Behavioral task
behavioral1
Sample
2780-0-0x00000000011F0000-0x0000000001EFF000-memory.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2780-0-0x00000000011F0000-0x0000000001EFF000-memory.exe
Resource
win10v2004-20240226-en
General
-
Target
2780-0-0x00000000011F0000-0x0000000001EFF000-memory.dmp
-
Size
13.1MB
-
MD5
ac21a4a667b5668ab38a43bd94abb2df
-
SHA1
5d104699b387672de73b1c50d260308637a23f1a
-
SHA256
98d98749b6fbf5da8f5b5e7ed10cca6c972f46074ee2c6355b68fa29c4d0d5ab
-
SHA512
f0661959ebce19e08c349a6c64c1a4d743eaea1116ba1ee369af21eea3bdfe47d3a2ecfedfdef116b4d8acf40c5f426ad9c2146699cf65a18aec9a2279998c6a
-
SSDEEP
393216:PUMty1qa8Ck80uYF513aJ8RKRFx6kv0J7:sMtyBD0uo50UoF9v
Malware Config
Extracted
risepro
193.233.132.67:50500
Signatures
-
Risepro family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2780-0-0x00000000011F0000-0x0000000001EFF000-memory.dmp
Files
-
2780-0-0x00000000011F0000-0x0000000001EFF000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 155KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp�@ Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp�@ Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp÷�� Size: - Virtual size: 991KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp÷�� Size: 1024B - Virtual size: 604B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp÷�� Size: 6.4MB - Virtual size: 6.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 132KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ