risepro | 1f03dd4db5b7c81c32a77908f3ba149998509df8fe3f1780c269198ef045cfb0

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/04/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-08_c26055270f3c727d018e1848ab6d16f0_elex_manuscrypt_maze_njrat_rhadamanthys_stop.exe
Size 1.2MB
Sample260408-e1ed5sgy8k
SHA256 1f03dd4db5b7c81c32a77908f3ba149998509df8fe3f1780c269198ef045cfb0
MD5 c26055270f3c727d018e1848ab6d16f0
SHA1 02b7ee6c2f37ab07a4d1ce601581b1ca958e10ad
SHA512 4cf1cb927a0fd4458803055008f00be21f5313e9cb322cdacab78661fce9a1ec247b6b30e617edea747081225f7b7cfbe1e88d71d7f8b2e60ff8437908f0042a
SSDEEP 24576:3IwoFmXsR3sf1viW1V6T/uKWZUtH6z1oIxvOJFIw4W/:YuosfYWH6zuKd6z3xvOJFIw4q
TLSH
T18445BF0336947CE2C7255B706E5DA9DA7329B8637F41AB962500674F0CBB2E8DF47B20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution risepro persistence stealer

Malware Config

Signatures

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
Risepro family
risepro

Executes dropped EXE 2 IoCs

pid	Process
4820	RageMP131.exe
1332	MPGPH131.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Windows\CurrentVersion\Run\RageMP131 = "C:\\Users\\Admin\\AppData\\Local\\RageMP131\\RageMP131.exe"	2026-04-08_c26055270f3c727d018e1848ab6d16f0_elex_manuscrypt_maze_njrat_rhadamanthys_stop.exe

Program crash 12 IoCs

pid	pid_target	Process	procid_target
3972	2476	WerFault.exe	78
4888	4820	WerFault.exe	84
2492	1332	WerFault.exe	89
1148	2476	WerFault.exe	78
3656	2476	WerFault.exe	78
2044	4820	WerFault.exe	84
1184	4820	WerFault.exe	84
948	1332	WerFault.exe	89
1408	1332	WerFault.exe	89
2608	4820	WerFault.exe	84
4492	2476	WerFault.exe	78
4484	1332	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-08_c26055270f3c727d018e1848ab6d16f0_elex_manuscrypt_maze_njrat_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RageMP131.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MPGPH131.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1424	schtasks.exe
3120	schtasks.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 1424	2476	2026-04-08_c26055270f3c727d018e1848ab6d16f0_elex_manuscrypt_maze_njrat_rhadamanthys_stop.exe	79
PID 2476 wrote to memory of 3120	2476	2026-04-08_c26055270f3c727d018e1848ab6d16f0_elex_manuscrypt_maze_njrat_rhadamanthys_stop.exe	82

C:\Users\Admin\AppData\Local\Temp\2026-04-08_c26055270f3c727d018e1848ab6d16f0_elex_manuscrypt_maze_njrat_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-08_c26055270f3c727d018e1848ab6d16f0_elex_manuscrypt_maze_njrat_rhadamanthys_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1424
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 872
  2⤵
  - Program crash
  PID:3972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 912
  2⤵
  - Program crash
  PID:1148
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 944
  2⤵
  - Program crash
  PID:3656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 964
  2⤵
  - Program crash
  PID:4492

C:\Users\Admin\AppData\Local\RageMP131\RageMP131.exe
C:\Users\Admin\AppData\Local\RageMP131\RageMP131.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 860
  2⤵
  - Program crash
  PID:4888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 888
  2⤵
  - Program crash
  PID:2044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 668
  2⤵
  - Program crash
  PID:1184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 940
  2⤵
  - Program crash
  PID:2608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2476 -ip 2476
1⤵
PID:2948

C:\ProgramData\MPGPH131\MPGPH131.exe
C:\ProgramData\MPGPH131\MPGPH131.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 852
  2⤵
  - Program crash
  PID:2492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 896
  2⤵
  - Program crash
  PID:948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 668
  2⤵
  - Program crash
  PID:1408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 912
  2⤵
  - Program crash
  PID:4484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4820 -ip 4820
1⤵
PID:1228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1332 -ip 1332
1⤵
PID:4600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2476 -ip 2476
1⤵
PID:1260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2476 -ip 2476
1⤵
PID:484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4820 -ip 4820
1⤵
PID:2996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4820 -ip 4820
1⤵
PID:400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 1332 -ip 1332
1⤵
PID:580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1332 -ip 1332
1⤵
PID:1188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1332 -ip 1332
1⤵
PID:4164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4820 -ip 4820
1⤵
PID:3536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2476 -ip 2476
1⤵
PID:4672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RageMP131.exe

Path C:\Users\Admin\AppData\Local\RageMP131\RageMP131.exe
Size 1.2MB
SHA256 1f03dd4db5b7c81c32a77908f3ba149998509df8fe3f1780c269198ef045cfb0
MD5 c26055270f3c727d018e1848ab6d16f0
SHA1 02b7ee6c2f37ab07a4d1ce601581b1ca958e10ad
SHA512 4cf1cb927a0fd4458803055008f00be21f5313e9cb322cdacab78661fce9a1ec247b6b30e617edea747081225f7b7cfbe1e88d71d7f8b2e60ff8437908f0042a
SSDEEP 24576:3IwoFmXsR3sf1viW1V6T/uKWZUtH6z1oIxvOJFIw4W/:YuosfYWH6zuKd6z3xvOJFIw4q
TLSH
T18445BF0336947CE2C7255B706E5DA9DA7329B8637F41AB962500674F0CBB2E8DF47B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rage131MP.tmp

Path C:\Users\Admin\AppData\Local\Temp\rage131MP.tmp
Size 13B
SHA256 2008771247133acdb33b1c8c3cb69c7e239a41594f7cf0095371ae382f56dea5
MD5 25b00122dee436140986828232e033aa
SHA1 3ea4ad5f551b4dce1de7464da6bca435ff78adf4
SHA512 8209eef9795f5c51c030b6fbd64ffdb09b6046d4d0af4a47635dd73ff7b80f34cbfacb2a149fffe18820da188eae9b51a1d0511bff921a3a5d3935398aca9d57
MD5 SHA1 SHA512

Submit Download

rage131MP.tmp

Path C:\Users\Admin\AppData\Local\Temp\rage131MP.tmp
Size 13B
SHA256 a787ba6d9a15ef3930e95d09833a3e96477a5fa8202ad7a2cc786b4da35225bb
MD5 381438df217b8f33c64a10250b6079f9
SHA1 3c48ab6b3f9c6f9718dfae05d2bcb287a19be5d2
SHA512 c53ace1ea2ee62f4d000098ca71d390be7a11747e3bdaa5cf73c90b2712ae530ca62a4c2295e0103584aeb618724dec5d9c375905d9c11b3583faf4e05497825
MD5 SHA1 SHA512

Submit Download

memory/2476-1-0x0000000003830000-0x00000000038E8000-memory.dmp

Download

memory/2476-2-0x00000000038F0000-0x0000000003A48000-memory.dmp

Download

memory/2476-9-0x0000000003830000-0x00000000038E8000-memory.dmp

Download

memory/4820-10-0x00000000036A0000-0x0000000003762000-memory.dmp

Download

memory/4820-11-0x00000000038C0000-0x0000000003A18000-memory.dmp

Download

memory/4820-20-0x00000000036A0000-0x0000000003762000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads