Behavioral task
behavioral1
Sample
1888-3-0x0000000000400000-0x0000000000574000-memory.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1888-3-0x0000000000400000-0x0000000000574000-memory.exe
Resource
win10v2004-20231215-en
General
-
Target
1888-3-0x0000000000400000-0x0000000000574000-memory.dmp
-
Size
1.5MB
-
MD5
f55cd928708456e9dbb48d71f6400000
-
SHA1
2b93284a0d17284d13aa011570e8c74cfe50979b
-
SHA256
a3a546b017042e82c4618923bd380c931a860fb8888f190abb1be8550dc747d9
-
SHA512
b130cb6e595e287a9fdc7c12c7e4b4190283ee2e3d9782b8542f4e68ea41b02c6cfc80e94596976a3686fa76129405ab543369be0cc3b0c2d156b6a038c4a024
-
SSDEEP
24576:rH6br3UhichwvMqbKaTNclgDWsUvIxTk9mNGT9UHt:ubrEhicQFQPvd9mITu
Malware Config
Extracted
risepro
193.233.132.62
Signatures
-
Risepro family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1888-3-0x0000000000400000-0x0000000000574000-memory.dmp
Files
-
1888-3-0x0000000000400000-0x0000000000574000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: - Virtual size: 1.3MB
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 94KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE