Behavioral task
behavioral1
Sample
2040-2-0x0000000001360000-0x0000000001840000-memory.exe
Resource
win7-20231215-en
General
-
Target
2040-2-0x0000000001360000-0x0000000001840000-memory.dmp
-
Size
4.9MB
-
MD5
f75f9b1a2c49aa1b8e43e6bfaa5d4db3
-
SHA1
56711306e923319a6fb48a04db8ffac2df1afe02
-
SHA256
c204991b6821acb2efc9d78fc2a2a66a7b0d170b63bc8a07b4e54f6e44c45e10
-
SHA512
dc1c7a454b24a7e2cf7801d5443d9d0ea7ec673e80d1b300dc32ab48b5d55a0e9ae6767f58d9f11685857b9eb52ceb8a66e2c97a7566667a41387f5b09b5f1e9
-
SSDEEP
49152:oiit2CKO3KHEgVrTxc54lXypUm3yISrmDRp8VfHW+lMmQ9JBlrL8XBqLIJt:oiit2g6HEB54lXFrlMmQ/FLw
Malware Config
Extracted
risepro
193.233.132.62:50500
Signatures
-
Risepro family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2040-2-0x0000000001360000-0x0000000001840000-memory.dmp
Files
-
2040-2-0x0000000001360000-0x0000000001840000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 458KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 71KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 3.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 630KB - Virtual size: 632KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE