Behavioral task
behavioral1
Sample
2504-2-0x00000000013E0000-0x0000000001D29000-memory.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2504-2-0x00000000013E0000-0x0000000001D29000-memory.exe
Resource
win10v2004-20231215-en
General
-
Target
2504-2-0x00000000013E0000-0x0000000001D29000-memory.dmp
-
Size
9.3MB
-
MD5
a10f4ef62faf19ab2b674d6c42872352
-
SHA1
211a63924738f8ab38cb42e977f14fc73c12d5a7
-
SHA256
7fffa5f256175d14c90de37daefebb97064547bb441343cce8f2a062e7cbabd7
-
SHA512
6e4eb62d82eb224b79df492d394a8830e54f5c67014585b64abc7e5ba678c5b2ab52aa3c05b892d233c299f4528774ef427dd3a0f7e043dc1f2d1785d28ae9b4
-
SSDEEP
196608:imEPzE6GHv2ez1UFTnqYuxqhrCo1yOArMjvyWXyp6EZrvsZoq6jBMGQX:ihzE6+uezqF7qkhrCo1rEMjvzip6Evs1
Malware Config
Extracted
risepro
193.233.132.55:50500
Signatures
-
Risepro family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2504-2-0x00000000013E0000-0x0000000001D29000-memory.dmp
Files
-
2504-2-0x00000000013E0000-0x0000000001D29000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 153KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp*³8 Size: - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp*³8 Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp*³8 Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 100KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ