Extracted

• • Target

    1722448950.190938_setup.exe

  • Size

    2.2MB

  • MD5

    636b4c3770045d8e53c1485ea19f326b

  • SHA1

    dbadc786af04a76114f9f1facb3c007e7b3e2c01

  • SHA256

    952e8649fe47039f20f778310b0591ee83efa659c8bf19c24587e37fe4b14606

  • SHA512

    b498a7b743a3f863998771851ada48e3533598bf156da3c1b9abf430500c4f2a2ede545f25330305c5571235929825edefeddd835f590318e152690b4f5e94a9

  • SSDEEP

    49152:N23muAhf1prFS4Aiy3//QkyM3Pq6ZIiaJKu1AajJQe89:N23muAXs4AKnOCHiYAUQX9

  Score

  10^/10

  riseprodefense_evasiondiscoverystealer

  • Modifies firewall policy service

    defense_evasion

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Risepro family

    risepro

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Drops file in System32 directory

  • Enumerates processes with tasklist

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3