risepro | cb67a188bafea0fd5f5e9725881c88a1c494763c094f76df73914bd8cadce170

Analysis

max time kernel
195s
max time network
255s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
07/06/2024, 01:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cb67a188bafea0fd5f5e9725881c88a1c494763c094f76df73914bd8cadce170.exe
Size 2.6MB
Sample240607-b3bjgsfe2v
SHA256 cb67a188bafea0fd5f5e9725881c88a1c494763c094f76df73914bd8cadce170
MD5 d86ff3c02aefcd74ece7eb45ee226806
SHA1 43749f2e4303daa222ffa6af7297a07e62b55b70
SHA512 36abc197f3f3e10c2495633a95e4ba69a1362a77beff7cb3f2e9aee525040d72fd7ea76b1f4b1fe07146edf3dbb3905c94fd96a34a74d3b0e3c6f60a8f00daab
SSDEEP 49152:dI1+AV/nH+LZTiRDmIzov0aEEWXr/m0ce6XjX04LbfQyXhZzByPfP11X/RaPWJhq:dI1+Q/HgliRD1C0a925ceIjX/bfQyXzg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

risepro stealer

Malware Config

Extracted

Family

risepro

118.194.235.187:50500

Signatures

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4988 set thread context of 1588	4988	cb67a188bafea0fd5f5e9725881c88a1c494763c094f76df73914bd8cadce170.exe	75

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 3956	4988	cb67a188bafea0fd5f5e9725881c88a1c494763c094f76df73914bd8cadce170.exe	72
PID 4988 wrote to memory of 3956	4988	cb67a188bafea0fd5f5e9725881c88a1c494763c094f76df73914bd8cadce170.exe	72
PID 4988 wrote to memory of 3956	4988	cb67a188bafea0fd5f5e9725881c88a1c494763c094f76df73914bd8cadce170.exe	72
PID 4988 wrote to memory of 4468	4988	cb67a188bafea0fd5f5e9725881c88a1c494763c094f76df73914bd8cadce170.exe	73
PID 4988 wrote to memory of 4468	4988	cb67a188bafea0fd5f5e9725881c88a1c494763c094f76df73914bd8cadce170.exe	73
PID 4988 wrote to memory of 4468	4988	cb67a188bafea0fd5f5e9725881c88a1c494763c094f76df73914bd8cadce170.exe	73
PID 4988 wrote to memory of 1580	4988	cb67a188bafea0fd5f5e9725881c88a1c494763c094f76df73914bd8cadce170.exe	74
PID 4988 wrote to memory of 1580	4988	cb67a188bafea0fd5f5e9725881c88a1c494763c094f76df73914bd8cadce170.exe	74
PID 4988 wrote to memory of 1580	4988	cb67a188bafea0fd5f5e9725881c88a1c494763c094f76df73914bd8cadce170.exe	74
PID 4988 wrote to memory of 1588	4988	cb67a188bafea0fd5f5e9725881c88a1c494763c094f76df73914bd8cadce170.exe	75
PID 4988 wrote to memory of 1588	4988	cb67a188bafea0fd5f5e9725881c88a1c494763c094f76df73914bd8cadce170.exe	75
PID 4988 wrote to memory of 1588	4988	cb67a188bafea0fd5f5e9725881c88a1c494763c094f76df73914bd8cadce170.exe	75
PID 4988 wrote to memory of 1588	4988	cb67a188bafea0fd5f5e9725881c88a1c494763c094f76df73914bd8cadce170.exe	75
PID 4988 wrote to memory of 1588	4988	cb67a188bafea0fd5f5e9725881c88a1c494763c094f76df73914bd8cadce170.exe	75
PID 4988 wrote to memory of 1588	4988	cb67a188bafea0fd5f5e9725881c88a1c494763c094f76df73914bd8cadce170.exe	75
PID 4988 wrote to memory of 1588	4988	cb67a188bafea0fd5f5e9725881c88a1c494763c094f76df73914bd8cadce170.exe	75
PID 4988 wrote to memory of 1588	4988	cb67a188bafea0fd5f5e9725881c88a1c494763c094f76df73914bd8cadce170.exe	75
PID 4988 wrote to memory of 1588	4988	cb67a188bafea0fd5f5e9725881c88a1c494763c094f76df73914bd8cadce170.exe	75
PID 4988 wrote to memory of 1588	4988	cb67a188bafea0fd5f5e9725881c88a1c494763c094f76df73914bd8cadce170.exe	75
PID 4988 wrote to memory of 1588	4988	cb67a188bafea0fd5f5e9725881c88a1c494763c094f76df73914bd8cadce170.exe	75
PID 4988 wrote to memory of 1588	4988	cb67a188bafea0fd5f5e9725881c88a1c494763c094f76df73914bd8cadce170.exe	75

C:\Users\Admin\AppData\Local\Temp\cb67a188bafea0fd5f5e9725881c88a1c494763c094f76df73914bd8cadce170.exe
"C:\Users\Admin\AppData\Local\Temp\cb67a188bafea0fd5f5e9725881c88a1c494763c094f76df73914bd8cadce170.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3956
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4468
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1580
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1588-1-0x0000000000400000-0x00000000008B9000-memory.dmp

Download

memory/1588-4-0x0000000000400000-0x00000000008B9000-memory.dmp

Download

memory/1588-7-0x0000000000400000-0x00000000008B9000-memory.dmp

Download

memory/1588-8-0x0000000000400000-0x00000000008B9000-memory.dmp

Download

memory/1588-11-0x0000000000400000-0x00000000008B9000-memory.dmp

Download

memory/4988-0-0x00000000001F0000-0x00000000001F1000-memory.dmp

Download

memory/4988-2-0x00000000001F0000-0x00000000001F1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads