File name:

102a9ec729b9c7d22477ef5614608cb6d53f00947a1dc10ac28475416d2f1ac5

Full analysis: https://app.any.run/tasks/6958eb44-a321-47c9-b0ae-c176cd9e8649
Verdict: Malicious activity
Threats:

RisePro, an information-stealing malware, targets a wide range of sensitive data, including credit cards, passwords, and cryptocurrency wallets. By compromising infected devices, RisePro can steal valuable information and potentially cause significant financial and personal losses for victims.

Malware Trends Tracker     >>>
Analysis date: May 17, 2025, 10:51:02
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
risepro
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

7A1B1911FFF5098FAC7FE44E51EF21B8

SHA1:

B5E5902656728276E4682AF250812381B197E722

SHA256:

102A9EC729B9C7D22477EF5614608CB6D53F00947A1DC10AC28475416D2F1AC5

SSDEEP:

98304:Un2/MFBQuzZpifhClPb/pnmBnWcJq5IsJ1oScxCSpHSrSD8gTMTUbTMmUPDcfpQm:pTxN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • 1qZ24zZ9.exe (PID: 6252)

    • Changes the autorun value in the registry

      • 1qZ24zZ9.exe (PID: 6252)

    • Uses Task Scheduler to run other applications

      • 1qZ24zZ9.exe (PID: 6252)

    • Uses Task Scheduler to autorun other applications

      • 1qZ24zZ9.exe (PID: 6252)

    • Risepro uses scheduled tasks to run itself

      • 1qZ24zZ9.exe (PID: 6252)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • 102a9ec729b9c7d22477ef5614608cb6d53f00947a1dc10ac28475416d2f1ac5.exe (PID: 6800)
      • XK5bd49.exe (PID: 6760)
      • FD6rd67.exe (PID: 4452)

    • Starts a Microsoft application from unusual location

      • 102a9ec729b9c7d22477ef5614608cb6d53f00947a1dc10ac28475416d2f1ac5.exe (PID: 6800)
      • XK5bd49.exe (PID: 6760)
      • FD6rd67.exe (PID: 4452)
      • nv4gB91.exe (PID: 6660)

    • Executable content was dropped or overwritten

      • 102a9ec729b9c7d22477ef5614608cb6d53f00947a1dc10ac28475416d2f1ac5.exe (PID: 6800)
      • XK5bd49.exe (PID: 6760)
      • FD6rd67.exe (PID: 4452)
      • nv4gB91.exe (PID: 6660)
      • 1qZ24zZ9.exe (PID: 6252)

    • Connects to unusual port

      • 1qZ24zZ9.exe (PID: 6252)

  • INFO

    • Create files in a temporary directory

      • 102a9ec729b9c7d22477ef5614608cb6d53f00947a1dc10ac28475416d2f1ac5.exe (PID: 6800)
      • XK5bd49.exe (PID: 6760)
      • FD6rd67.exe (PID: 4452)
      • nv4gB91.exe (PID: 6660)
      • 1qZ24zZ9.exe (PID: 6252)

    • Checks supported languages

      • 102a9ec729b9c7d22477ef5614608cb6d53f00947a1dc10ac28475416d2f1ac5.exe (PID: 6800)
      • nv4gB91.exe (PID: 6660)
      • XK5bd49.exe (PID: 6760)
      • FD6rd67.exe (PID: 4452)
      • 1qZ24zZ9.exe (PID: 6252)

    • The sample compiled with english language support

      • FD6rd67.exe (PID: 4452)
      • XK5bd49.exe (PID: 6760)
      • nv4gB91.exe (PID: 6660)
      • 1qZ24zZ9.exe (PID: 6252)
      • 102a9ec729b9c7d22477ef5614608cb6d53f00947a1dc10ac28475416d2f1ac5.exe (PID: 6800)

    • Creates files or folders in the user directory

      • 1qZ24zZ9.exe (PID: 6252)

    • Reads the computer name

      • 1qZ24zZ9.exe (PID: 6252)

    • Creates files in the program directory

      • 1qZ24zZ9.exe (PID: 6252)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:05:24 22:49:06+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.13
CodeSize: 25600
InitializedDataSize: 1997824
UninitializedDataSize: -
EntryPoint: 0x6a60
OSVersion: 10
ImageVersion: 10
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 11.0.17763.1
ProductVersionNumber: 11.0.17763.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor
FileVersion: 11.00.17763.1 (WinBuild.160101.0800)
InternalName: Wextract
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: WEXTRACT.EXE .MUI
ProductName: Internet Explorer
ProductVersion: 11.00.17763.1
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
11
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 102a9ec729b9c7d22477ef5614608cb6d53f00947a1dc10ac28475416d2f1ac5.exe fd6rd67.exe xk5bd49.exe nv4gb91.exe 1qz24zz9.exe schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
536\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
864schtasks /create /f /RU "admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHESTC:\Windows\SysWOW64\schtasks.exe—1qZ24zZ9.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4452C:\Users\admin\AppData\Local\Temp\IXP000.TMP\FD6rd67.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\FD6rd67.exe
102a9ec729b9c7d22477ef5614608cb6d53f00947a1dc10ac28475416d2f1ac5.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Version:
11.00.17763.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\fd6rd67.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6252C:\Users\admin\AppData\Local\Temp\IXP003.TMP\1qZ24zZ9.exeC:\Users\admin\AppData\Local\Temp\IXP003.TMP\1qZ24zZ9.exe
nv4gB91.exe
User:
admin
Company:
Epic Games
Integrity Level:
MEDIUM
Description:
Easy Anti-Cheat Bootstrapper (EOS)
Version:
1.6.0.0
Modules
Images
c:\users\admin\appdata\local\temp\ixp003.tmp\1qz24zz9.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6660C:\Users\admin\AppData\Local\Temp\IXP002.TMP\nv4gB91.exeC:\Users\admin\AppData\Local\Temp\IXP002.TMP\nv4gB91.exe
XK5bd49.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Version:
11.00.17763.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\ixp002.tmp\nv4gb91.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6760C:\Users\admin\AppData\Local\Temp\IXP001.TMP\XK5bd49.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\XK5bd49.exe
FD6rd67.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Version:
11.00.17763.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\ixp001.tmp\xk5bd49.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6800"C:\Users\admin\AppData\Local\Temp\102a9ec729b9c7d22477ef5614608cb6d53f00947a1dc10ac28475416d2f1ac5.exe" C:\Users\admin\AppData\Local\Temp\102a9ec729b9c7d22477ef5614608cb6d53f00947a1dc10ac28475416d2f1ac5.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Version:
11.00.17763.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\102a9ec729b9c7d22477ef5614608cb6d53f00947a1dc10ac28475416d2f1ac5.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
7208schtasks /create /f /RU "admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHESTC:\Windows\SysWOW64\schtasks.exe—1qZ24zZ9.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7220\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7296C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
Total events
877
Read events
876
Write events
1
Delete events
0

Modification events

(PID) Process:(6252) 1qZ24zZ9.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MaxLoonaFest131
Value:
C:\Users\admin\AppData\Local\MaxLoonaFest131\MaxLoonaFest131.exe
Executable files
11
Suspicious files
1
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
6800102a9ec729b9c7d22477ef5614608cb6d53f00947a1dc10ac28475416d2f1ac5.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\5ud4Wy7.exeexecutable
MD5:763C49E24FC4E891D43FBBCE1D05A60A
SHA256:25D3ED776CD55998289CA4931473981F5AFBA6C646AA8A3E390A53F8F61B5144
4452FD6rd67.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\XK5bd49.exeexecutable
MD5:EBF5706C72AB1FD8E933162C408793F2
SHA256:FEEFA4EE493680AEB0611F569D77D5C9C165F6A3FF792913D307EE11AD225E83
6760XK5bd49.exeC:\Users\admin\AppData\Local\Temp\IXP002.TMP\nv4gB91.exeexecutable
MD5:A8EB80539BB9824271677E2A2D755F36
SHA256:E862CF4F4ED8417494B5A8ED25091132B562831639453DB1AB095C8FC2E7A0A9
4452FD6rd67.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\4ct560cP.exeexecutable
MD5:724FA47FB7E31DA2A6701B84CA16F7AC
SHA256:3C7DAFD6532DC4D933D04C489986E954B9C64CED4765D046E7B1B033A25A3400
62521qZ24zZ9.exeC:\Users\admin\AppData\Local\Temp\FANBooster131\FANBooster131.exeexecutable
MD5:621C992F093A43B754526DB673056812
SHA256:6C04BAFCB73D4AC6571357A20163229BB40C16A9D0EF12E4481DA20BAA148142
6660nv4gB91.exeC:\Users\admin\AppData\Local\Temp\IXP003.TMP\1qZ24zZ9.exeexecutable
MD5:621C992F093A43B754526DB673056812
SHA256:6C04BAFCB73D4AC6571357A20163229BB40C16A9D0EF12E4481DA20BAA148142
62521qZ24zZ9.exeC:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exeexecutable
MD5:621C992F093A43B754526DB673056812
SHA256:6C04BAFCB73D4AC6571357A20163229BB40C16A9D0EF12E4481DA20BAA148142
62521qZ24zZ9.exeC:\Users\admin\AppData\Local\Temp\rise131M9Asphalt.tmptext
MD5:C9961433ADF54D4886D34CA4B6E26767
SHA256:132FF113A4EF72CAF22169AD16C8D8D217C59FFECCD88F75D8875F9BB14AC02B
6660nv4gB91.exeC:\Users\admin\AppData\Local\Temp\IXP003.TMP\2FE6978.exeexecutable
MD5:4E93B44118139D565289CD2F43F57312
SHA256:C1E23732716D60B3CF11547A998B7812455008A2D4F622A3EFC1495A2772C455
6800102a9ec729b9c7d22477ef5614608cb6d53f00947a1dc10ac28475416d2f1ac5.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\FD6rd67.exeexecutable
MD5:1C14231C923F1BB97A2FAE5416922FCA
SHA256:632FA0655E6CE277F3C4956EC4DBC2EABD2E62504EAC74675098CBCEEA073E1B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
22
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.19.11.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7860
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7860
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
2.19.11.120:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
5496
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6252
1qZ24zZ9.exe
194.49.94.152:50500
—
Enes Koken
DE
malicious
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.17:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.18.110
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 2.19.11.120
  • 2.19.11.105
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.17
  • 20.190.160.14
  • 20.190.160.5
  • 40.126.32.68
  • 20.190.160.64
  • 20.190.160.2
  • 20.190.160.128
  • 40.126.32.72
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
102a9ec729b9c7d22477ef5614608cb6d53f00947a1dc10ac28475416d2f1ac5