File name:

file

Full analysis: https://app.any.run/tasks/35a9b2a9-e289-4ac0-88d8-04494550109c
Verdict: Malicious activity
Threats:

RisePro, an information-stealing malware, targets a wide range of sensitive data, including credit cards, passwords, and cryptocurrency wallets. By compromising infected devices, RisePro can steal valuable information and potentially cause significant financial and personal losses for victims.

Malware Trends Tracker     >>>
Analysis date: December 02, 2023, 07:36:19
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
risepro
stealer
evasion
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

AE8A00C804E5EAB5EBEA019955FD4127

SHA1:

8D169C2806D827AB5A581FEE69958E7D267E13C1

SHA256:

E6D750764C689687FF957BBFAD08927C26A160CF350AB72E04100CC4EA7F4EA4

SSDEEP:

49152:Fc0N+ryjV/aE35uUzOSA8GbD00TJuqmmWQz2jr52tAk2CRTQeA84jTd3V:Fc0N+ryh/ctT5lWNjr52tdMez4n

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • AppLaunch.exe (PID: 796)

    • Create files in the Startup directory

      • AppLaunch.exe (PID: 796)

    • Uses Task Scheduler to run other applications

      • AppLaunch.exe (PID: 796)

    • Uses Task Scheduler to autorun other applications

      • AppLaunch.exe (PID: 796)

    • RISEPRO has been detected (SURICATA)

      • AppLaunch.exe (PID: 796)

    • Steals credentials from Web Browsers

      • AppLaunch.exe (PID: 796)

    • Steals credentials

      • AppLaunch.exe (PID: 796)

    • RISEPRO has been detected (YARA)

      • AppLaunch.exe (PID: 796)

    • Actions looks like stealing of personal data

      • AppLaunch.exe (PID: 796)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • AppLaunch.exe (PID: 796)

    • Reads settings of System Certificates

      • AppLaunch.exe (PID: 796)

    • Checks for external IP

      • AppLaunch.exe (PID: 796)

    • Connects to unusual port

      • AppLaunch.exe (PID: 796)

    • Reads browser cookies

      • AppLaunch.exe (PID: 796)

    • Accesses Microsoft Outlook profiles

      • AppLaunch.exe (PID: 796)

    • Searches for installed software

      • AppLaunch.exe (PID: 796)

  • INFO

    • Checks supported languages

      • AppLaunch.exe (PID: 796)
      • file.exe (PID: 2208)

    • Reads the computer name

      • AppLaunch.exe (PID: 796)

    • Creates files in the program directory

      • AppLaunch.exe (PID: 796)

    • Reads the machine GUID from the registry

      • AppLaunch.exe (PID: 796)

    • Create files in a temporary directory

      • AppLaunch.exe (PID: 796)

    • Creates files or folders in the user directory

      • AppLaunch.exe (PID: 796)

    • Reads CPU info

      • AppLaunch.exe (PID: 796)

    • Reads product name

      • AppLaunch.exe (PID: 796)

    • Reads Environment values

      • AppLaunch.exe (PID: 796)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

RisePro

(PID) Process(796) AppLaunch.exe
C2193.233.132.51
No Malware configuration.

TRiD

.exe | InstallShield setup (50.1)
.exe | Win64 Executable (generic) (32.2)
.dll | Win32 Dynamic Link Library (generic) (7.6)
.exe | Win32 Executable (generic) (5.2)
.exe | Generic Win/DOS Executable (2.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:12:02 08:31:06+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.34
CodeSize: 744960
InitializedDataSize: 2002432
UninitializedDataSize: -
EntryPoint: 0x11cc
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start file.exe no specs #RISEPRO applaunch.exe schtasks.exe no specs schtasks.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
796"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
file.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET ClickOnce Launch Utility
Exit code:
0
Version:
4.8.3761.0 built by: NET48REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
RisePro
(PID) Process(796) AppLaunch.exe
C2193.233.132.51
2100schtasks /create /f /RU "admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHESTC:\Windows\SysWOW64\schtasks.exe—AppLaunch.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2208"C:\Users\admin\AppData\Local\Temp\file.exe" C:\Users\admin\AppData\Local\Temp\file.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\file.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2924schtasks /create /f /RU "admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHESTC:\Windows\SysWOW64\schtasks.exe—AppLaunch.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
Total events
1 407
Read events
1 402
Write events
5
Delete events
0

Modification events

(PID) Process:(796) AppLaunch.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\15A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
3
Suspicious files
33
Text files
8
Unknown types
2

Dropped files

PID
Process
Filename
Type
796AppLaunch.exeC:\Users\admin\AppData\Local\Temp\posterBoxEBxq5igkh5jHs\Ei8DrAmaYu9Kkey3.dbbinary
MD5:BCA2821DAA9D78EE0255F8158C299354
SHA256:7785F457BCD199A9F2AC604F4F16D0347B9C916C7EC7EC5B4E41A8B268CF14CC
796AppLaunch.exeC:\Users\admin\AppData\Local\Temp\posterBoxEBxq5igkh5jHs\Ei8DrAmaYu9KLogin Databinary
MD5:CEB39527E05115BBE0227EA14D897374
SHA256:D3406398F5A7D00D94E1F36065ACC5C63DBF27FB4026D75FB09129DDD05C2D20
796AppLaunch.exeC:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exeexecutable
MD5:4DF5F963C7E18F062E49870D0AFF8F6F
SHA256:CFA7D98AD44C7FB11DE5FF07DA04F8FD4A3423564DE05F87BA5E10BD13A1FE59
796AppLaunch.exeC:\Users\admin\AppData\Local\Temp\FANBooster131\FANBooster131.exeexecutable
MD5:4DF5F963C7E18F062E49870D0AFF8F6F
SHA256:CFA7D98AD44C7FB11DE5FF07DA04F8FD4A3423564DE05F87BA5E10BD13A1FE59
796AppLaunch.exeC:\Users\admin\AppData\Local\Temp\grandUIAEBxq5igkh5jHs\Quantum_Certs\Firefox_6f92ee326c8ef14418453b590491e536\key3.dbbinary
MD5:580EA25DEA0E72D58350A302BAC91465
SHA256:8E863B7DCD71BD8057D671668C8681A1A763686AAD74AB91E938EFDB197D3007
796AppLaunch.exeC:\Users\admin\AppData\Local\Temp\rise131M9Asphalt.tmptext
MD5:6CFB37895800985A31CBD12E1E876AA3
SHA256:C6C6AE959CF4DBF49353C69A144D3C2BC37768DDD03E2BCF944910390EEBA5AD
796AppLaunch.exeC:\Users\admin\AppData\Local\Temp\posterBoxEBxq5igkh5jHs\8ghN89CsjOW1key4.dbbinary
MD5:3B06A0ABE75A1EE72D7F6D921D3873BC
SHA256:41A47FD351DF24844D3A61CFDA90257A5A43E2B71395D66E3A04B3AA1F986C0F
796AppLaunch.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnkbinary
MD5:80CA1508F9639CDC5C449C5ECF7F15D1
SHA256:D526E99480D7158F584F4C4DE2B6FB8DFB4DB096AAB44B8F32C1525D5EFEAF76
796AppLaunch.exeC:\Users\admin\AppData\Local\Temp\posterBoxEBxq5igkh5jHs\02zdBXl47cvzkey4.dbsqlite
MD5:3B06A0ABE75A1EE72D7F6D921D3873BC
SHA256:41A47FD351DF24844D3A61CFDA90257A5A43E2B71395D66E3A04B3AA1F986C0F
796AppLaunch.exeC:\Users\admin\AppData\Local\Temp\posterBoxEBxq5igkh5jHs\UPG2LoPXwc7Oplaces.sqlite —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
9
DNS requests
2
Threats
11

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
796
AppLaunch.exe
193.233.132.51:50500
—
ATT-INTERNET4
US
unknown
796
AppLaunch.exe
34.117.59.81:443
ipinfo.io
GOOGLE-CLOUD-PLATFORM
US
whitelisted
796
AppLaunch.exe
104.26.5.15:443
db-ip.com
CLOUDFLARENET
US
unknown

DNS requests

Domain
IP
Reputation
ipinfo.io
  • 34.117.59.81
shared
db-ip.com
  • 104.26.5.15
  • 172.67.75.166
  • 104.26.4.15
whitelisted

Threats

PID
Process
Class
Message
796
AppLaunch.exe
Malware Command and Control Activity Detected
ET MALWARE [ANY.RUN] RisePro TCP (Token)
796
AppLaunch.exe
Malware Command and Control Activity Detected
STEALER [ANY.RUN] RisePro TCP (Token)
796
AppLaunch.exe
Malware Command and Control Activity Detected
ET MALWARE [ANY.RUN] RisePro TCP (External IP)
796
AppLaunch.exe
Malware Command and Control Activity Detected
STEALER [ANY.RUN] RisePro TCP (External IP Check)
—
—
A Network Trojan was detected
ET MALWARE Suspected RisePro TCP Heartbeat Packet
796
AppLaunch.exe
Device Retrieving External IP Address Detected
ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
796
AppLaunch.exe
Malware Command and Control Activity Detected
STEALER [ANY.RUN] RisePro TCP (get_settings)
796
AppLaunch.exe
Malware Command and Control Activity Detected
ET MALWARE [ANY.RUN] RisePro TCP (Exfiltration)
796
AppLaunch.exe
Successful Credential Theft Detected
STEALER [ANY.RUN] RisePro TCP (exfiltration)
796
AppLaunch.exe
Malware Command and Control Activity Detected
ET MALWARE [ANY.RUN] RisePro TCP (Activity)
No debug info