Behavioral task
behavioral1
Sample
1524-1-0x0000000000EE0000-0x00000000013E5000-memory.exe
Resource
win7-20240221-en
General
-
Target
1524-1-0x0000000000EE0000-0x00000000013E5000-memory.dmp
-
Size
5.0MB
-
MD5
72494fff6e33c6f0922ef1f9555f1012
-
SHA1
9e7f452131359674802cf8f40ef39090dfc600e4
-
SHA256
5802e2422469c131882e58ac64297beb34d41629f361f0644815c5ea89e51908
-
SHA512
2f01df1696c35507c6eead384f7bfac47dd915fcca3d3f67373a6fa6da83e53df9d55e76cdb1a4f72b51826945b38306a9bbde21c01ff443f41858ae97ab81bf
-
SSDEEP
98304:pt2px5sNLZmdaYpMRBC7YdpJLuQmdsl+HPTpF9ro:pt2yxEOJSQmd9pU
Malware Config
Extracted
risepro
193.233.132.74:58709
Signatures
-
Risepro family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1524-1-0x0000000000EE0000-0x00000000013E5000-memory.dmp
Files
-
1524-1-0x0000000000EE0000-0x00000000013E5000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 574KB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
kueszxml Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
snydpqnp Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE