File name:

ce96a3e09c94bf8715b57584d9ceecdb641b80fe360e2757b01a201749753d7a

Full analysis: https://app.any.run/tasks/51f34408-3372-4b6c-b2d7-57187e24a580
Verdict: Malicious activity
Threats:

RisePro, an information-stealing malware, targets a wide range of sensitive data, including credit cards, passwords, and cryptocurrency wallets. By compromising infected devices, RisePro can steal valuable information and potentially cause significant financial and personal losses for victims.

Malware Trends Tracker     >>>
Analysis date: May 18, 2025, 06:21:03
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
risepro
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

867243EF63D6F23644C8CBD25DEA8DB1

SHA1:

615CD8E15788BA1490AFBB62ED34A96BA2259257

SHA256:

CE96A3E09C94BF8715B57584D9CEECDB641B80FE360E2757B01A201749753D7A

SSDEEP:

98304:On2kcsTk8qUi3gdd8a/p1+cH4N1I/pwQSwx4OZ9WuwlHtUOgU2/NqHjiqA1ZV9yn:WUCpJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • 1NV13Xn8.exe (PID: 7176)

    • Changes the autorun value in the registry

      • 1NV13Xn8.exe (PID: 7176)

    • Uses Task Scheduler to autorun other applications

      • 1NV13Xn8.exe (PID: 7176)

    • Risepro uses scheduled tasks to run itself

      • 1NV13Xn8.exe (PID: 7176)

    • Uses Task Scheduler to run other applications

      • 1NV13Xn8.exe (PID: 7176)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • ce96a3e09c94bf8715b57584d9ceecdb641b80fe360e2757b01a201749753d7a.exe (PID: 680)
      • ml6Lh59.exe (PID: 904)
      • Ct2HD61.exe (PID: 6816)

    • Starts a Microsoft application from unusual location

      • ce96a3e09c94bf8715b57584d9ceecdb641b80fe360e2757b01a201749753d7a.exe (PID: 680)
      • ml6Lh59.exe (PID: 904)
      • Ct2HD61.exe (PID: 6816)
      • eL6bJ13.exe (PID: 5072)

    • Executable content was dropped or overwritten

      • ce96a3e09c94bf8715b57584d9ceecdb641b80fe360e2757b01a201749753d7a.exe (PID: 680)
      • ml6Lh59.exe (PID: 904)
      • Ct2HD61.exe (PID: 6816)
      • eL6bJ13.exe (PID: 5072)
      • 1NV13Xn8.exe (PID: 7176)

    • Connects to unusual port

      • 1NV13Xn8.exe (PID: 7176)

  • INFO

    • Checks supported languages

      • ce96a3e09c94bf8715b57584d9ceecdb641b80fe360e2757b01a201749753d7a.exe (PID: 680)
      • ml6Lh59.exe (PID: 904)
      • Ct2HD61.exe (PID: 6816)
      • 1NV13Xn8.exe (PID: 7176)
      • eL6bJ13.exe (PID: 5072)

    • The sample compiled with english language support

      • ce96a3e09c94bf8715b57584d9ceecdb641b80fe360e2757b01a201749753d7a.exe (PID: 680)
      • ml6Lh59.exe (PID: 904)
      • Ct2HD61.exe (PID: 6816)
      • eL6bJ13.exe (PID: 5072)
      • 1NV13Xn8.exe (PID: 7176)

    • Create files in a temporary directory

      • ce96a3e09c94bf8715b57584d9ceecdb641b80fe360e2757b01a201749753d7a.exe (PID: 680)
      • ml6Lh59.exe (PID: 904)
      • Ct2HD61.exe (PID: 6816)
      • 1NV13Xn8.exe (PID: 7176)
      • eL6bJ13.exe (PID: 5072)

    • Reads the computer name

      • 1NV13Xn8.exe (PID: 7176)

    • Creates files or folders in the user directory

      • 1NV13Xn8.exe (PID: 7176)

    • Creates files in the program directory

      • 1NV13Xn8.exe (PID: 7176)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:05:24 22:49:06+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.13
CodeSize: 25600
InitializedDataSize: 1742848
UninitializedDataSize: -
EntryPoint: 0x6a60
OSVersion: 10
ImageVersion: 10
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 11.0.17763.1
ProductVersionNumber: 11.0.17763.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor
FileVersion: 11.00.17763.1 (WinBuild.160101.0800)
InternalName: Wextract
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: WEXTRACT.EXE .MUI
ProductName: Internet Explorer
ProductVersion: 11.00.17763.1
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
11
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start ce96a3e09c94bf8715b57584d9ceecdb641b80fe360e2757b01a201749753d7a.exe ml6lh59.exe ct2hd61.exe el6bj13.exe 1nv13xn8.exe schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
680"C:\Users\admin\AppData\Local\Temp\ce96a3e09c94bf8715b57584d9ceecdb641b80fe360e2757b01a201749753d7a.exe" C:\Users\admin\AppData\Local\Temp\ce96a3e09c94bf8715b57584d9ceecdb641b80fe360e2757b01a201749753d7a.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Version:
11.00.17763.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\ce96a3e09c94bf8715b57584d9ceecdb641b80fe360e2757b01a201749753d7a.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
904C:\Users\admin\AppData\Local\Temp\IXP000.TMP\ml6Lh59.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\ml6Lh59.exe
ce96a3e09c94bf8715b57584d9ceecdb641b80fe360e2757b01a201749753d7a.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Version:
11.00.17763.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\ml6lh59.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
5072C:\Users\admin\AppData\Local\Temp\IXP002.TMP\eL6bJ13.exeC:\Users\admin\AppData\Local\Temp\IXP002.TMP\eL6bJ13.exe
Ct2HD61.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Version:
11.00.17763.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\ixp002.tmp\el6bj13.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6816C:\Users\admin\AppData\Local\Temp\IXP001.TMP\Ct2HD61.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\Ct2HD61.exe
ml6Lh59.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Version:
11.00.17763.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\ixp001.tmp\ct2hd61.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
7176C:\Users\admin\AppData\Local\Temp\IXP003.TMP\1NV13Xn8.exeC:\Users\admin\AppData\Local\Temp\IXP003.TMP\1NV13Xn8.exe
eL6bJ13.exe
User:
admin
Company:
Epic Games
Integrity Level:
MEDIUM
Description:
Easy Anti-Cheat Bootstrapper (EOS)
Version:
1.6.0.0
Modules
Images
c:\users\admin\appdata\local\temp\ixp003.tmp\1nv13xn8.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
7204schtasks /create /f /RU "admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHESTC:\Windows\SysWOW64\schtasks.exe—1NV13Xn8.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7212\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7268schtasks /create /f /RU "admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHESTC:\Windows\SysWOW64\schtasks.exe—1NV13Xn8.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7276\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7432C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
Total events
877
Read events
876
Write events
1
Delete events
0

Modification events

(PID) Process:(7176) 1NV13Xn8.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MaxLoonaFest131
Value:
C:\Users\admin\AppData\Local\MaxLoonaFest131\MaxLoonaFest131.exe
Executable files
11
Suspicious files
1
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
904ml6Lh59.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\4yv063YO.exeexecutable
MD5:BA89C70CAED4F0FC9B85C19D2633DE7D
SHA256:A5F47551CA86D57B2119B59134F26AB890D92B247A2C48F1B1D4E8ACB841021E
6816Ct2HD61.exeC:\Users\admin\AppData\Local\Temp\IXP002.TMP\3rA30Of.exeexecutable
MD5:FE5103AA7B8B663471316B783A128382
SHA256:0089992678EAC950F7FC08B64817F2619FB5F53901FAFE37006ED5B645106E48
680ce96a3e09c94bf8715b57584d9ceecdb641b80fe360e2757b01a201749753d7a.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\5Cp6Iz3.exeexecutable
MD5:45AFA8F45354F1F6F56ACFF4A21A94D6
SHA256:BAC7D841F3190D1037B519726E196D0670FBEB89D30F0410C59EF287B3E6FCA0
904ml6Lh59.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\Ct2HD61.exeexecutable
MD5:0417967ED6C1321136E09A1943F07F36
SHA256:B47A1549F4A924C6C440D5F7C6ECA907FF54CD9DC748A355793A2AEEFCC28DE1
680ce96a3e09c94bf8715b57584d9ceecdb641b80fe360e2757b01a201749753d7a.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\ml6Lh59.exeexecutable
MD5:CBA3C479104884228F582B7721FDDF24
SHA256:EC497E9CCA0DCED2478EAB27344AC62906F466844594F9DEFCFE58600365001E
71761NV13Xn8.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnkbinary
MD5:CCF57A6134E800BB11EF1D7CFACC1F0D
SHA256:90918E97FDDA2B054F133ED58669EC3BCC74FB2E5B4313E4AA0D8903DF5E9E63
6816Ct2HD61.exeC:\Users\admin\AppData\Local\Temp\IXP002.TMP\eL6bJ13.exeexecutable
MD5:A3CC6A02EA2387C881D4F2E4780CA1DF
SHA256:E38BD94EC8555BC98A12D743832F973B9ACE2FD9F80D42218213903897E9DD1D
71761NV13Xn8.exeC:\Users\admin\AppData\Local\Temp\rise131M9Asphalt.tmptext
MD5:0C26180DC61E52C4E0C7223D927E5401
SHA256:5B1286C030F07D82639974F96D5697770D6B0830F1E5C90FAD9790BD7D17AEA3
5072eL6bJ13.exeC:\Users\admin\AppData\Local\Temp\IXP003.TMP\1NV13Xn8.exeexecutable
MD5:F9F38D7F0CDA1CEF769C9A0A0D7BF57A
SHA256:97E5D8D7D635E3B73213E5CC17E04BF85F1563556C16AB9E1CFCF483272F2C4B
71761NV13Xn8.exeC:\Users\admin\AppData\Local\MaxLoonaFest131\MaxLoonaFest131.exeexecutable
MD5:F9F38D7F0CDA1CEF769C9A0A0D7BF57A
SHA256:97E5D8D7D635E3B73213E5CC17E04BF85F1563556C16AB9E1CFCF483272F2C4B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
23
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7996
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7996
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
7176
1NV13Xn8.exe
194.49.94.152:50500
—
Enes Koken
DE
malicious
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.22:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
google.com
  • 172.217.16.206
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.36
  • 23.216.77.20
  • 23.216.77.6
  • 23.216.77.42
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 184.30.21.171
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.22
  • 20.190.160.14
  • 20.190.160.5
  • 40.126.32.136
  • 40.126.32.138
  • 40.126.32.76
  • 20.190.160.3
  • 20.190.160.130
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ce96a3e09c94bf8715b57584d9ceecdb641b80fe360e2757b01a201749753d7a