Behavioral task
behavioral1
Sample
2188-3-0x0000000000400000-0x0000000000574000-memory.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2188-3-0x0000000000400000-0x0000000000574000-memory.exe
Resource
win10v2004-20231222-en
General
-
Target
2188-3-0x0000000000400000-0x0000000000574000-memory.dmp
-
Size
1.5MB
-
MD5
3628b2a1c7c6534d8b0a6b48a3d456e1
-
SHA1
9e1945117407e2cf96a418ddb3f89ff3581d026c
-
SHA256
1547eca59003ea3d4fc9a993979945d052d54dd6aa464c42bed4e2a26c79630e
-
SHA512
c06d262f77a893c1dc343a96686cc73ec7231ad5ef49263592a1f2d9d7d1404d3530c838d9314c268584bfc1548f10598eddb60ae728742c66ed57d2b0b63dd1
-
SSDEEP
24576:f56bd38Ow0hGvWqbKLTNclgDWsUvIxTk9mNGT9Un6rUY:UbdsOw0isQPvd9mITm6YY
Malware Config
Extracted
risepro
193.233.132.62
Signatures
-
Risepro family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2188-3-0x0000000000400000-0x0000000000574000-memory.dmp
Files
-
2188-3-0x0000000000400000-0x0000000000574000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: - Virtual size: 1.3MB
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 94KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE