Behavioral task
behavioral1
Sample
4664-15-0x00000000006F0000-0x0000000000CD4000-memory.exe
Resource
win7-20240221-en
General
-
Target
4664-15-0x00000000006F0000-0x0000000000CD4000-memory.dmp
-
Size
5.9MB
-
MD5
8693e077abc0ced05da4907d75ce7158
-
SHA1
ec54ec807e85e7f1e4aea4774fce2748f2834449
-
SHA256
8b02a6b9164fb390820e9e8ce7a9b3a7c78ede603d8ce9ae1b9cf13cfa1be7ae
-
SHA512
b4156a130b172256b7a89a4d819e83cb98cb00b03597a9c95dcbfc1fb655a5a9e76ec4ab4d804622d05f70d5ce6972ee1092000aabc14c52fd5dc0b4d9c96261
-
SSDEEP
98304:j+x/ELCjH7WiLbzQhv10OPu/57QkC+jabCp1WnZCJtShbstHfK0VWER3KoEVK:KOLuH7Wi3zQhN0OPuhcZCJtWsty0VfRf
Malware Config
Signatures
-
Risepro family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4664-15-0x00000000006F0000-0x0000000000CD4000-memory.dmp
Files
-
4664-15-0x00000000006F0000-0x0000000000CD4000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 680KB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ixenuqiu Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
jfwobtku Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE