File name:

24252593cb99006ceea27dc8368ba17460f100045f3885bf1edd55209d88b3eb

Full analysis: https://app.any.run/tasks/0c0fdbf2-14cc-45de-b2f8-7fd6c1be26e9
Verdict: Malicious activity
Threats:

RisePro, an information-stealing malware, targets a wide range of sensitive data, including credit cards, passwords, and cryptocurrency wallets. By compromising infected devices, RisePro can steal valuable information and potentially cause significant financial and personal losses for victims.

Malware Trends Tracker     >>>
Analysis date: May 17, 2025, 12:34:53
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
risepro
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

60DADD87272C7E2F1A94F5BBDCE89D05

SHA1:

0DBABC0A372913C9D59AB0D32292104BF3F0710D

SHA256:

24252593CB99006CEEA27DC8368BA17460F100045F3885BF1EDD55209D88B3EB

SSDEEP:

49152:MdhhzWXtZyEuzoy7lg9l2sBJEkzi8AkW3RfOyhKyp0/PSNu:Md3KXtAEusslg9l2yJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • 24252593cb99006ceea27dc8368ba17460f100045f3885bf1edd55209d88b3eb.exe (PID: 4428)

    • Uses Task Scheduler to run other applications

      • 24252593cb99006ceea27dc8368ba17460f100045f3885bf1edd55209d88b3eb.exe (PID: 4428)

    • RISEPRO has been detected (YARA)

      • 24252593cb99006ceea27dc8368ba17460f100045f3885bf1edd55209d88b3eb.exe (PID: 4428)

    • Risepro uses scheduled tasks to run itself

      • 24252593cb99006ceea27dc8368ba17460f100045f3885bf1edd55209d88b3eb.exe (PID: 4428)

    • Changes the autorun value in the registry

      • 24252593cb99006ceea27dc8368ba17460f100045f3885bf1edd55209d88b3eb.exe (PID: 4428)

    • Uses Task Scheduler to autorun other applications

      • 24252593cb99006ceea27dc8368ba17460f100045f3885bf1edd55209d88b3eb.exe (PID: 4428)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 24252593cb99006ceea27dc8368ba17460f100045f3885bf1edd55209d88b3eb.exe (PID: 4428)

    • Connects to unusual port

      • 24252593cb99006ceea27dc8368ba17460f100045f3885bf1edd55209d88b3eb.exe (PID: 4428)

    • There is functionality for taking screenshot (YARA)

      • 24252593cb99006ceea27dc8368ba17460f100045f3885bf1edd55209d88b3eb.exe (PID: 4428)

  • INFO

    • Creates files or folders in the user directory

      • 24252593cb99006ceea27dc8368ba17460f100045f3885bf1edd55209d88b3eb.exe (PID: 4428)

    • Reads the computer name

      • 24252593cb99006ceea27dc8368ba17460f100045f3885bf1edd55209d88b3eb.exe (PID: 4428)

    • The sample compiled with english language support

      • 24252593cb99006ceea27dc8368ba17460f100045f3885bf1edd55209d88b3eb.exe (PID: 4428)

    • Checks supported languages

      • 24252593cb99006ceea27dc8368ba17460f100045f3885bf1edd55209d88b3eb.exe (PID: 4428)

    • Create files in a temporary directory

      • 24252593cb99006ceea27dc8368ba17460f100045f3885bf1edd55209d88b3eb.exe (PID: 4428)

    • Creates files in the program directory

      • 24252593cb99006ceea27dc8368ba17460f100045f3885bf1edd55209d88b3eb.exe (PID: 4428)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

RisePro

(PID) Process(4428) 24252593cb99006ceea27dc8368ba17460f100045f3885bf1edd55209d88b3eb.exe
C2 (1)194.49.94.152
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:11:23 11:16:32+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.34
CodeSize: 1271808
InitializedDataSize: 274432
UninitializedDataSize: -
EntryPoint: 0xe6dab
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.6.0.0
ProductVersionNumber: 1.6.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Epic Games
FileDescription: Easy Anti-Cheat Bootstrapper (EOS)
FileVersion: 1.6.0.0
InternalName: EACLauncher.exe
LegalCopyright: Copyright Epic Games, Inc.
OriginalFileName: EACLauncher.exe
ProductName: Easy Anti-Cheat Bootstrapper (EOS)
ProductVersion: 1.6.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
7
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #RISEPRO 24252593cb99006ceea27dc8368ba17460f100045f3885bf1edd55209d88b3eb.exe schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3768schtasks /create /f /RU "admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHESTC:\Windows\SysWOW64\schtasks.exe—24252593cb99006ceea27dc8368ba17460f100045f3885bf1edd55209d88b3eb.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4428"C:\Users\admin\AppData\Local\Temp\24252593cb99006ceea27dc8368ba17460f100045f3885bf1edd55209d88b3eb.exe" C:\Users\admin\AppData\Local\Temp\24252593cb99006ceea27dc8368ba17460f100045f3885bf1edd55209d88b3eb.exe
explorer.exe
User:
admin
Company:
Epic Games
Integrity Level:
MEDIUM
Description:
Easy Anti-Cheat Bootstrapper (EOS)
Version:
1.6.0.0
Modules
Images
c:\users\admin\appdata\local\temp\24252593cb99006ceea27dc8368ba17460f100045f3885bf1edd55209d88b3eb.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
RisePro
(PID) Process(4428) 24252593cb99006ceea27dc8368ba17460f100045f3885bf1edd55209d88b3eb.exe
C2 (1)194.49.94.152
4944"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5244\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6516schtasks /create /f /RU "admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHESTC:\Windows\SysWOW64\schtasks.exe—24252593cb99006ceea27dc8368ba17460f100045f3885bf1edd55209d88b3eb.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7148\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7148C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
Total events
825
Read events
824
Write events
1
Delete events
0

Modification events

(PID) Process:(4428) 24252593cb99006ceea27dc8368ba17460f100045f3885bf1edd55209d88b3eb.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MaxLoonaFest131
Value:
C:\Users\admin\AppData\Local\MaxLoonaFest131\MaxLoonaFest131.exe
Executable files
3
Suspicious files
1
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
442824252593cb99006ceea27dc8368ba17460f100045f3885bf1edd55209d88b3eb.exeC:\Users\admin\AppData\Local\Temp\rise131M9Asphalt.tmptext
MD5:0AF6340EDAF6B79EBDF23446D14EF386
SHA256:AA71FF5611D07D0BED5C824CB55E970435B8B42351244E077312A568992213A3
442824252593cb99006ceea27dc8368ba17460f100045f3885bf1edd55209d88b3eb.exeC:\Users\admin\AppData\Local\MaxLoonaFest131\MaxLoonaFest131.exeexecutable
MD5:60DADD87272C7E2F1A94F5BBDCE89D05
SHA256:24252593CB99006CEEA27DC8368BA17460F100045F3885BF1EDD55209D88B3EB
442824252593cb99006ceea27dc8368ba17460f100045f3885bf1edd55209d88b3eb.exeC:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exeexecutable
MD5:60DADD87272C7E2F1A94F5BBDCE89D05
SHA256:24252593CB99006CEEA27DC8368BA17460F100045F3885BF1EDD55209D88B3EB
442824252593cb99006ceea27dc8368ba17460f100045f3885bf1edd55209d88b3eb.exeC:\Users\admin\AppData\Local\Temp\FANBooster131\FANBooster131.exeexecutable
MD5:60DADD87272C7E2F1A94F5BBDCE89D05
SHA256:24252593CB99006CEEA27DC8368BA17460F100045F3885BF1EDD55209D88B3EB
442824252593cb99006ceea27dc8368ba17460f100045f3885bf1edd55209d88b3eb.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnkbinary
MD5:F68232117F390FD6E65576ABE691BB5B
SHA256:6D1E87121DBFD761A561C537B3C91023CCF2A7C437B8506F286FE9ACABFEC91C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
23
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.166:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.166:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5544
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5544
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.48.23.166:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.166:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4428
24252593cb99006ceea27dc8368ba17460f100045f3885bf1edd55209d88b3eb.exe
194.49.94.152:50500
—
Enes Koken
DE
malicious
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.174
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.48.23.166
  • 23.48.23.167
  • 23.48.23.176
  • 23.48.23.141
  • 23.48.23.183
  • 23.48.23.190
  • 23.48.23.164
  • 23.48.23.193
  • 23.48.23.180
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.160.2
  • 20.190.160.22
  • 40.126.32.68
  • 40.126.32.76
  • 20.190.160.4
  • 20.190.160.3
  • 40.126.32.136
  • 40.126.32.138
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
24252593cb99006ceea27dc8368ba17460f100045f3885bf1edd55209d88b3eb