risepro | 95a893e07197a813a6d23fa5a35abcec8831197b17ea835e6fd32f2000171cf8 | Triage

Submit
Reports

Overview

overview

Static

static

1

F-SecureOn...er.exe

windows11-21h2-x64

Resubmissions

01-07-2024 10:13

240701-l829havhnd 10

01-07-2024 10:11

240701-l79xysvhkh 10

Sharing

General

Target

F-SecureOnlineScanner.exe
Size

13.2MB
Sample

240701-l829havhnd
MD5

d55e98db94c13103618b16aea55c0de2
SHA1

eb0dc4e5ba77b5570201d84d8e22635be0736dbe
SHA256

95a893e07197a813a6d23fa5a35abcec8831197b17ea835e6fd32f2000171cf8
SHA512

d64d22e4004156e6d348be8f5a1d514864e233d20547ca0893ca20bdd4c36d4ead1fc0555c6fbfe65cb0ca1f076de2735243c14d4d1c6bb90dc52b7fb74393f0
SSDEEP

393216:XKWUuGCWX+wK9EI84FmdyC8rY3PzDM8IWLlYI:33Gv+wKmIHFl43XYI

Score

10^/10

risepro discovery evasion persistence privilege_escalation ransomware spyware stealer

Static task

static1

Behavioral task

behavioral1

Sample

F-SecureOnlineScanner.exe

Resource

win11-20240611-en

risepro discovery evasion persistence privilege_escalation ransomware spyware stealer

windows11-21h2-x64

26 signatures

300 seconds

Malware Config

Targets

- Target
  
  F-SecureOnlineScanner.exe
- Size
  
  13.2MB
- MD5
  
  d55e98db94c13103618b16aea55c0de2
- SHA1
  
  eb0dc4e5ba77b5570201d84d8e22635be0736dbe
- SHA256
  
  95a893e07197a813a6d23fa5a35abcec8831197b17ea835e6fd32f2000171cf8
- SHA512
  
  d64d22e4004156e6d348be8f5a1d514864e233d20547ca0893ca20bdd4c36d4ead1fc0555c6fbfe65cb0ca1f076de2735243c14d4d1c6bb90dc52b7fb74393f0
- SSDEEP
  
  393216:XKWUuGCWX+wK9EI84FmdyC8rY3PzDM8IWLlYI:33Gv+wKmIHFl43XYI
Score

10^/10

risepro discovery evasion persistence privilege_escalation ransomware spyware stealer
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- Clears Windows event logs
  evasion ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Indicator Removal

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

riseprodiscoveryevasionpersistenceprivilege_escalationransomwarespywarestealer

© 2018-2025

Terms | Privacy