risepro | 038147fba2c54767ec6034e9e7c6a9fdffe4d3388a36ae61de5043843c941c34

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 16:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

6.4MB
MD5

ef7fba013fbe8829b6a7037170693d19
SHA1

63f02a3437d0e572fb284f826f8cc6ce4996e5bc
SHA256

038147fba2c54767ec6034e9e7c6a9fdffe4d3388a36ae61de5043843c941c34
SHA512

9550b68e14dc2217e28efd19a67e5f0327eae7660d04d6c5c6adbb6742ba0b157e671830d3b0cc9bb3192ad75ef981be4f0c9d9242a938a370ad360a18eecc45
SSDEEP

196608:6SLpeEaPy4MSpBcb9piUx6lNO35RAcI1:60eEaPy4h09MUJ3vV

Score

10^/10

risepro stealer

Malware Config

Extracted

Family

risepro

77.91.77.180:50500

Signatures

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4340 set thread context of 2468	4340	file.exe	80

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4340	file.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 2468	4340	file.exe	80
PID 4340 wrote to memory of 2468	4340	file.exe	80
PID 4340 wrote to memory of 2468	4340	file.exe	80
PID 4340 wrote to memory of 2468	4340	file.exe	80
PID 4340 wrote to memory of 2468	4340	file.exe	80
PID 4340 wrote to memory of 2468	4340	file.exe	80
PID 4340 wrote to memory of 2468	4340	file.exe	80
PID 4340 wrote to memory of 2468	4340	file.exe	80
PID 4340 wrote to memory of 2468	4340	file.exe	80
PID 4340 wrote to memory of 2468	4340	file.exe	80

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2468-67-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download
memory/2468-68-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download
memory/2468-72-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download
memory/2468-69-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download
memory/4340-51-0x0000000005630000-0x0000000005645000-memory.dmp

Filesize
84KB

Download
memory/4340-19-0x0000000005630000-0x0000000005645000-memory.dmp

Filesize
84KB

Download
memory/4340-6-0x0000000005630000-0x0000000005645000-memory.dmp

Filesize
84KB

Download
memory/4340-13-0x0000000005630000-0x0000000005645000-memory.dmp

Filesize
84KB

Download
memory/4340-63-0x0000000005630000-0x0000000005645000-memory.dmp

Filesize
84KB

Download
memory/4340-62-0x0000000005630000-0x0000000005645000-memory.dmp

Filesize
84KB

Download
memory/4340-4-0x0000000005660000-0x0000000005912000-memory.dmp

Filesize
2.7MB

Download
memory/4340-3-0x0000000074950000-0x0000000075100000-memory.dmp

Filesize
7.7MB

Download
memory/4340-71-0x0000000074950000-0x0000000075100000-memory.dmp

Filesize
7.7MB

Download
memory/4340-2-0x0000000005590000-0x000000000562C000-memory.dmp

Filesize
624KB

Download
memory/4340-1-0x0000000000510000-0x0000000000B86000-memory.dmp

Filesize
6.5MB

Download
memory/4340-66-0x0000000074950000-0x0000000075100000-memory.dmp

Filesize
7.7MB

Download
memory/4340-59-0x0000000005630000-0x0000000005645000-memory.dmp

Filesize
84KB

Download
memory/4340-43-0x0000000005630000-0x0000000005645000-memory.dmp

Filesize
84KB

Download
memory/4340-55-0x0000000005630000-0x0000000005645000-memory.dmp

Filesize
84KB

Download
memory/4340-53-0x0000000005630000-0x0000000005645000-memory.dmp

Filesize
84KB

Download
memory/4340-0-0x000000007495E000-0x000000007495F000-memory.dmp

Filesize
4KB

Download
memory/4340-49-0x0000000005630000-0x0000000005645000-memory.dmp

Filesize
84KB

Download
memory/4340-9-0x0000000005630000-0x0000000005645000-memory.dmp

Filesize
84KB

Download
memory/4340-5-0x0000000005630000-0x000000000564C000-memory.dmp

Filesize
112KB

Download
memory/4340-57-0x0000000005630000-0x0000000005645000-memory.dmp

Filesize
84KB

Download
memory/4340-65-0x0000000005630000-0x0000000005645000-memory.dmp

Filesize
84KB

Download
memory/4340-41-0x0000000005630000-0x0000000005645000-memory.dmp

Filesize
84KB

Download
memory/4340-39-0x0000000005630000-0x0000000005645000-memory.dmp

Filesize
84KB

Download
memory/4340-37-0x0000000005630000-0x0000000005645000-memory.dmp

Filesize
84KB

Download
memory/4340-35-0x0000000005630000-0x0000000005645000-memory.dmp

Filesize
84KB

Download
memory/4340-34-0x0000000005630000-0x0000000005645000-memory.dmp

Filesize
84KB

Download
memory/4340-31-0x0000000005630000-0x0000000005645000-memory.dmp

Filesize
84KB

Download
memory/4340-29-0x0000000005630000-0x0000000005645000-memory.dmp

Filesize
84KB

Download
memory/4340-27-0x0000000005630000-0x0000000005645000-memory.dmp

Filesize
84KB

Download
memory/4340-25-0x0000000005630000-0x0000000005645000-memory.dmp

Filesize
84KB

Download
memory/4340-23-0x0000000005630000-0x0000000005645000-memory.dmp

Filesize
84KB

Download
memory/4340-22-0x0000000005630000-0x0000000005645000-memory.dmp

Filesize
84KB

Download
memory/4340-46-0x0000000005630000-0x0000000005645000-memory.dmp

Filesize
84KB

Download
memory/4340-17-0x0000000005630000-0x0000000005645000-memory.dmp

Filesize
84KB

Download
memory/4340-16-0x0000000005630000-0x0000000005645000-memory.dmp

Filesize
84KB

Download
memory/4340-12-0x0000000005630000-0x0000000005645000-memory.dmp

Filesize
84KB

Download
memory/4340-47-0x0000000005630000-0x0000000005645000-memory.dmp

Filesize
84KB

Download
memory/4340-7-0x0000000005630000-0x0000000005645000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads