Behavioral task
behavioral1
Sample
2884-1-0x0000000000110000-0x00000000004B7000-memory.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2884-1-0x0000000000110000-0x00000000004B7000-memory.exe
Resource
win10v2004-20240226-en
General
-
Target
2884-1-0x0000000000110000-0x00000000004B7000-memory.dmp
-
Size
3.7MB
-
MD5
3d2ddf940800b7b061bb7010558f79e4
-
SHA1
4348b77bffc820e68011ecbeb0cb574c6a6e93c2
-
SHA256
e422cd29028e8cce7eb8fffca724c223328d1230becaa0928f02c926845912e0
-
SHA512
8e1da539d6f8ec82d391098c0ef87fcd50145076f99fe00049db3680cf38220b8c5907f13294d1fa333062231cf5a1be6864f096dab94967e2856cf6cb76927b
-
SSDEEP
49152:hbo+XSGVTCO6y/NficfTmIh4xRTXlJ5WPtIrTQUsQca/r0Ib8H:hbo+JTCtcVARhJ5WPtkZFcQvYH
Malware Config
Extracted
risepro
193.233.132.62:50500
Signatures
-
Risepro family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2884-1-0x0000000000110000-0x00000000004B7000-memory.dmp
Files
-
2884-1-0x0000000000110000-0x00000000004B7000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 570KB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ewpureuy Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
plojfuit Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE