risepro | b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76

General

Target

b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
Size

3.0MB
MD5

7116a0cf1d8842e14512aad44041b265
SHA1

617fac256e018a4dd7869a708194cf13c2fc09b5
SHA256

b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76
SHA512

dc3aea207710a1ec664d58f57ed9ea2172f66a6a40a9f110e1c259fda6c4587a0bcde4e074ed928dda6ae39983c8b50bcd9246107f0674c29883847ad53aa343
SSDEEP

49152:JIsKpuaI47HpE5HQSWjtcCwA9pGCA3KT5v/dfNYj0krdEI88NGOknqKsyE:ypH/HaJHIpwE9LvVfNYIkrbGt

Score

10^/10

risepro stealer

Malware Config

Extracted

Family

risepro

C2

147.45.47.126:58709

Signatures

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Suspicious use of NtSetInformationThreadHideFromDebugger 31 IoCs

Processes:

b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe

pid	process
2440	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
2440	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
2440	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
2440	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
2440	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
2440	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
2440	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
2440	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
2440	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
2440	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
2440	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
2440	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
2440	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
2440	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
2440	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
2440	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
2440	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
2440	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
2440	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
2440	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
2440	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
2440	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
2440	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
2440	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
2440	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
2440	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
2440	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
2440	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
2440	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
2440	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
2440	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe

pid process

2440 b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe

C:\Users\Admin\AppData\Local\Temp\b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
"C:\Users\Admin\AppData\Local\Temp\b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:2440

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2440-0-0x00000000002E0000-0x0000000000E24000-memory.dmp

Filesize
11.3MB

Download
memory/2440-1-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download
memory/2440-2-0x00000000774D0000-0x00000000774D1000-memory.dmp

Filesize
4KB

Download
memory/2440-3-0x00000000002E0000-0x0000000000E24000-memory.dmp

Filesize
11.3MB

Download
memory/2440-4-0x00000000002E0000-0x0000000000E24000-memory.dmp

Filesize
11.3MB

Download
memory/2440-6-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download
memory/2440-5-0x00000000002E0000-0x0000000000E24000-memory.dmp

Filesize
11.3MB

Download
memory/2440-7-0x00000000002E0000-0x0000000000E24000-memory.dmp

Filesize
11.3MB

Download
memory/2440-8-0x00000000002E0000-0x0000000000E24000-memory.dmp

Filesize
11.3MB

Download
memory/2440-9-0x00000000002E0000-0x0000000000E24000-memory.dmp

Filesize
11.3MB

Download
memory/2440-10-0x00000000002E0000-0x0000000000E24000-memory.dmp

Filesize
11.3MB

Download
memory/2440-11-0x00000000002E0000-0x0000000000E24000-memory.dmp

Filesize
11.3MB

Download
memory/2440-12-0x00000000002E0000-0x0000000000E24000-memory.dmp

Filesize
11.3MB

Download
memory/2440-13-0x00000000002E0000-0x0000000000E24000-memory.dmp

Filesize
11.3MB

Download
memory/2440-14-0x00000000002E0000-0x0000000000E24000-memory.dmp

Filesize
11.3MB

Download
memory/2440-15-0x00000000002E0000-0x0000000000E24000-memory.dmp

Filesize
11.3MB

Download
memory/2440-16-0x00000000002E0000-0x0000000000E24000-memory.dmp

Filesize
11.3MB

Download
memory/2440-17-0x00000000002E0000-0x0000000000E24000-memory.dmp

Filesize
11.3MB

Download
memory/2440-18-0x00000000002E0000-0x0000000000E24000-memory.dmp

Filesize
11.3MB

Download
memory/2440-19-0x00000000002E0000-0x0000000000E24000-memory.dmp

Filesize
11.3MB

Download
memory/2440-20-0x00000000002E0000-0x0000000000E24000-memory.dmp

Filesize
11.3MB

Download
memory/2440-21-0x00000000002E0000-0x0000000000E24000-memory.dmp

Filesize
11.3MB

Download
memory/2440-22-0x00000000002E0000-0x0000000000E24000-memory.dmp

Filesize
11.3MB

Download
memory/2440-23-0x00000000002E0000-0x0000000000E24000-memory.dmp

Filesize
11.3MB

Download
memory/2440-24-0x00000000002E0000-0x0000000000E24000-memory.dmp

Filesize
11.3MB

Download
memory/2440-25-0x00000000002E0000-0x0000000000E24000-memory.dmp

Filesize
11.3MB

Download
memory/2440-26-0x00000000002E0000-0x0000000000E24000-memory.dmp

Filesize
11.3MB

Download
memory/2440-27-0x00000000002E0000-0x0000000000E24000-memory.dmp

Filesize
11.3MB

Download
memory/2440-28-0x00000000002E0000-0x0000000000E24000-memory.dmp

Filesize
11.3MB

Download
memory/2440-29-0x00000000002E0000-0x0000000000E24000-memory.dmp

Filesize
11.3MB

Download
memory/2440-30-0x00000000002E0000-0x0000000000E24000-memory.dmp

Filesize
11.3MB

Download
memory/2440-31-0x00000000002E0000-0x0000000000E24000-memory.dmp

Filesize
11.3MB

Download
memory/2440-32-0x00000000002E0000-0x0000000000E24000-memory.dmp

Filesize
11.3MB

Download
memory/2440-33-0x00000000002E0000-0x0000000000E24000-memory.dmp

Filesize
11.3MB

Download

Analysis

Sharing