Behavioral task
behavioral1
Sample
2356-5-0x00000000008A0000-0x0000000000E33000-memory.exe
Resource
win7-20231129-en
General
-
Target
2356-5-0x00000000008A0000-0x0000000000E33000-memory.dmp
-
Size
5.6MB
-
MD5
fec26b1d7ff56d8d8667c52771368d4b
-
SHA1
6ef96585c7bedf3bb2b355263837ad7f90508861
-
SHA256
8f4e7b6d61e20466eaace8c48c9314645265a24ce37b2d2969a17716dfda0372
-
SHA512
3055a75fc3a455668880e6bcea340a2f205fe1edebf28c36555ae328f7dea76d69fb25ce77e2259c4fcd5a6ed638c676d36e9473432fdf9885726d063d6b0d38
-
SSDEEP
98304:NLxVoHvGG3xD1CyGCVByW24wGKdzZeAyi3Ar8/5Sru00v1F1OK:NUHFtZsZeeA4/5Sq00v1
Malware Config
Signatures
-
Risepro family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2356-5-0x00000000008A0000-0x0000000000E33000-memory.dmp
Files
-
2356-5-0x00000000008A0000-0x0000000000E33000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 562KB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
gobaykju Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
nqexkfjg Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE