risepro | MBSetup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
MBSetup.exe
Size 2.5MB
Sample240602-q8fsqaeb4t
SHA256 3c68baabc345c58d95825e548a395d305775b7f0313ec42997c17870ea6a458f
MD5 6107ffe4a1a1ee9eb2453ca669791ac9
SHA1 8f69617ffd69adab260500ec25d5ae50cc49b882
SHA512 305ed565d5b61271e3deac9ab254ce2d70c031f4713c9b37212ea56ff061b8ce0afb5002c02a5252991c506d217f3f6aad439c192384646432f2ae71c252fb56
SSDEEP 49152:u5wZat2rFnBQjvaq/GM6+StQyfvE0Z3R0nxiIq2dd5OAnp:u5wZauVBQjvLQYKtQRq2Hnp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

risepro

Malware Config

Signatures

Risepro family
risepro

File Explorer

MBSetup.exe

.exe 2.5MB

MBSetup.exe

IMPHASH 63ccd71a76a39a85385ce6d1810f26c1
SHA256 3c68baabc345c58d95825e548a395d305775b7f0313ec42997c17870ea6a458f
MD5 6107ffe4a1a1ee9eb2453ca669791ac9
SHA1 8f69617ffd69adab260500ec25d5ae50cc49b882
SHA512 305ed565d5b61271e3deac9ab254ce2d70c031f4713c9b37212ea56ff061b8ce0afb5002c02a5252991c506d217f3f6aad439c192384646432f2ae71c252fb56
SSDEEP 49152:u5wZat2rFnBQjvaq/GM6+StQyfvE0Z3R0nxiIq2dd5OAnp:u5wZauVBQjvLQYKtQRq2Hnp
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

93:10:8f:97:19:03:56:9e:4e:d7:0c:5c:df:c4:92:74:06:65:17:b8:ce:2b:75:ee:7e:10:5c:16:c2:cb:8f:5b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Malwarebytes Inc,O=Malwarebytes Inc,L=Santa Clara,ST=CA,C=US

Chains

Apr 22, 2024

Digest

93:10:8f:97:19:03:56:9e:4e:d7:0c:5c:df:c4:92:74:06:65:17:b8:ce:2b:75:ee:7e:10:5c:16:c2:cb:8f:5b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Malwarebytes Inc.,O=Malwarebytes Inc.,ST=California,C=US

Chains

Apr 22, 2024

CN=Malwarebytes Inc.,O=Malwarebytes Inc.,ST=California,C=US

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=Malwarebytes Inc.,O=Malwarebytes Inc.,ST=California,C=US

Serial Number

a6:57:f7:78:b3:1a:e5:23:d6:67:13:17:18:d1:6e:b2

Issuer

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 23, 2022 - Mar 16, 2025

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

01:fd:6d:30:fc:a3:ca:51:a8:1b:bc:64:0e:35:03:2d

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 1, 2010 - Jan 18, 2038

Subject

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Serial Number

9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - May 24, 2036

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 3, 2023 - Aug 2, 2034

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Malwarebytes Inc,O=Malwarebytes Inc,L=Santa Clara,ST=CA,C=US

Serial Number

33:00:00:ea:f8:2e:47:e1:5f:c2:61:de:27:00:00:00:00:ea:f8

Issuer

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 22, 2024 - Apr 25, 2024

Subject

CN=Malwarebytes Inc,O=Malwarebytes Inc,L=Santa Clara,ST=CA,C=US

Serial Number

33:00:00:ea:f8:2e:47:e1:5f:c2:61:de:27:00:00:00:00:ea:f8

Issuer

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 22, 2024 - Apr 25, 2024

Subject

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:37:8c:5b:a1:d9:5b:8c:d4:00:00:00:00:00:07

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2021 - Apr 13, 2026

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 3, 2023 - Aug 2, 2034

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

454254

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Jenkins\workspace\MBAM-Windows\A_MB5_MBSetup\bin\Win32\Release\MBSetup.pdb

kernel32

LeaveCriticalSection RaiseException EnterCriticalSection GetLastError MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleFileNameW InitializeCriticalSectionEx DeleteCriticalSection IsWow64Process GetCurrentProcess VerifyVersionInfoW VerSetConditionMask GetSystemDirectoryW CreateFileW DeviceIoControl CloseHandle GetCurrentThreadId SetLastError Sleep DeleteFileW GlobalFree LockResource FindResourceExW LocalFree FormatMessageW LocalAlloc CallNamedPipeW GetWindowsDirectoryW SetCurrentDirectoryW GetCommandLineW lstrcmpiW CreateMutexW GetNativeSystemInfo GetDiskFreeSpaceExW FindFirstFileW FindClose CreateProcessW FindNextFileW WideCharToMultiByte GlobalAlloc GlobalLock SetThreadUILanguage LoadLibraryW CreateDirectoryW GetLogicalDrives GetTempPathW MoveFileExW InitializeProcThreadAttributeList UpdateProcThreadAttribute DeleteProcThreadAttributeList OpenProcess ResumeThread TerminateProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetModuleFileNameExW GetCurrentDirectoryW GetCurrentProcessId GetModuleFileNameA OutputDebugStringW SetEndOfFile WriteConsoleW SetStdHandle GetProcAddress GetModuleHandleW FreeLibrary GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy DecodePointer MulDiv SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA GetStringTypeW FindFirstFileExW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle RemoveDirectoryW AreFileApisANSI CopyFileW DuplicateHandle WaitForSingleObjectEx SwitchToThread GetCurrentThread QueryPerformanceCounter TryEnterCriticalSection EncodePointer InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo IsDebuggerPresent InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree SetEvent ResetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread GetModuleHandleA GetVersionExW ReleaseSemaphore InterlockedFlushSList QueryDepthSList UnregisterWaitEx RtlUnwind ExitProcess GetModuleHandleExW GetCommandLineA ExitThread GetStdHandle WriteFile GetFileType FlushFileBuffers GetConsoleCP GetConsoleMode ReadFile SetFilePointerEx GetFileSizeEx GetDateFormatW

dwmapi

DwmGetWindowAttribute

crypt32

CryptMsgClose CertCloseStore CertFreeCertificateContext CertGetNameStringW CertFindCertificateInStore CryptMsgGetParam CryptQueryObject

rpcrt4

UuidToStringW RpcStringFreeW UuidCreate

Sharing

General

Malware Config

Signatures

File Explorer

MBSetup.exe

PE Signature issue

kernel32

dwmapi

crypt32

rpcrt4

generic