Behavioral task
behavioral1
Sample
2192-15-0x0000000000080000-0x0000000000601000-memory.exe
Resource
win7-20240220-en
General
-
Target
2192-15-0x0000000000080000-0x0000000000601000-memory.dmp
-
Size
5.5MB
-
MD5
6ec759ccc59c7e4767f14a8edcf4f5ca
-
SHA1
31c09101a8a7c71d735f7b352730570826f390b6
-
SHA256
f28fea06d726dfed3b0b0b1f7a9a5186419c67dcf3f72d328f5c149c67d36614
-
SHA512
7953ec6d48d344995d3e0bb3a5567c0e263c27b77da6c70c0c132267740d44fd6f3eaf0e050fb6fff2bea57e79d0abfa487cc00283b10b9fbcaddd523c8da54b
-
SSDEEP
98304:S4PUXRqt/0fF9FZcwA111SHQG4NaQsNkBByFpf6/iGoXL5u:wHAjIOyF0/k
Malware Config
Extracted
risepro
147.45.47.93:58709
Signatures
-
Risepro family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2192-15-0x0000000000080000-0x0000000000601000-memory.dmp
Files
-
2192-15-0x0000000000080000-0x0000000000601000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 591KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
jxylsmsq Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
rglwykzt Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE