risepro | b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76

General

Target

b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
Size

3.0MB
MD5

7116a0cf1d8842e14512aad44041b265
SHA1

617fac256e018a4dd7869a708194cf13c2fc09b5
SHA256

b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76
SHA512

dc3aea207710a1ec664d58f57ed9ea2172f66a6a40a9f110e1c259fda6c4587a0bcde4e074ed928dda6ae39983c8b50bcd9246107f0674c29883847ad53aa343
SSDEEP

49152:JIsKpuaI47HpE5HQSWjtcCwA9pGCA3KT5v/dfNYj0krdEI88NGOknqKsyE:ypH/HaJHIpwE9LvVfNYIkrbGt

Score

10^/10

risepro stealer

Malware Config

Extracted

Family

risepro

C2

147.45.47.126:58709

Signatures

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Suspicious use of NtSetInformationThreadHideFromDebugger 30 IoCs

Processes:

b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe

pid	process
1572	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
1572	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
1572	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
1572	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
1572	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
1572	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
1572	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
1572	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
1572	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
1572	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
1572	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
1572	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
1572	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
1572	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
1572	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
1572	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
1572	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
1572	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
1572	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
1572	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
1572	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
1572	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
1572	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
1572	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
1572	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
1572	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
1572	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
1572	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
1572	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
1572	b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe

pid process

1572 b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe

C:\Users\Admin\AppData\Local\Temp\b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe
"C:\Users\Admin\AppData\Local\Temp\b4ae6bcccc2a32a0f1f3a42376f251c3b716680b227d4f31690737b64a6d4a76.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:1572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1572-0-0x0000000000C90000-0x00000000017D4000-memory.dmp

Filesize
11.3MB

Download
memory/1572-1-0x000000007EA80000-0x000000007EE51000-memory.dmp

Filesize
3.8MB

Download
memory/1572-2-0x0000000077D02000-0x0000000077D03000-memory.dmp

Filesize
4KB

Download
memory/1572-3-0x0000000000C90000-0x00000000017D4000-memory.dmp

Filesize
11.3MB

Download
memory/1572-4-0x0000000000C90000-0x00000000017D4000-memory.dmp

Filesize
11.3MB

Download
memory/1572-5-0x000000007EA80000-0x000000007EE51000-memory.dmp

Filesize
3.8MB

Download
memory/1572-6-0x0000000000C90000-0x00000000017D4000-memory.dmp

Filesize
11.3MB

Download
memory/1572-7-0x0000000000C90000-0x00000000017D4000-memory.dmp

Filesize
11.3MB

Download
memory/1572-8-0x0000000000C90000-0x00000000017D4000-memory.dmp

Filesize
11.3MB

Download
memory/1572-9-0x0000000000C90000-0x00000000017D4000-memory.dmp

Filesize
11.3MB

Download
memory/1572-10-0x0000000000C90000-0x00000000017D4000-memory.dmp

Filesize
11.3MB

Download
memory/1572-11-0x0000000000C90000-0x00000000017D4000-memory.dmp

Filesize
11.3MB

Download
memory/1572-12-0x0000000000C90000-0x00000000017D4000-memory.dmp

Filesize
11.3MB

Download
memory/1572-13-0x0000000000C90000-0x00000000017D4000-memory.dmp

Filesize
11.3MB

Download
memory/1572-14-0x0000000000C90000-0x00000000017D4000-memory.dmp

Filesize
11.3MB

Download
memory/1572-15-0x0000000000C90000-0x00000000017D4000-memory.dmp

Filesize
11.3MB

Download
memory/1572-16-0x0000000000C90000-0x00000000017D4000-memory.dmp

Filesize
11.3MB

Download
memory/1572-17-0x0000000000C90000-0x00000000017D4000-memory.dmp

Filesize
11.3MB

Download
memory/1572-18-0x0000000000C90000-0x00000000017D4000-memory.dmp

Filesize
11.3MB

Download
memory/1572-19-0x0000000000C90000-0x00000000017D4000-memory.dmp

Filesize
11.3MB

Download
memory/1572-20-0x0000000000C90000-0x00000000017D4000-memory.dmp

Filesize
11.3MB

Download
memory/1572-21-0x0000000000C90000-0x00000000017D4000-memory.dmp

Filesize
11.3MB

Download
memory/1572-22-0x0000000000C90000-0x00000000017D4000-memory.dmp

Filesize
11.3MB

Download
memory/1572-23-0x0000000000C90000-0x00000000017D4000-memory.dmp

Filesize
11.3MB

Download
memory/1572-24-0x0000000000C90000-0x00000000017D4000-memory.dmp

Filesize
11.3MB

Download
memory/1572-25-0x0000000000C90000-0x00000000017D4000-memory.dmp

Filesize
11.3MB

Download
memory/1572-26-0x0000000000C90000-0x00000000017D4000-memory.dmp

Filesize
11.3MB

Download
memory/1572-27-0x0000000000C90000-0x00000000017D4000-memory.dmp

Filesize
11.3MB

Download
memory/1572-28-0x0000000000C90000-0x00000000017D4000-memory.dmp

Filesize
11.3MB

Download
memory/1572-29-0x0000000000C90000-0x00000000017D4000-memory.dmp

Filesize
11.3MB

Download
memory/1572-30-0x0000000000C90000-0x00000000017D4000-memory.dmp

Filesize
11.3MB

Download
memory/1572-31-0x0000000000C90000-0x00000000017D4000-memory.dmp

Filesize
11.3MB

Download
memory/1572-32-0x0000000000C90000-0x00000000017D4000-memory.dmp

Filesize
11.3MB

Download
memory/1572-33-0x0000000000C90000-0x00000000017D4000-memory.dmp

Filesize
11.3MB

Download

Analysis

Sharing