Behavioral task
behavioral1
Sample
2212-5-0x0000000000F00000-0x000000000149F000-memory.exe
Resource
win7-20240221-en
General
-
Target
2212-5-0x0000000000F00000-0x000000000149F000-memory.dmp
-
Size
5.6MB
-
MD5
09a4aeec4182bd2f240a6acef4dd8867
-
SHA1
72bcce0505570de1226ccbd0b903ae1f55684508
-
SHA256
69787cb6bd8f30aaa038265b28ba1779de3fee66a6a1fa1996176e27b5c8097c
-
SHA512
65bf7334a3af66d5eef846d6a9062c7e99dd622733e00be85026a715f9d10c05fc0bbbe164d7a2e877b09e91df0dde8a488bbd05dd40bfe302c415e8d709cad1
-
SSDEEP
98304:yy2frZJFuLzOnFDviqT8hPUF0tl3txQVCcwZimkgmod71zl/P8AQGjh7sH:yy6axPc6i1gmK71R/VQGjh
Malware Config
Extracted
risepro
193.233.132.62
Signatures
-
Risepro family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2212-5-0x0000000000F00000-0x000000000149F000-memory.dmp
Files
-
2212-5-0x0000000000F00000-0x000000000149F000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 573KB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ydlhlmrw Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
gawtdhgd Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE