risepro | e18387327b785e9f81e2ef1f6430063bf432be7cdfd0a348e08fc71331dbcf1c

Analysis

max time kernel
140s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:30

Target

e18387327b785e9f81e2ef1f6430063bf432be7cdfd0a348e08fc71331dbcf1c.exe
Size

2.5MB
MD5

f02d5b2bd83e73412dc29996ce23640c
SHA1

70fab69fc08f9cac63457dbc3775b1f7bf8b3140
SHA256

e18387327b785e9f81e2ef1f6430063bf432be7cdfd0a348e08fc71331dbcf1c
SHA512

aa47c43405b3d7b8bc7833e12ec29f30c553fe745425a5260a67c3cbd02d3def6689242b90b8bcc1e7e8a3fd1ea6f063782e55acd26ab27d32d1cf7138e67e20
SSDEEP

49152:TRoVAqt9sWqNhngi/0LCVqwMlKM23iuUXUhV/t67c0xsEU9:TR+Ht9sW4hnNbVNmKM23nUXUhVDZEU

Score

10^/10

risepro stealer

Family

risepro

5.42.96.64:50500

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Suspicious use of SetThreadContext 1 IoCs

Processes:

e18387327b785e9f81e2ef1f6430063bf432be7cdfd0a348e08fc71331dbcf1c.exe

description	pid	process	target process
PID 1824 set thread context of 1632	1824	e18387327b785e9f81e2ef1f6430063bf432be7cdfd0a348e08fc71331dbcf1c.exe	RegAsm.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

e18387327b785e9f81e2ef1f6430063bf432be7cdfd0a348e08fc71331dbcf1c.exe

description	pid	process	target process
PID 1824 wrote to memory of 1632	1824	e18387327b785e9f81e2ef1f6430063bf432be7cdfd0a348e08fc71331dbcf1c.exe	RegAsm.exe
PID 1824 wrote to memory of 1632	1824	e18387327b785e9f81e2ef1f6430063bf432be7cdfd0a348e08fc71331dbcf1c.exe	RegAsm.exe
PID 1824 wrote to memory of 1632	1824	e18387327b785e9f81e2ef1f6430063bf432be7cdfd0a348e08fc71331dbcf1c.exe	RegAsm.exe
PID 1824 wrote to memory of 1632	1824	e18387327b785e9f81e2ef1f6430063bf432be7cdfd0a348e08fc71331dbcf1c.exe	RegAsm.exe
PID 1824 wrote to memory of 1632	1824	e18387327b785e9f81e2ef1f6430063bf432be7cdfd0a348e08fc71331dbcf1c.exe	RegAsm.exe
PID 1824 wrote to memory of 1632	1824	e18387327b785e9f81e2ef1f6430063bf432be7cdfd0a348e08fc71331dbcf1c.exe	RegAsm.exe
PID 1824 wrote to memory of 1632	1824	e18387327b785e9f81e2ef1f6430063bf432be7cdfd0a348e08fc71331dbcf1c.exe	RegAsm.exe
PID 1824 wrote to memory of 1632	1824	e18387327b785e9f81e2ef1f6430063bf432be7cdfd0a348e08fc71331dbcf1c.exe	RegAsm.exe
PID 1824 wrote to memory of 1632	1824	e18387327b785e9f81e2ef1f6430063bf432be7cdfd0a348e08fc71331dbcf1c.exe	RegAsm.exe
PID 1824 wrote to memory of 1632	1824	e18387327b785e9f81e2ef1f6430063bf432be7cdfd0a348e08fc71331dbcf1c.exe	RegAsm.exe
PID 1824 wrote to memory of 1632	1824	e18387327b785e9f81e2ef1f6430063bf432be7cdfd0a348e08fc71331dbcf1c.exe	RegAsm.exe
PID 1824 wrote to memory of 1632	1824	e18387327b785e9f81e2ef1f6430063bf432be7cdfd0a348e08fc71331dbcf1c.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:1632

memory/1632-2-0x0000000000400000-0x000000000087F000-memory.dmp

Filesize
4.5MB

Download
memory/1632-5-0x0000000000400000-0x000000000087F000-memory.dmp

Filesize
4.5MB

Download
memory/1632-8-0x0000000000400000-0x000000000087F000-memory.dmp

Filesize
4.5MB

Download
memory/1632-11-0x0000000000400000-0x000000000087F000-memory.dmp

Filesize
4.5MB

Download
memory/1824-0-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

Filesize
4KB

Download
memory/1824-1-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

Filesize
4KB

Download
memory/1824-3-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

Filesize
4KB

Download