Behavioral task
behavioral1
Sample
2896-7-0x0000000001040000-0x00000000015E1000-memory.exe
Resource
win7-20240508-en
General
-
Target
2896-7-0x0000000001040000-0x00000000015E1000-memory.dmp
-
Size
5.6MB
-
MD5
ae92f13c2a3359811e5dfff1b61b4642
-
SHA1
5b047d9ec9f96d9602870bd99d211d0d5c614936
-
SHA256
0a39bf5add027dc22a005b5d06f81f7f30a73bbd913b6fb8dc827ae025b5c302
-
SHA512
e6f008578bae99eedde75a23e4d75335be94845e456a9fe6530bf3953702f5f6ea1875d23b617e91290f4233b76aa6f24d545cf2aa674f6633c6f62993e6f4b3
-
SSDEEP
98304:jSctS1qEy7KbPtBFIR09MoXVAzAQeT3+CTLiTpcH2jQ2fueEA0Q7zait3IEmv:jSJ1xUi3IK2bWUjfTIEm
Malware Config
Extracted
risepro
193.233.132.62
Signatures
-
Risepro family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2896-7-0x0000000001040000-0x00000000015E1000-memory.dmp
Files
-
2896-7-0x0000000001040000-0x00000000015E1000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 572KB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
nlyzwaah Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
lkbejoib Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE