Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
31/07/2026, 09:37
General
- Target 284ae9899ae53d03d27bd3f72892d843fe5bbecb097f52fc0b1b37d1040401d0.exe
- Size 4.3MB
- Sample260731-lln4cszyev
- SHA256 284ae9899ae53d03d27bd3f72892d843fe5bbecb097f52fc0b1b37d1040401d0
Malware Config
Extracted
-
risepro
-
185.225.200.214
Signatures
- Family: PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
- Family: RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- Modifies firewall policy service 3 TTPs 1 IoCs
- Drops file in System32 directory 4 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\284ae9899ae53d03d27bd3f72892d843fe5bbecb097f52fc0b1b37d1040401d0.exe"C:\Users\Admin\AppData\Local\Temp\284ae9899ae53d03d27bd3f72892d843fe5bbecb097f52fc0b1b37d1040401d0.exe"1⤵
- Modifies firewall policy service
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5060-0-0x00007FF77FD76000-0x00007FF77FFEB000-memory.dmp
memory/5060-3-0x00007FFC20DF0000-0x00007FFC20DF2000-memory.dmp
memory/5060-1-0x00007FFC20DD0000-0x00007FFC20DD2000-memory.dmp
memory/5060-2-0x00007FFC20DE0000-0x00007FFC20DE2000-memory.dmp
memory/5060-8-0x00007FFC1E870000-0x00007FFC1E872000-memory.dmp
memory/5060-7-0x00007FF77FC10000-0x00007FF780430000-memory.dmp
memory/5060-6-0x00007FFC1E860000-0x00007FFC1E862000-memory.dmp
memory/5060-5-0x00007FFC20320000-0x00007FFC20322000-memory.dmp
memory/5060-4-0x00007FFC20310000-0x00007FFC20312000-memory.dmp
memory/5060-20-0x00007FF77FD76000-0x00007FF77FFEB000-memory.dmp
memory/5060-21-0x00007FF77FC10000-0x00007FF780430000-memory.dmp
memory/5060-22-0x00007FF77FC10000-0x00007FF780430000-memory.dmp