risepro | 68a9e97be5bec9fba6108897ebef0a1f00dec90cf894071dc80ba0fed62a2999

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
07/06/2024, 12:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
68a9e97be5bec9fba6108897ebef0a1f00dec90cf894071dc80ba0fed62a2999.exe
Size 2.6MB
Sample240607-n6fzlagg23
SHA256 68a9e97be5bec9fba6108897ebef0a1f00dec90cf894071dc80ba0fed62a2999
MD5 c8432b773d48e5e0a9f2d1ecb7c557f8
SHA1 ffd30a12849776a23351e9e768fc7b635553c271
SHA512 7d2e4e382f9591f0ba5098d6a265f6b70b5a6c360f6223ac0309edf7bea7c13c4b951888244ddafb512127b2c192075aeaf77a93ded3a1336e822abcfd83ebc8
SSDEEP 49152:KDjlabwz9PDjlabwz96f+wrja6tTPZYoUKm5OeNRwXIM2BfM3:6qwhqws+ia6tzZ1Zm5OmRwX0B+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

risepro stealer

Malware Config

Extracted

Family

risepro

77.91.77.122:50500

Signatures

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Executes dropped EXE 2 IoCs

pid	Process
2808	work.exe
3020	fesygh.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs

pid	Process
3020	fesygh.exe
3020	fesygh.exe
3020	fesygh.exe
3020	fesygh.exe
3020	fesygh.exe
3020	fesygh.exe
3020	fesygh.exe
3020	fesygh.exe
3020	fesygh.exe
3020	fesygh.exe
3020	fesygh.exe
3020	fesygh.exe
3020	fesygh.exe
3020	fesygh.exe
3020	fesygh.exe
3020	fesygh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3020	fesygh.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 1332	2464	68a9e97be5bec9fba6108897ebef0a1f00dec90cf894071dc80ba0fed62a2999.exe	80
PID 2464 wrote to memory of 1332	2464	68a9e97be5bec9fba6108897ebef0a1f00dec90cf894071dc80ba0fed62a2999.exe	80
PID 1332 wrote to memory of 2808	1332	cmd.exe	84
PID 1332 wrote to memory of 2808	1332	cmd.exe	84
PID 2808 wrote to memory of 3020	2808	work.exe	85
PID 2808 wrote to memory of 3020	2808	work.exe	85
PID 2808 wrote to memory of 3020	2808	work.exe	85

C:\Users\Admin\AppData\Local\Temp\68a9e97be5bec9fba6108897ebef0a1f00dec90cf894071dc80ba0fed62a2999.exe
"C:\Users\Admin\AppData\Local\Temp\68a9e97be5bec9fba6108897ebef0a1f00dec90cf894071dc80ba0fed62a2999.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1332
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe
    work.exe -priverdD
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2808
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\fesygh.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\fesygh.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetWindowsHookEx
      PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1.bat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat
Size 35B
SHA256 065d2b17ad499587dc9de7ee9ecda4938b45da1df388bc72e6627dff220f64d2
MD5 ff59d999beb970447667695ce3273f75
SHA1 316fa09f467ba90ac34a054daf2e92e6e2854ff8
SHA512 d5ac72cb065a3cd3cb118a69a2f356314eeed24dcb4880751e1a3683895e66cedc62607967e29f77a0c27adf1c9fe0efd86e804f693f0a63a5b51b0bf0056b5d
MD5 SHA1 SHA512

Submit Download

work.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe
Size 2.2MB
SHA256 692d78b34f0b5529280379a9fca8eed5d07ad378433cc59d9fe3e96a30d8ddc1
MD5 0fa5c74f07d73aafaafc23af988de1cb
SHA1 983c56fecc490a5721f69bf0110834eb2ec99e74
SHA512 e44aa8712d8bac4168d9f2f8e163daa289e3f257db01803a59f84e881336093025573bdd9f064f4b1e0edbb0221b434c2aa6b58003da6682950dadad54e5f414
SSDEEP 49152:1Djlabwz96f+wrja6tTPZYoUKm5OeNRwXIM2BfMQ:Zqws+ia6tzZ1Zm5OmRwX0B5
MD5 SHA1 SHA512 SSDEEP

Submit Download

fesygh.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\fesygh.exe
Size 1.8MB
SHA256 27976f8a3228f36bf268be4f3aade11d7ef07b0d81df6935e5b240cfa87b5661
MD5 596a208b0986edaa3f8dae751e2d0a4c
SHA1 101fc93688b28b1566d132f20d03b35a3e6ac083
SHA512 dbfa35919d31e2361f62adeb3110495c5b946f89b78d07e27d924d9aafbe6b63944185f1262b99237dc485286c5f5916b70f40d98afa138578b882e9fad263c9
SSDEEP 49152:wqaQuIcPmvaWVVo2pScFbEqnp9onfsTImTFMF:zxcPYzdpnF34fslTy
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3020-22-0x0000000000910000-0x0000000000E12000-memory.dmp

Download

memory/3020-23-0x0000000000910000-0x0000000000E12000-memory.dmp

Download

memory/3020-24-0x0000000000910000-0x0000000000E12000-memory.dmp

Download

memory/3020-25-0x0000000000910000-0x0000000000E12000-memory.dmp

Download

memory/3020-26-0x0000000000910000-0x0000000000E12000-memory.dmp

Download

memory/3020-27-0x0000000000910000-0x0000000000E12000-memory.dmp

Download

memory/3020-28-0x0000000000910000-0x0000000000E12000-memory.dmp

Download

memory/3020-29-0x0000000000910000-0x0000000000E12000-memory.dmp

Download

memory/3020-30-0x0000000000910000-0x0000000000E12000-memory.dmp

Download

memory/3020-31-0x0000000000910000-0x0000000000E12000-memory.dmp

Download

memory/3020-32-0x0000000000910000-0x0000000000E12000-memory.dmp

Download

memory/3020-33-0x0000000000910000-0x0000000000E12000-memory.dmp

Download

memory/3020-34-0x0000000000910000-0x0000000000E12000-memory.dmp

Download

memory/3020-35-0x0000000000910000-0x0000000000E12000-memory.dmp

Download

memory/3020-36-0x0000000000910000-0x0000000000E12000-memory.dmp

Download

memory/3020-37-0x0000000000910000-0x0000000000E12000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads