Behavioral task
behavioral1
Sample
1736-1-0x0000000001170000-0x0000000001509000-memory.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1736-1-0x0000000001170000-0x0000000001509000-memory.exe
Resource
win10v2004-20240226-en
General
-
Target
1736-1-0x0000000001170000-0x0000000001509000-memory.dmp
-
Size
3.6MB
-
MD5
dc5f0f71f22bf5260f694547f33b5945
-
SHA1
d63b44417563693c1a995b60f7c9b110e3c2ea51
-
SHA256
86d07ff9870b53532c1cd8642a24572d61af068eda2bf6edc34b9a3153c24d23
-
SHA512
096cb64753af8b3d20844ec81f5d0092cf355c6aa5e73d93ab4efe7d0a8d7479f2c508921dc55f9c53aea9163bf93e106ef776fa391166ecf8600973def1d4ee
-
SSDEEP
98304:LJlURYr0XQJGJN3nOKqpxzrxOBJ7z3wmODl:LJwhsxOjsmo
Malware Config
Extracted
risepro
193.233.132.62
Signatures
-
Risepro family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1736-1-0x0000000001170000-0x0000000001509000-memory.dmp
Files
-
1736-1-0x0000000001170000-0x0000000001509000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 573KB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
cntqsfza Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
pyblsjnn Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE