risepro | a22db49ce797ce6ac5d91a4791d9954f4c31397b01d362fb0d24ffb7e16cd8d5

Analysis

max time kernel
129s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:51

Target

a22db49ce797ce6ac5d91a4791d9954f4c31397b01d362fb0d24ffb7e16cd8d5.exe
Size

11.7MB
MD5

3d5808948d8fa538b14ddc5d1861202b
SHA1

465557a1e5384105df4f388e960f2c8469bf7b98
SHA256

a22db49ce797ce6ac5d91a4791d9954f4c31397b01d362fb0d24ffb7e16cd8d5
SHA512

72473f3f32bdf9cde220811cbb1da873a0d8dd0441ce37081c003fd930c9a2bf9fac50f00fc04a5e2d7da759f6ed382665fc01c082cea37ab80a31d73431e9e0
SSDEEP

98304:fXdAsPOHF+PYGMetYEYNx0s7N9ERbkQMrN:fCeS0s7Nu

Score

10^/10

risepro stealer

Family

risepro

185.172.128.136:50500

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Suspicious use of SetThreadContext 1 IoCs

Processes:

a22db49ce797ce6ac5d91a4791d9954f4c31397b01d362fb0d24ffb7e16cd8d5.exe

description	pid	process	target process
PID 4292 set thread context of 4064	4292	a22db49ce797ce6ac5d91a4791d9954f4c31397b01d362fb0d24ffb7e16cd8d5.exe	BitLockerToGo.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

a22db49ce797ce6ac5d91a4791d9954f4c31397b01d362fb0d24ffb7e16cd8d5.exe

description	pid	process	target process
PID 4292 wrote to memory of 4064	4292	a22db49ce797ce6ac5d91a4791d9954f4c31397b01d362fb0d24ffb7e16cd8d5.exe	BitLockerToGo.exe
PID 4292 wrote to memory of 4064	4292	a22db49ce797ce6ac5d91a4791d9954f4c31397b01d362fb0d24ffb7e16cd8d5.exe	BitLockerToGo.exe
PID 4292 wrote to memory of 4064	4292	a22db49ce797ce6ac5d91a4791d9954f4c31397b01d362fb0d24ffb7e16cd8d5.exe	BitLockerToGo.exe
PID 4292 wrote to memory of 4064	4292	a22db49ce797ce6ac5d91a4791d9954f4c31397b01d362fb0d24ffb7e16cd8d5.exe	BitLockerToGo.exe
PID 4292 wrote to memory of 4064	4292	a22db49ce797ce6ac5d91a4791d9954f4c31397b01d362fb0d24ffb7e16cd8d5.exe	BitLockerToGo.exe

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
2⤵
PID:4064

memory/4064-5-0x0000000000500000-0x0000000000696000-memory.dmp

Filesize
1.6MB

Download
memory/4064-6-0x0000000000500000-0x0000000000696000-memory.dmp

Filesize
1.6MB

Download
memory/4064-8-0x0000000000500000-0x0000000000696000-memory.dmp

Filesize
1.6MB

Download
memory/4064-9-0x0000000000500000-0x0000000000696000-memory.dmp

Filesize
1.6MB

Download
memory/4064-10-0x0000000000500000-0x0000000000696000-memory.dmp

Filesize
1.6MB

Download
memory/4292-4-0x00007FF7BF900000-0x00007FF7C051E000-memory.dmp

Filesize
12.1MB

Download
memory/4292-7-0x00007FF7BF900000-0x00007FF7C051E000-memory.dmp

Filesize
12.1MB

Download