risepro | 4c33b99e4c2dc9bea496880f08c06e43a8742bb19ff84c32c33984430f63bac4

Analysis

max time kernel
135s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 01:34

Target

4c33b99e4c2dc9bea496880f08c06e43a8742bb19ff84c32c33984430f63bac4.exe
Size

2.5MB
MD5

1ebac077529a8693f5b474fc0996d1d8
SHA1

1af4d2b48778103af737f7a0b4aa45a3196e0e32
SHA256

4c33b99e4c2dc9bea496880f08c06e43a8742bb19ff84c32c33984430f63bac4
SHA512

890ab5c3aac054fed850b2a988b67f191369339c9315aa3e2e8248ae776591aa7d86bc576712e7dee6f2c6fd103cb21d30f3da855a8948f5c50f94b65a25ccec
SSDEEP

49152:GCXXZtaDs5cfHOpnlG01P2pj0ftGFXbfpVVgimBiL11ZVjJiXG7:GKDaDs5cfupn8wPejmSX7rtEiLZxJwU

Score

10^/10

risepro stealer

Family

risepro

118.194.235.187:50500

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Suspicious use of SetThreadContext 1 IoCs

Processes:

4c33b99e4c2dc9bea496880f08c06e43a8742bb19ff84c32c33984430f63bac4.exe

description	pid	process	target process
PID 4404 set thread context of 4296	4404	4c33b99e4c2dc9bea496880f08c06e43a8742bb19ff84c32c33984430f63bac4.exe	RegAsm.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

4c33b99e4c2dc9bea496880f08c06e43a8742bb19ff84c32c33984430f63bac4.exe

description	pid	process	target process
PID 4404 wrote to memory of 4296	4404	4c33b99e4c2dc9bea496880f08c06e43a8742bb19ff84c32c33984430f63bac4.exe	RegAsm.exe
PID 4404 wrote to memory of 4296	4404	4c33b99e4c2dc9bea496880f08c06e43a8742bb19ff84c32c33984430f63bac4.exe	RegAsm.exe
PID 4404 wrote to memory of 4296	4404	4c33b99e4c2dc9bea496880f08c06e43a8742bb19ff84c32c33984430f63bac4.exe	RegAsm.exe
PID 4404 wrote to memory of 4296	4404	4c33b99e4c2dc9bea496880f08c06e43a8742bb19ff84c32c33984430f63bac4.exe	RegAsm.exe
PID 4404 wrote to memory of 4296	4404	4c33b99e4c2dc9bea496880f08c06e43a8742bb19ff84c32c33984430f63bac4.exe	RegAsm.exe
PID 4404 wrote to memory of 4296	4404	4c33b99e4c2dc9bea496880f08c06e43a8742bb19ff84c32c33984430f63bac4.exe	RegAsm.exe
PID 4404 wrote to memory of 4296	4404	4c33b99e4c2dc9bea496880f08c06e43a8742bb19ff84c32c33984430f63bac4.exe	RegAsm.exe
PID 4404 wrote to memory of 4296	4404	4c33b99e4c2dc9bea496880f08c06e43a8742bb19ff84c32c33984430f63bac4.exe	RegAsm.exe
PID 4404 wrote to memory of 4296	4404	4c33b99e4c2dc9bea496880f08c06e43a8742bb19ff84c32c33984430f63bac4.exe	RegAsm.exe
PID 4404 wrote to memory of 4296	4404	4c33b99e4c2dc9bea496880f08c06e43a8742bb19ff84c32c33984430f63bac4.exe	RegAsm.exe
PID 4404 wrote to memory of 4296	4404	4c33b99e4c2dc9bea496880f08c06e43a8742bb19ff84c32c33984430f63bac4.exe	RegAsm.exe
PID 4404 wrote to memory of 4296	4404	4c33b99e4c2dc9bea496880f08c06e43a8742bb19ff84c32c33984430f63bac4.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:4296

memory/4296-2-0x0000000000400000-0x00000000008AD000-memory.dmp

Filesize
4.7MB

Download
memory/4296-5-0x0000000000400000-0x00000000008AD000-memory.dmp

Filesize
4.7MB

Download
memory/4296-8-0x0000000000400000-0x00000000008AD000-memory.dmp

Filesize
4.7MB

Download
memory/4296-9-0x0000000000400000-0x00000000008AD000-memory.dmp

Filesize
4.7MB

Download
memory/4296-12-0x0000000000400000-0x00000000008AD000-memory.dmp

Filesize
4.7MB

Download
memory/4404-0-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

Filesize
4KB

Download
memory/4404-1-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

Filesize
4KB

Download
memory/4404-3-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

Filesize
4KB

Download