Behavioral task
behavioral1
Sample
2204-16-0x0000000000970000-0x0000000000F2E000-memory.exe
Resource
win7-20240221-en
General
-
Target
2204-16-0x0000000000970000-0x0000000000F2E000-memory.dmp
-
Size
5.7MB
-
MD5
fb8d0574b705c1381a2a17338f84ba21
-
SHA1
111ad19d72528bd717f06c8bce4a3944654c7f86
-
SHA256
453bd6298114f37cc7c90b78eb3835e6065cbf3fdcbd352266b896a8d47e3a65
-
SHA512
9d1880bc63df5758947a3b9e50a0451af6e2ffce65c2f8e582cadadadaaa1ef504956228d4f05576edaf678b29aca263054c857da92ca4f9daec4080f432984a
-
SSDEEP
98304:eshIjZPXUgbZ5UNcsh/jF3zSePSt9DoIpy+sSzepVE:hEQJHSt73Bs
Malware Config
Extracted
risepro
147.45.47.93:58709
Signatures
-
Risepro family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2204-16-0x0000000000970000-0x0000000000F2E000-memory.dmp
Files
-
2204-16-0x0000000000970000-0x0000000000F2E000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 591KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
pqptbovo Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
uujqwbld Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE