Behavioral task
behavioral1
Sample
2200-14-0x0000000000C20000-0x00000000011B5000-memory.exe
Resource
win7-20240221-en
General
-
Target
2200-14-0x0000000000C20000-0x00000000011B5000-memory.dmp
-
Size
5.6MB
-
MD5
9fd64fb0e06248b8709ee56541f38796
-
SHA1
5e3d88af82117de93ec836e0619b420c8f1d9c44
-
SHA256
ba899db87ad2b43a7fc2141271d3d81dc92aec6ecb06aa7b12deb5964f559b56
-
SHA512
540585e069500695fcbe4567694402dc347eccb0c900bc2c8f68a5023ba222ca2d7f0ef68fc20ab2e6dbcd191f961d1d3a14b67f5636f9c364e983f8abba5d56
-
SSDEEP
98304:gra6GBo6kVEa9l74Oox93r7twYc50Z0+h0/ioHZ:w5i9b76RArA
Malware Config
Extracted
risepro
147.45.47.93:58709
Signatures
-
Risepro family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2200-14-0x0000000000C20000-0x00000000011B5000-memory.dmp
Files
-
2200-14-0x0000000000C20000-0x00000000011B5000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 591KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
onqvrfdi Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
cdejpxxf Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE