risepro | de39bc2c5f18ae468501a573ee5cb9b22f2f608ec2fc51954b44d4549fac2a57

Analysis

max time kernel
195s
max time network
255s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
07/06/2024, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
de39bc2c5f18ae468501a573ee5cb9b22f2f608ec2fc51954b44d4549fac2a57.exe
Size 2.4MB
Sample240607-chrweafh2s
SHA256 de39bc2c5f18ae468501a573ee5cb9b22f2f608ec2fc51954b44d4549fac2a57
MD5 b11913361b2d4c43c00c1969184050a8
SHA1 8358fa3426e4136e0873a32f49f5f367770bad0a
SHA512 2d25c021ddf59a10b63c56d85a550e7454767444472f3e40662dda1e1dddeef551202253cf9137bf4054ed832cd59c53b66aba6d42361f044fe4e7b06bef2026
SSDEEP 49152:E8iOCSczbcIjxv6rOJFQPn540XnNQkSejExBTyscdg5gSv1GeRkddpQ:E8iOCmexvHFJ03tSOEzjcObv1Ge6ddS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

risepro stealer

Malware Config

Signatures

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 344 set thread context of 5072	344	de39bc2c5f18ae468501a573ee5cb9b22f2f608ec2fc51954b44d4549fac2a57.exe	75

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 344 wrote to memory of 3656	344	de39bc2c5f18ae468501a573ee5cb9b22f2f608ec2fc51954b44d4549fac2a57.exe	73
PID 344 wrote to memory of 3656	344	de39bc2c5f18ae468501a573ee5cb9b22f2f608ec2fc51954b44d4549fac2a57.exe	73
PID 344 wrote to memory of 3656	344	de39bc2c5f18ae468501a573ee5cb9b22f2f608ec2fc51954b44d4549fac2a57.exe	73
PID 344 wrote to memory of 3212	344	de39bc2c5f18ae468501a573ee5cb9b22f2f608ec2fc51954b44d4549fac2a57.exe	74
PID 344 wrote to memory of 3212	344	de39bc2c5f18ae468501a573ee5cb9b22f2f608ec2fc51954b44d4549fac2a57.exe	74
PID 344 wrote to memory of 3212	344	de39bc2c5f18ae468501a573ee5cb9b22f2f608ec2fc51954b44d4549fac2a57.exe	74
PID 344 wrote to memory of 5072	344	de39bc2c5f18ae468501a573ee5cb9b22f2f608ec2fc51954b44d4549fac2a57.exe	75
PID 344 wrote to memory of 5072	344	de39bc2c5f18ae468501a573ee5cb9b22f2f608ec2fc51954b44d4549fac2a57.exe	75
PID 344 wrote to memory of 5072	344	de39bc2c5f18ae468501a573ee5cb9b22f2f608ec2fc51954b44d4549fac2a57.exe	75
PID 344 wrote to memory of 5072	344	de39bc2c5f18ae468501a573ee5cb9b22f2f608ec2fc51954b44d4549fac2a57.exe	75
PID 344 wrote to memory of 5072	344	de39bc2c5f18ae468501a573ee5cb9b22f2f608ec2fc51954b44d4549fac2a57.exe	75
PID 344 wrote to memory of 5072	344	de39bc2c5f18ae468501a573ee5cb9b22f2f608ec2fc51954b44d4549fac2a57.exe	75
PID 344 wrote to memory of 5072	344	de39bc2c5f18ae468501a573ee5cb9b22f2f608ec2fc51954b44d4549fac2a57.exe	75
PID 344 wrote to memory of 5072	344	de39bc2c5f18ae468501a573ee5cb9b22f2f608ec2fc51954b44d4549fac2a57.exe	75
PID 344 wrote to memory of 5072	344	de39bc2c5f18ae468501a573ee5cb9b22f2f608ec2fc51954b44d4549fac2a57.exe	75
PID 344 wrote to memory of 5072	344	de39bc2c5f18ae468501a573ee5cb9b22f2f608ec2fc51954b44d4549fac2a57.exe	75
PID 344 wrote to memory of 5072	344	de39bc2c5f18ae468501a573ee5cb9b22f2f608ec2fc51954b44d4549fac2a57.exe	75
PID 344 wrote to memory of 5072	344	de39bc2c5f18ae468501a573ee5cb9b22f2f608ec2fc51954b44d4549fac2a57.exe	75

C:\Users\Admin\AppData\Local\Temp\de39bc2c5f18ae468501a573ee5cb9b22f2f608ec2fc51954b44d4549fac2a57.exe
"C:\Users\Admin\AppData\Local\Temp\de39bc2c5f18ae468501a573ee5cb9b22f2f608ec2fc51954b44d4549fac2a57.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:344
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3656
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3212
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/344-0-0x00000000014F0000-0x00000000014F1000-memory.dmp

Download

memory/344-2-0x00000000014F0000-0x00000000014F1000-memory.dmp

Download

memory/344-3-0x00007FFA72C70000-0x00007FFA72E4B000-memory.dmp

Download

memory/5072-1-0x0000000000400000-0x000000000087C000-memory.dmp

Download

memory/5072-5-0x0000000000400000-0x000000000087C000-memory.dmp

Download

memory/5072-8-0x00007FFA72C70000-0x00007FFA72E4B000-memory.dmp

Download

memory/5072-9-0x0000000000400000-0x000000000087C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads