risepro | a22db49ce797ce6ac5d91a4791d9954f4c31397b01d362fb0d24ffb7e16cd8d5

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:51

Target

a22db49ce797ce6ac5d91a4791d9954f4c31397b01d362fb0d24ffb7e16cd8d5.exe
Size

11.7MB
MD5

3d5808948d8fa538b14ddc5d1861202b
SHA1

465557a1e5384105df4f388e960f2c8469bf7b98
SHA256

a22db49ce797ce6ac5d91a4791d9954f4c31397b01d362fb0d24ffb7e16cd8d5
SHA512

72473f3f32bdf9cde220811cbb1da873a0d8dd0441ce37081c003fd930c9a2bf9fac50f00fc04a5e2d7da759f6ed382665fc01c082cea37ab80a31d73431e9e0
SSDEEP

98304:fXdAsPOHF+PYGMetYEYNx0s7N9ERbkQMrN:fCeS0s7Nu

Score

10^/10

risepro stealer

Family

risepro

185.172.128.136:50500

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Suspicious use of SetThreadContext 1 IoCs

Processes:

a22db49ce797ce6ac5d91a4791d9954f4c31397b01d362fb0d24ffb7e16cd8d5.exe

description	pid	process	target process
PID 1728 set thread context of 1168	1728	a22db49ce797ce6ac5d91a4791d9954f4c31397b01d362fb0d24ffb7e16cd8d5.exe	BitLockerToGo.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

a22db49ce797ce6ac5d91a4791d9954f4c31397b01d362fb0d24ffb7e16cd8d5.exe

description	pid	process	target process
PID 1728 wrote to memory of 1168	1728	a22db49ce797ce6ac5d91a4791d9954f4c31397b01d362fb0d24ffb7e16cd8d5.exe	BitLockerToGo.exe
PID 1728 wrote to memory of 1168	1728	a22db49ce797ce6ac5d91a4791d9954f4c31397b01d362fb0d24ffb7e16cd8d5.exe	BitLockerToGo.exe
PID 1728 wrote to memory of 1168	1728	a22db49ce797ce6ac5d91a4791d9954f4c31397b01d362fb0d24ffb7e16cd8d5.exe	BitLockerToGo.exe
PID 1728 wrote to memory of 1168	1728	a22db49ce797ce6ac5d91a4791d9954f4c31397b01d362fb0d24ffb7e16cd8d5.exe	BitLockerToGo.exe
PID 1728 wrote to memory of 1168	1728	a22db49ce797ce6ac5d91a4791d9954f4c31397b01d362fb0d24ffb7e16cd8d5.exe	BitLockerToGo.exe
PID 1728 wrote to memory of 1168	1728	a22db49ce797ce6ac5d91a4791d9954f4c31397b01d362fb0d24ffb7e16cd8d5.exe	BitLockerToGo.exe

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
2⤵
PID:1168

memory/1168-5-0x00000000002A0000-0x0000000000436000-memory.dmp

Filesize
1.6MB

Download
memory/1168-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1168-6-0x00000000002A0000-0x0000000000436000-memory.dmp

Filesize
1.6MB

Download
memory/1168-10-0x00000000002A0000-0x0000000000436000-memory.dmp

Filesize
1.6MB

Download
memory/1168-11-0x00000000002A0000-0x0000000000436000-memory.dmp

Filesize
1.6MB

Download
memory/1168-12-0x00000000002A0000-0x0000000000436000-memory.dmp

Filesize
1.6MB

Download
memory/1728-2-0x000000013F840000-0x000000014045E000-memory.dmp

Filesize
12.1MB

Download
memory/1728-9-0x000000013F840000-0x000000014045E000-memory.dmp

Filesize
12.1MB

Download