Behavioral task
behavioral1
Sample
2648-0-0x0000000001240000-0x00000000017CB000-memory.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2648-0-0x0000000001240000-0x00000000017CB000-memory.exe
Resource
win10v2004-20231215-en
General
-
Target
2648-0-0x0000000001240000-0x00000000017CB000-memory.dmp
-
Size
5.5MB
-
MD5
940db6b39245423a3766266fb20234d3
-
SHA1
c25b8bbd5a3b1c97469c392ff2c90da60d81a7e0
-
SHA256
c0ba2c83eba21b8d8f555399a7f457442169c1c0a607c7554b0d2d8154c9f7c3
-
SHA512
fc86a4abe168ea3b1af5370b0d03fcd9bcedfdebba9fc73ae1942e68d0c8dfa08c4d85e4baed249939f04416cf287b1a48fdaa5ddc69a3c1c7fd194bde76dc1a
-
SSDEEP
98304:/uq6UHjUF+KXz9WC+t+A3G+3SAB0fHn4Mi5kpKGWWpL2v:GqV4+Km+AfBBBWwIL2v
Malware Config
Extracted
risepro
193.233.132.67
Signatures
-
Risepro family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2648-0-0x0000000001240000-0x00000000017CB000-memory.dmp
Files
-
2648-0-0x0000000001240000-0x00000000017CB000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 173KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp°>� Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp°>� Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp°>� Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 195KB - Virtual size: 198KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ