risepro | 41abfe88061a6c7229a2d647447d8a6e2bcfd6d9c106a4f82f3aa6a87d37bb32

Analysis

max time kernel
91s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02-07-2024 02:46

Target

2024-07-02_a5315d17b53154f153073fa6087d43c7_magniber_revil.exe
Size

4.3MB
MD5

a5315d17b53154f153073fa6087d43c7
SHA1

be5f75e36110a63f9a755fa439efebf5abe24807
SHA256

41abfe88061a6c7229a2d647447d8a6e2bcfd6d9c106a4f82f3aa6a87d37bb32
SHA512

706e7e173e6ea606f3fc5911e313093c5fe3b912018a3d6d3ee9bacf24699cd20feb47b0d503ad4d2781b72f553379d2a8c36355c3accb49a2421e841c08220f
SSDEEP

49152:VZRGPuGTHRek1vKzNaFCPcFxtxJzgZKUxT2BHHF6c9OtutAP9RojKpT7rBQdz:VZQ3HRek1SzoFrFxlgDx2BOrNJ7rBs

Score

10^/10

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4804	2024-07-02_a5315d17b53154f153073fa6087d43c7_magniber_revil.exe
4804	2024-07-02_a5315d17b53154f153073fa6087d43c7_magniber_revil.exe

C:\Users\Admin\AppData\Local\Temp\2024-07-02_a5315d17b53154f153073fa6087d43c7_magniber_revil.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-02_a5315d17b53154f153073fa6087d43c7_magniber_revil.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4804

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/4804-0-0x0000000000400000-0x000000000085A000-memory.dmp

Filesize
4.4MB

Download
memory/4804-1-0x0000000000400000-0x000000000085A000-memory.dmp

Filesize
4.4MB

Download