Extracted

• • Target

    https://tirrex.cl/server/arch0408_0224.7z

  Score

  10^/10

  riseprodefense_evasiondiscoverystealer

  • Modifies firewall policy service

    defense_evasion

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Risepro family

    risepro

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • Enumerates processes with tasklist

    discovery

  • Suspicious use of SetThreadContext

  behavioral1