Behavioral task
behavioral1
Sample
2668-7-0x0000000000880000-0x0000000000E3F000-memory.exe
Resource
win7-20231129-en
General
-
Target
2668-7-0x0000000000880000-0x0000000000E3F000-memory.dmp
-
Size
5.7MB
-
MD5
5828fdd36cfb5d2434962fda094051d0
-
SHA1
33cc1a4811c7373c5cd9ae31f042b6e6ae373bd4
-
SHA256
35b13767f35cd72425a861ad66b02dce53a322515577afd015d3a63ce7770d5a
-
SHA512
da242d57f49ce0d62afe55bd1e1539bb776f030a1113743271231f2018c629d095337e7ac6b18e2d25371e0efa391c5798cfa54825dd3db043d0f913a06b57d3
-
SSDEEP
98304:33vsQeXfTl+paKCFtJRlRuF2BRpphNMhGX2ZKJLpH7StoBy:33LWpuEBRppYW2ZKJLQ6
Malware Config
Extracted
risepro
193.233.132.62
Signatures
-
Risepro family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2668-7-0x0000000000880000-0x0000000000E3F000-memory.dmp
Files
-
2668-7-0x0000000000880000-0x0000000000E3F000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 572KB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
bfxlqqtk Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
wmqfwvec Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE