Behavioral task
behavioral1
Sample
2136-3-0x0000000000810000-0x000000000136C000-memory.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
2136-3-0x0000000000810000-0x000000000136C000-memory.exe
Resource
win10v2004-20231025-en
General
-
Target
2136-3-0x0000000000810000-0x000000000136C000-memory.dmp
-
Size
11.4MB
-
MD5
e6ea7e18857d7e77ad7f8b84618f5e00
-
SHA1
1f8d6f2387482ff0f506f672996f4e74f585c029
-
SHA256
c9f7418242f325b5f967a4b4482bd985750dfcc14e22461588a4ddad44f96cff
-
SHA512
71c637f4faa036cd39e66fda5aef8e64f6c196f11ba4630fde7415269c02429af285155aec0b01741b308721a5d935e3b19cf3e5365535d2a89d4063bf60b6f3
-
SSDEEP
196608:8p7nVbVY352ipu1kR9aWzUiHUOCQ/6sQkrDZALsJzt56vXhHeX+Ab1CrCxlqiK6F:abVm52cQWNxU1ScGzt56vy+Ab1CrQw6F
Malware Config
Extracted
risepro
194.49.94.171
Signatures
-
Privateloader family
-
Risepro family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2136-3-0x0000000000810000-0x000000000136C000-memory.dmp
Files
-
2136-3-0x0000000000810000-0x000000000136C000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 203KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.|Tracer Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.|Tracer Size: 6.4MB - Virtual size: 6.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ