Behavioral task
behavioral1
Sample
2356-0-0x0000000000E50000-0x0000000001AD7000-memory.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2356-0-0x0000000000E50000-0x0000000001AD7000-memory.exe
Resource
win10v2004-20240221-en
General
-
Target
2356-0-0x0000000000E50000-0x0000000001AD7000-memory.dmp
-
Size
12.5MB
-
MD5
c7124621fb42e8deb8dfc4fea959c408
-
SHA1
e22d24bf5cf742783a241b62a36c0bcb1ac7183e
-
SHA256
6740fb5c054dfa58ae64f238c8f2a37a29bbaed04be0e287a4c4f96102abb6bf
-
SHA512
ae281974887159a20b939f66a8ed8a5bbb08b04f2480145e84900d555a071013bb164649a73ff0e761d3f6a287a7a35547ab8452fdbfe84a189634f591cef238
-
SSDEEP
196608:PImEh6siFLHOU/mguYIFnzB9fFSpTRtx6cla1SUgfGGDN72D4BcuA1OcsNP1sPBG:PM6wnwRJxUenZ9cFdsNP1sZVhba
Malware Config
Extracted
risepro
193.233.132.89:50500
Signatures
-
Risepro family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2356-0-0x0000000000E50000-0x0000000001AD7000-memory.dmp
Files
-
2356-0-0x0000000000E50000-0x0000000001AD7000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 154KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.^_][&u� Size: - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.^_][&u� Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.^_][&u� Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmpyÜ+ Size: - Virtual size: 1005KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmpyÜ+ Size: 1024B - Virtual size: 552B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmpyÜ+ Size: 6.0MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 144KB - Virtual size: 714KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ