risepro | 2536-28-0x0000000000400000-0x0000000000575000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2536-28-0x0000000000400000-0x0000000000575000-memory.dmp
Size

1.5MB
MD5

d564815a23390d311c0e1b3497f5e300
SHA1

a30a057907fe955aef0469af1a34cfd4002843c0
SHA256

20d6cf92edf261176ecbe19b0aaebbb9c64628e979ce60506fd7eb7d13f8da78
SHA512

b7c429b978143a7b4681be59e8a82e8432af11f24437327498db8cfc87a9811a5be4efac9f192da97f11716766613dbf9c2ec46e21cf06dd77877fdfcc0ff3f5
SSDEEP

24576:nUalkVcJGB7FyCTEaYtT9SfVK5Y3IexDzSf3Z8MQQvTICTNiLPUX:nyWJG7yUVYtT8RSPKqvTVTQs

Score

10^/10

risepro

Malware Config

Extracted

Family

risepro

C2

195.20.16.210:50500

Signatures

Risepro family
risepro

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2536-28-0x0000000000400000-0x0000000000575000-memory.dmp

Files

2536-28-0x0000000000400000-0x0000000000575000-memory.dmp
.exe windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 174KB - Virtual size: 173KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ