Behavioral task
behavioral1
Sample
64-15-0x0000000000620000-0x0000000000B94000-memory.exe
Resource
win7-20240221-en
General
-
Target
64-15-0x0000000000620000-0x0000000000B94000-memory.dmp
-
Size
5.5MB
-
MD5
2efde014ed7fa6c28d33642ed10c62ac
-
SHA1
7a1c886502c79196ddf7f246f6aad111ac7cdea9
-
SHA256
13618ec7286f7ab58ab8b10d14c2a65584328686e16004fe2b1100c8008159a4
-
SHA512
f82503f1fc6c2edd425f189d2701e8f9275bc666db3e67adc6db2275934ea57ab2220e77fbb5aea0fa3c8008dddb3a25549e12bf54c608c17e447d988c1f2c33
-
SSDEEP
98304:vnYawBKKn0nqnPtZBNUW7j/068UuaOIKcTq:kRUP61p7
Malware Config
Extracted
risepro
147.45.47.93:58709
Signatures
-
Risepro family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 64-15-0x0000000000620000-0x0000000000B94000-memory.dmp
Files
-
64-15-0x0000000000620000-0x0000000000B94000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 591KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
wsfqadty Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
kkxxbcen Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE