15f42648733538ad01d.exe
Size

873KB
MD5

58c1b93f888be190686b8c2c82754a25
SHA1

c26e5814b3a858c8660bd8c982ad53e4a85bd17f
SHA256

80cc10923bcba090e2ef7507eb54bdc444d238ed41c7a15f42648733538ad01d
SHA512

e6d10a37ee266d90932f70e88fbfa35bdca1c32680ee2e114de34b3a208a10e4d4ff98fd2bd15f34eea2c21cd1e096c57b7c9a2c939b74fcfce39a6b9ab7c942
SSDEEP

12288:8sY7HraLnYSeEPWjwyi9oppShv0JVXi0ILDpUBl4BgIzSIzMiJJXlwwwuiRcd/zo:6PMx8ppSZsA3KCgYrJztpH/NJ

Score

10^/10

risepro stealer

Family

risepro

147.45.47.93:58709

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1516 set thread context of 2476	1516	80cc10923bcba090e2ef7507eb54bdc444d238ed41c7a15f42648733538ad01d.exe	91

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 2476	1516	80cc10923bcba090e2ef7507eb54bdc444d238ed41c7a15f42648733538ad01d.exe	91
PID 1516 wrote to memory of 2476	1516	80cc10923bcba090e2ef7507eb54bdc444d238ed41c7a15f42648733538ad01d.exe	91
PID 1516 wrote to memory of 2476	1516	80cc10923bcba090e2ef7507eb54bdc444d238ed41c7a15f42648733538ad01d.exe	91
PID 1516 wrote to memory of 2476	1516	80cc10923bcba090e2ef7507eb54bdc444d238ed41c7a15f42648733538ad01d.exe	91
PID 1516 wrote to memory of 2476	1516	80cc10923bcba090e2ef7507eb54bdc444d238ed41c7a15f42648733538ad01d.exe	91
PID 1516 wrote to memory of 2476	1516	80cc10923bcba090e2ef7507eb54bdc444d238ed41c7a15f42648733538ad01d.exe	91
PID 1516 wrote to memory of 2476	1516	80cc10923bcba090e2ef7507eb54bdc444d238ed41c7a15f42648733538ad01d.exe	91
PID 1516 wrote to memory of 2476	1516	80cc10923bcba090e2ef7507eb54bdc444d238ed41c7a15f42648733538ad01d.exe	91
PID 1516 wrote to memory of 2476	1516	80cc10923bcba090e2ef7507eb54bdc444d238ed41c7a15f42648733538ad01d.exe	91
PID 1516 wrote to memory of 2476	1516	80cc10923bcba090e2ef7507eb54bdc444d238ed41c7a15f42648733538ad01d.exe	91

C:\Users\Admin\AppData\Local\Temp\80cc10923bcba090e2ef7507eb54bdc444d238ed41c7a15f42648733538ad01d.exe
"C:\Users\Admin\AppData\Local\Temp\80cc10923bcba090e2ef7507eb54bdc444d238ed41c7a15f42648733538ad01d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Users\Admin\AppData\Local\Temp\80cc10923bcba090e2ef7507eb54bdc444d238ed41c7a15f42648733538ad01d.exe
  "C:\Users\Admin\AppData\Local\Temp\80cc10923bcba090e2ef7507eb54bdc444d238ed41c7a15f42648733538ad01d.exe"
  2⤵
  PID:2476

memory/1516-1-0x0000000002E30000-0x0000000002EE0000-memory.dmp

Filesize
704KB

Download
memory/1516-2-0x00000000049A0000-0x0000000004AF0000-memory.dmp

Filesize
1.3MB

Download
memory/2476-3-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/2476-4-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/2476-5-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/2476-6-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/2476-7-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download