risepro | 3498a720830519dabf81f3f99afe873c06407efffe118f59ec88cba096c559cb

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 17:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

5.7MB
MD5

6f66a80f63f04a40812c6e410a26694b
SHA1

b2b28c03f8ab3fea28f21394175fccdeadab24a0
SHA256

3498a720830519dabf81f3f99afe873c06407efffe118f59ec88cba096c559cb
SHA512

eddf716ba6a2042833e6f30f9b16cb75d75bc8cd7e704fd42e375ada556aff598ed79c22f63b783d5f95885c6a82fbc570cc8aa55a6bb6b2aac27ccc67368c56
SSDEEP

98304:EtMGzMuHWLAySm4nS8+chDsnHhfGCjqPCUfs6uw4ah:EPo3LAJJnKLqKUfs6Kah

Score

10^/10

risepro stealer

Malware Config

Extracted

Family

risepro

77.91.77.180:50500

Signatures

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 1656 set thread context of 2672 1656 file.exe MSBuild.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

file.exe

description pid process

Token: SeDebugPrivilege 1656 file.exe

description	pid	process	target process
PID 1656 set thread context of 2672	1656	file.exe	MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	1656	file.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

file.exe

description	pid	process	target process
PID 1656 wrote to memory of 2672	1656	file.exe	MSBuild.exe
PID 1656 wrote to memory of 2672	1656	file.exe	MSBuild.exe
PID 1656 wrote to memory of 2672	1656	file.exe	MSBuild.exe
PID 1656 wrote to memory of 2672	1656	file.exe	MSBuild.exe
PID 1656 wrote to memory of 2672	1656	file.exe	MSBuild.exe
PID 1656 wrote to memory of 2672	1656	file.exe	MSBuild.exe
PID 1656 wrote to memory of 2672	1656	file.exe	MSBuild.exe
PID 1656 wrote to memory of 2672	1656	file.exe	MSBuild.exe
PID 1656 wrote to memory of 2672	1656	file.exe	MSBuild.exe
PID 1656 wrote to memory of 2672	1656	file.exe	MSBuild.exe
PID 1656 wrote to memory of 2672	1656	file.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1656

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
PID:2672

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1656-47-0x00000000022D0000-0x00000000022E5000-memory.dmp

Filesize
84KB

Download
memory/1656-3-0x0000000074D80000-0x000000007546E000-memory.dmp

Filesize
6.9MB

Download
memory/1656-2-0x0000000000B00000-0x0000000000B1A000-memory.dmp

Filesize
104KB

Download
memory/1656-45-0x00000000022D0000-0x00000000022E5000-memory.dmp

Filesize
84KB

Download
memory/1656-4-0x0000000005780000-0x00000000059D0000-memory.dmp

Filesize
2.3MB

Download
memory/1656-5-0x00000000022D0000-0x00000000022EC000-memory.dmp

Filesize
112KB

Download
memory/1656-6-0x00000000022D0000-0x00000000022E5000-memory.dmp

Filesize
84KB

Download
memory/1656-11-0x00000000022D0000-0x00000000022E5000-memory.dmp

Filesize
84KB

Download
memory/1656-29-0x00000000022D0000-0x00000000022E5000-memory.dmp

Filesize
84KB

Download
memory/1656-31-0x00000000022D0000-0x00000000022E5000-memory.dmp

Filesize
84KB

Download
memory/1656-61-0x00000000022D0000-0x00000000022E5000-memory.dmp

Filesize
84KB

Download
memory/1656-65-0x00000000022D0000-0x00000000022E5000-memory.dmp

Filesize
84KB

Download
memory/1656-66-0x0000000074D80000-0x000000007546E000-memory.dmp

Filesize
6.9MB

Download
memory/1656-63-0x00000000022D0000-0x00000000022E5000-memory.dmp

Filesize
84KB

Download
memory/1656-59-0x00000000022D0000-0x00000000022E5000-memory.dmp

Filesize
84KB

Download
memory/1656-43-0x00000000022D0000-0x00000000022E5000-memory.dmp

Filesize
84KB

Download
memory/1656-55-0x00000000022D0000-0x00000000022E5000-memory.dmp

Filesize
84KB

Download
memory/1656-53-0x00000000022D0000-0x00000000022E5000-memory.dmp

Filesize
84KB

Download
memory/1656-52-0x00000000022D0000-0x00000000022E5000-memory.dmp

Filesize
84KB

Download
memory/1656-49-0x00000000022D0000-0x00000000022E5000-memory.dmp

Filesize
84KB

Download
memory/1656-84-0x0000000074D80000-0x000000007546E000-memory.dmp

Filesize
6.9MB

Download
memory/1656-1-0x00000000000D0000-0x0000000000682000-memory.dmp

Filesize
5.7MB

Download
memory/1656-57-0x00000000022D0000-0x00000000022E5000-memory.dmp

Filesize
84KB

Download
memory/1656-41-0x00000000022D0000-0x00000000022E5000-memory.dmp

Filesize
84KB

Download
memory/1656-39-0x00000000022D0000-0x00000000022E5000-memory.dmp

Filesize
84KB

Download
memory/1656-37-0x00000000022D0000-0x00000000022E5000-memory.dmp

Filesize
84KB

Download
memory/1656-35-0x00000000022D0000-0x00000000022E5000-memory.dmp

Filesize
84KB

Download
memory/1656-33-0x00000000022D0000-0x00000000022E5000-memory.dmp

Filesize
84KB

Download
memory/1656-27-0x00000000022D0000-0x00000000022E5000-memory.dmp

Filesize
84KB

Download
memory/1656-25-0x00000000022D0000-0x00000000022E5000-memory.dmp

Filesize
84KB

Download
memory/1656-23-0x00000000022D0000-0x00000000022E5000-memory.dmp

Filesize
84KB

Download
memory/1656-21-0x00000000022D0000-0x00000000022E5000-memory.dmp

Filesize
84KB

Download
memory/1656-19-0x00000000022D0000-0x00000000022E5000-memory.dmp

Filesize
84KB

Download
memory/1656-17-0x00000000022D0000-0x00000000022E5000-memory.dmp

Filesize
84KB

Download
memory/1656-15-0x00000000022D0000-0x00000000022E5000-memory.dmp

Filesize
84KB

Download
memory/1656-13-0x00000000022D0000-0x00000000022E5000-memory.dmp

Filesize
84KB

Download
memory/1656-9-0x00000000022D0000-0x00000000022E5000-memory.dmp

Filesize
84KB

Download
memory/1656-8-0x00000000022D0000-0x00000000022E5000-memory.dmp

Filesize
84KB

Download
memory/1656-0-0x0000000074D8E000-0x0000000074D8F000-memory.dmp

Filesize
4KB

Download
memory/2672-69-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download
memory/2672-83-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download
memory/2672-68-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download
memory/2672-85-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads