risepro | 2056-0-0x0000000000550000-0x0000000000694000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2056-0-0x0000000000550000-0x0000000000694000-memory.dmp
Size

1.3MB
MD5

c2befe0089159ce60c84ac608a911068
SHA1

f6b6c83e180c5ed5c31b6b906f744dad4b962551
SHA256

3715bfbf136908d3a978d8d7aa9a1a3b30dddba08df64ae9b9e9c42ea753ef9a
SHA512

fdd8e2f9ad1de6a695b005cfb498311e974c05bfd4237a9ff42caf2dd5798d1588013388d86ca320c5f0adb8204d17f30a5db651110c97c5aab6180c8014b310
SSDEEP

24576:NQrTiaPlJ0GghKJuzh6TBK2Y4yWS5BuRuQyauCyTXPDS6ELwp:8TiaPzT/S56uQyauCyTLzELwp

Score

10^/10

risepro

Malware Config

Extracted

Family

risepro

C2

88.210.9.117:50500

Signatures

Risepro family
risepro

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2056-0-0x0000000000550000-0x0000000000694000-memory.dmp

Files

2056-0-0x0000000000550000-0x0000000000694000-memory.dmp
.exe windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 154KB - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ