risepro | d6a6b072dc40f26656cee11c9dfd8a3da5da0eab7d0223f3e607d6d372b0fc74

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 22:33

Target
2456-2-0x0000000000400000-0x0000000000BED000-memory.exe
Size 7.9MB
Sample240620-2gp3vszhmb
SHA256 d6a6b072dc40f26656cee11c9dfd8a3da5da0eab7d0223f3e607d6d372b0fc74
MD5 ee07504c357fbc4c493c6c99aa64bd64
SHA1 f38369255ad632e5801e1b3861714c5484452897
SHA512 9812aa3e24301a2368afb7ca4cedc657e85c02702c1cf9407b1407c57e5e2493125664ff71a8470b71049d00ee6f5cf08d21bb3e6e7a652d5f10dad3abfed462
SSDEEP 196608:V/Fz40drwQLWCGXXIh3kNOF3IUpdLqKu:pFHF6CKXMVIqd+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
behavioral2/memory/1832-0-0x0000000000400000-0x0000000000BED000-memory.dmp	themida

C:\Users\Admin\AppData\Local\Temp\2456-2-0x0000000000400000-0x0000000000BED000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\2456-2-0x0000000000400000-0x0000000000BED000-memory.exe"
1⤵
PID:1832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4168,i,13281073920029625837,8253721632651544158,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:8
1⤵
PID:812

memory/1832-0-0x0000000000400000-0x0000000000BED000-memory.dmp

Download