risepro | f04cb1b8a8beb6a51b0beb2867d18dc6df2352afb67a3c85233a7383c1ce3617

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 10:57

Target

file.exe
Size

2.9MB
MD5

8eb3c7bc1ad38ae064eda594deed070b
SHA1

58d2d8baa9a14ece4ae12b6cd3260e79c7003059
SHA256

f04cb1b8a8beb6a51b0beb2867d18dc6df2352afb67a3c85233a7383c1ce3617
SHA512

4c86c4e290b678faecf906719c183fe190ce88e7242ae25af35887c12da9e4184010a94854cf12e49342074d56097dc117439f9711600f110222c264fa730648
SSDEEP

49152:U4D5fBZcSZW/ym3NyBWvYPywzniB/U+0DqKwoszSwKWFQpFR7IUyq3QqumQhG/75:U+W/D3gBlmB/URKos9z2pFF/puLc71

Score

10^/10

risepro stealer

Family

risepro

118.194.235.187:50500

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 2340 set thread context of 992 2340 file.exe RegAsm.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2960 2340 WerFault.exe file.exe

description	pid	process	target process
PID 2340 set thread context of 992	2340	file.exe	RegAsm.exe

pid	pid_target	process	target process
2960	2340	WerFault.exe	file.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

file.exe

description	pid	process	target process
PID 2340 wrote to memory of 992	2340	file.exe	RegAsm.exe
PID 2340 wrote to memory of 992	2340	file.exe	RegAsm.exe
PID 2340 wrote to memory of 992	2340	file.exe	RegAsm.exe
PID 2340 wrote to memory of 992	2340	file.exe	RegAsm.exe
PID 2340 wrote to memory of 992	2340	file.exe	RegAsm.exe
PID 2340 wrote to memory of 992	2340	file.exe	RegAsm.exe
PID 2340 wrote to memory of 992	2340	file.exe	RegAsm.exe
PID 2340 wrote to memory of 992	2340	file.exe	RegAsm.exe
PID 2340 wrote to memory of 992	2340	file.exe	RegAsm.exe
PID 2340 wrote to memory of 992	2340	file.exe	RegAsm.exe
PID 2340 wrote to memory of 992	2340	file.exe	RegAsm.exe
PID 2340 wrote to memory of 992	2340	file.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 276
2⤵
- Program crash
PID:2960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2340 -ip 2340
1⤵
PID:4828

memory/992-4-0x0000000000400000-0x00000000008AC000-memory.dmp

Filesize
4.7MB

Download
memory/992-5-0x0000000000400000-0x00000000008AC000-memory.dmp

Filesize
4.7MB

Download
memory/992-8-0x0000000000400000-0x00000000008AC000-memory.dmp

Filesize
4.7MB

Download
memory/992-9-0x0000000000400000-0x00000000008AC000-memory.dmp

Filesize
4.7MB

Download
memory/992-12-0x0000000000400000-0x00000000008AC000-memory.dmp

Filesize
4.7MB

Download
memory/2340-0-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

Filesize
4KB

Download
memory/2340-2-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

Filesize
4KB

Download