Behavioral task
behavioral1
Sample
1720-1-0x00000000009B0000-0x0000000000D6B000-memory.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1720-1-0x00000000009B0000-0x0000000000D6B000-memory.exe
Resource
win10v2004-20240226-en
General
-
Target
1720-1-0x00000000009B0000-0x0000000000D6B000-memory.dmp
-
Size
3.7MB
-
MD5
c948e3418204b27a4d8a2a12b3675238
-
SHA1
190b17a15409b950895a14d2152e54dde96f7339
-
SHA256
d72b4622b1b333b494a516c5e7473f5ffaeda6ea93c422d1c84d24c39dccdd6d
-
SHA512
67bf89d118db626abbd457eca79c3a77aed6ec303d605826fb4e4ec9892bdc5e90d5f237017e43cc43cab43c7a90317de05c510d0f56acb51fcf61aedcd49c96
-
SSDEEP
49152:iZyTd0Dkn8eYKYMXTyMf4y/mitosRdmvqTYkKWaD8+:iZyTWIn8vMNgy/mitosR4CTYk5e
Malware Config
Extracted
risepro
193.233.132.62
Signatures
-
Risepro family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1720-1-0x00000000009B0000-0x0000000000D6B000-memory.dmp
Files
-
1720-1-0x00000000009B0000-0x0000000000D6B000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 573KB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ygfagihu Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
forpreru Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE