File name:

External24.exe

Full analysis: https://app.any.run/tasks/c9a75375-f72f-4026-9441-7c9cb74d881c
Verdict: Malicious activity
Threats:

RisePro, an information-stealing malware, targets a wide range of sensitive data, including credit cards, passwords, and cryptocurrency wallets. By compromising infected devices, RisePro can steal valuable information and potentially cause significant financial and personal losses for victims.

Malware Trends Tracker     >>>
Analysis date: April 11, 2025, 23:06:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
autoit
autoit-loader
risepro
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

E8AF10713A9E8EE414A1A0865C2379F2

SHA1:

12193121A75325CA4A32E7260D82E6D8C85FE0D4

SHA256:

ACAD873DA34AAB461E8A7B87DD2C6D98C3B2B187F5CA868415BAC26AF1516DA5

SSDEEP:

98304:T7z4iQ229IPCDV7hePTT0yQG0NiKks3WCVGIiuKYQZvbl0Y08Z/Msb3bMPc/W424:cbgCk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • External24.exe (PID: 2848)
      • External24.exe (PID: 1548)

    • Antivirus name has been found in the command line (generic signature)

      • findstr.exe (PID: 1880)
      • findstr.exe (PID: 752)
      • findstr.exe (PID: 1268)
      • findstr.exe (PID: 1396)

    • Uses Task Scheduler to autorun other applications

      • Lawyers.pif (PID: 3312)

    • RISEPRO has been detected (YARA)

      • Lawyers.pif (PID: 3632)

    • Changes the Windows auto-update feature

      • Lawyers.pif (PID: 3632)

    • AutoIt loader has been detected (YARA)

      • Lawyers.pif (PID: 3312)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • External24.exe (PID: 2848)
      • cmd.exe (PID: 2008)
      • External24.exe (PID: 1548)
      • cmd.exe (PID: 2356)
      • Lawyers.pif (PID: 3016)

    • Reads security settings of Internet Explorer

      • External24.exe (PID: 2848)
      • Lawyers.pif (PID: 3016)
      • External24.exe (PID: 1548)

    • Executing commands from ".cmd" file

      • External24.exe (PID: 2848)
      • External24.exe (PID: 1548)

    • Reads the Internet Settings

      • External24.exe (PID: 2848)
      • Lawyers.pif (PID: 3016)
      • External24.exe (PID: 1548)

    • Get information on the list of running processes

      • cmd.exe (PID: 2008)
      • cmd.exe (PID: 2356)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 2008)
      • cmd.exe (PID: 2356)

    • Executable content was dropped or overwritten

      • cmd.exe (PID: 2008)
      • Lawyers.pif (PID: 3312)

    • Drops a file with a rarely used extension (PIF)

      • cmd.exe (PID: 2008)
      • Lawyers.pif (PID: 3312)

    • Suspicious file concatenation

      • cmd.exe (PID: 2944)
      • cmd.exe (PID: 3280)

    • Application launched itself

      • cmd.exe (PID: 2008)
      • cmd.exe (PID: 2356)
      • Lawyers.pif (PID: 3312)

    • The executable file from the user directory is run by the CMD process

      • Lawyers.pif (PID: 3016)
      • Lawyers.pif (PID: 3312)

    • Starts application with an unusual extension

      • cmd.exe (PID: 2008)
      • cmd.exe (PID: 2356)
      • Lawyers.pif (PID: 3312)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 2008)
      • cmd.exe (PID: 2356)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 2356)
      • Lawyers.pif (PID: 3312)
      • cmd.exe (PID: 2008)

    • There is functionality for taking screenshot (YARA)

      • Lawyers.pif (PID: 3632)
      • Lawyers.pif (PID: 3312)

    • Connects to unusual port

      • Lawyers.pif (PID: 3632)

  • INFO

    • Create files in a temporary directory

      • External24.exe (PID: 2848)
      • External24.exe (PID: 1548)

    • Checks supported languages

      • External24.exe (PID: 2848)
      • External24.exe (PID: 1548)
      • Lawyers.pif (PID: 3016)
      • Lawyers.pif (PID: 3312)
      • Lawyers.pif (PID: 3632)

    • Reads the computer name

      • External24.exe (PID: 2848)
      • Lawyers.pif (PID: 3016)
      • External24.exe (PID: 1548)
      • Lawyers.pif (PID: 3312)
      • Lawyers.pif (PID: 3632)

    • Creates a new folder

      • cmd.exe (PID: 972)
      • cmd.exe (PID: 2544)

    • Reads mouse settings

      • Lawyers.pif (PID: 3016)
      • Lawyers.pif (PID: 3312)

    • Creates files or folders in the user directory

      • Lawyers.pif (PID: 3312)

    • The sample compiled with english language support

      • Lawyers.pif (PID: 3312)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

RisePro

(PID) Process(3632) Lawyers.pif
C2 (1)3.36.173.8:50500
Strings (55)\OpenVPN Connect
\Growtopia
\GHISLER\wcx_ftp.ini
\Minecraft
\.minecraft\launcher_msa_credentials.bin
\Steam
\Element
\accounts.xml
\TotalCommander
\Growtopia\save.dat
\LunarClient
\.minecraft\launcher_accounts.json
\ICQ\0001
\launcher_profiles.json
\launcher_accounts.json
\config.json
\.feather\accounts.json
WSASend
\ey_tokens.txt
C:\program files\steam
frug?0
\Pidgin
S,{w_6
VaultCloseVault
\.lunarclient\settings\games\accounts.txt
\accounts.txt
\launcher_msa_credentials.bin
\Local Storage
VaultOpenVault
\Element\Local Storage
J~|Hw
\Skype
\save.dat
\.minecraft\launcher_profiles.json
\Signal
\FeatherClient
\.purple
\Battle.net
\databases
VaultGetItem
\Games
\TLauncher
logins
\Messengers
APPDATA
\FileZilla
\OpenVPN Connect\profiles
\accounts.json
\Microsoft\Skype for Desktop\Local Storage
\tlauncher_profiles.json
C:\program files (x86)\steam
\wcx_ftp.ini
\config
UaEt,
\Session Storage
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:02:24 19:20:04+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 29696
InitializedDataSize: 489984
UninitializedDataSize: 16896
EntryPoint: 0x38af
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
66
Monitored processes
25
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start external24.exe no specs cmd.exe tasklist.exe no specs findstr.exe no specs findstr.exe no specs tasklist.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs lawyers.pif no specs timeout.exe no specs cmd.exe external24.exe no specs cmd.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs lawyers.pif timeout.exe no specs schtasks.exe no specs #RISEPRO lawyers.pif

Process information

PID
CMD
Path
Indicators
Parent process
752findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe" C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
972cmd /c md 292668C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
984tasklist C:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Lists the current running tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1268findstr /I "wrsa.exe opssvc.exe" C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
1396findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe" C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
1548C:\Users\admin\Desktop\External24.exeC:\Users\admin\Desktop\External24.exe—cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\external24.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
1800tasklist C:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1880findstr /I "wrsa.exe opssvc.exe" C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
2008"C:\Windows\System32\cmd.exe" /c copy Forgot Forgot.cmd & Forgot.cmdC:\Windows\System32\cmd.exe
External24.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2272tasklist C:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
4 025
Read events
3 965
Write events
38
Delete events
22

Modification events

(PID) Process:(2848) External24.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2848) External24.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2848) External24.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2848) External24.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3016) Lawyers.pifKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3016) Lawyers.pifKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3016) Lawyers.pifKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3016) Lawyers.pifKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1548) External24.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1548) External24.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
2
Suspicious files
44
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
2848External24.exeC:\Users\admin\AppData\Local\Temp\Lungbinary
MD5:EB432B91C0DB6A8B55C34F72D6A22201
SHA256:1D1F60BA613C9A9A588C15611C3D58BA912F8C5085F29E8728CA341267A58CB4
2848External24.exeC:\Users\admin\AppData\Local\Temp\Campbinary
MD5:2B6842ED089C780B04EC63A4913C01BC
SHA256:061523D676409A44F05464AA6CF32C62654B1037C33DD71C4417AF58B9F8B146
2848External24.exeC:\Users\admin\AppData\Local\Temp\Situationbinary
MD5:71E552ACF27B7198855203A7A6A25099
SHA256:73DBE22328916C224F2505C96043C966A74A711490E523A48F7FBBF2D4D90160
2848External24.exeC:\Users\admin\AppData\Local\Temp\Obesitybinary
MD5:379316EE013596397CF60738D378F843
SHA256:E9C14A5A32CCEBE859B4017D1115837310E7EE529B4E02F0D6C21CFE5BE340B0
2848External24.exeC:\Users\admin\AppData\Local\Temp\Accidentsbinary
MD5:0E6A2C91997604F59DE9B6DDEC6AFAEA
SHA256:27119FD62B46A840203D09A2CFE60771129A7FACA326F840E1C9E3A2053C8999
2848External24.exeC:\Users\admin\AppData\Local\Temp\Annexbinary
MD5:A5D18667A79D8C963BB32315EFE47E14
SHA256:65B9C9E5C04CCE99E2A4EF9BEBE6178A007EE21094C9EB83C7E587F5F809DBE7
2848External24.exeC:\Users\admin\AppData\Local\Temp\Monsterbinary
MD5:2B9C205FB7211E283CB476BA654DD9E8
SHA256:F850CCD4E0705E6EB7F8EB93B365D586691B24375BD7F7A1476A4A1A221C7720
2848External24.exeC:\Users\admin\AppData\Local\Temp\Coatedbinary
MD5:3705ED69B8EF3ACFA5114F76081EDE86
SHA256:CF965971F7E3C524C2284AFBF03DCFC33711E54D8A4307D305D3C1059E7E3C20
2848External24.exeC:\Users\admin\AppData\Local\Temp\Locbinary
MD5:E82234E64597DF26B82D9F7906CEB5F4
SHA256:64AC3403F57C4AB0885D1205926DAA8C05B6AE0FBE7A31F21C3FAB9FA3E3F750
2848External24.exeC:\Users\admin\AppData\Local\Temp\Thereforebinary
MD5:93F784793E7649CDAFF272E29EBE301C
SHA256:5A5537DF0CFB09E962D69FC8A7D24B1509A6B1274B1473621B5E91B1FEB589FA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
17
DNS requests
3
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
3632
Lawyers.pif
3.36.173.8:50500
—
AMAZON-02
KR
malicious

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.110
whitelisted
CcUPthUoPgCKIth.CcUPthUoPgCKIth
  • —
unknown
dns.msftncsi.com
  • 131.107.255.255
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
External24.exe