Behavioral task
behavioral1
Sample
3044-2-0x0000000000860000-0x0000000000D7D000-memory.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
3044-2-0x0000000000860000-0x0000000000D7D000-memory.exe
Resource
win10v2004-20231215-en
General
-
Target
3044-2-0x0000000000860000-0x0000000000D7D000-memory.dmp
-
Size
5.1MB
-
MD5
1ea262e96df7891ce664f2e728b9ab50
-
SHA1
b3be143d3c47892003c65ccabd9e9499a9c959b1
-
SHA256
fce1fb0142019b493a2f3e72bc6e5623ff4ea67b49449feed330e49f67df6e2a
-
SHA512
0baaccc0eb2e89137f86f752a08f184ad47d52ab1dd6d116fd3e66ff82a1002676287d69f593e479b5f81b947c7ac606e4a100d54be5c4114f3be7a3b8afbabe
-
SSDEEP
49152:2AxG7espuNnCVw1C2F5lTPLTc0O04zqWkTxcLR+9ZCUalchoTYfr:DxJspuUr2FfTc0O0xfxcLR+9olTYfr
Malware Config
Extracted
risepro
193.233.132.62:50500
Signatures
-
Risepro family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3044-2-0x0000000000860000-0x0000000000D7D000-memory.dmp
Files
-
3044-2-0x0000000000860000-0x0000000000D7D000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 492KB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 80KB - Virtual size: 176KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 45KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 3.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 635KB - Virtual size: 636KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE