Behavioral task
behavioral1
Sample
1660-6-0x00000000001A0000-0x000000000075B000-memory.exe
Resource
win7-20240221-en
General
-
Target
1660-6-0x00000000001A0000-0x000000000075B000-memory.dmp
-
Size
5.7MB
-
MD5
4555e5ed70a322d22147342c8695564a
-
SHA1
c2dfc0c17e0ed73e74123797c3520da98de28bbf
-
SHA256
9a7878d4bec0b8fd5b8b28f5925c2d39cf090753f4b58f45ce855fae8ee1dd73
-
SHA512
05edc682c38018ac9b390304add53581e45d36cad6ef6e2b005154bfba17e3af146ddafa7910ea726e8b61fa59926f17d91742c3284f34342cbe2b0ec403a896
-
SSDEEP
98304:NbMmToA3BY7C+pMzlXG8eBY62GRA37REI+VOoNHSfC/7eaogzq1hIGzt:Nb4fA+/VFNHSfCTtLzk
Malware Config
Extracted
risepro
193.233.132.62
Signatures
-
Risepro family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1660-6-0x00000000001A0000-0x000000000075B000-memory.dmp
Files
-
1660-6-0x00000000001A0000-0x000000000075B000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 573KB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
qfunasif Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
nbnwssxc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE