Behavioral task
behavioral1
Sample
2404-7-0x00000000011A0000-0x0000000001743000-memory.exe
Resource
win7-20240215-en
General
-
Target
2404-7-0x00000000011A0000-0x0000000001743000-memory.dmp
-
Size
5.6MB
-
MD5
1d6f6d6e7ddd47cb39dd1f8c6940071a
-
SHA1
a4b84e8c86d4ad070b3609ccf052e53309a484dc
-
SHA256
1e52b1507e3c75ede2e101dfa16968f44428042c46394bc8f02babce16577e70
-
SHA512
6144825689fe17597cf9f154ab292a7afb1654bd8a645e26fa7f0b372a4f81898e767336b9d9de7503884a9a85a4eca341f472ffa4e9c0f50f1e627f650a1733
-
SSDEEP
98304:pZ4Eulk+yeAoP6kHWMdsEEE2uTmtnNRQRzgbEq57liYjSjzGzfTK:pZQlhTWVN0gL571jSYf
Malware Config
Extracted
risepro
193.233.132.62
Signatures
-
Risepro family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2404-7-0x00000000011A0000-0x0000000001743000-memory.dmp
Files
-
2404-7-0x00000000011A0000-0x0000000001743000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 572KB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
qmylarsc Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
hpulawbf Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE