risepro | 1732e7b37f850365963eecee00963fb5736f7d699bc05e5f7aaaaf3b46a52bac_dump[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
1732e7b37f850365963eecee00963fb5736f7d699bc05e5f7aaaaf3b46a52bac_dump.exe
Size 1.6MB
Sample240604-3g5c8afh83
SHA256 98118cefd0fa23d66b62f428db067888fed95e4e3b520e4bc3bb8c1f0648e5e5
MD5 02b7ffc620622971a7d6242cf53f6cac
SHA1 e17fd7c42bfb88ae471671244ffd4bc0f47b43d8
SHA512 4513996a14b0101c04cc8091b5e62ed507e8a015bd38c1b1ce87380f7752855ea279af619426a398de73a58d70ef753a3152b472da9405133971b709b63f1eae
SSDEEP 49152:1TbDJ4gnpFzjE0Z3Vhs1QLWLWGfdTNRs0u+:1TCgpFzjE0Z3rs1QLWCG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

risepro

Malware Config

Signatures

Risepro family
risepro

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1732e7b37f850365963eecee00963fb5736f7d699bc05e5f7aaaaf3b46a52bac_dump.exe

File Explorer

1732e7b37f850365963eecee00963fb5736f7d699bc05e5f7aaaaf3b46a52bac_dump.exe

.exe 1.6MB

1732e7b37f850365963eecee00963fb5736f7d699bc05e5f7aaaaf3b46a52bac_dump.exe

IMPHASH e2abfd7ba257adf7a15b19d55fcf4379
SHA256 98118cefd0fa23d66b62f428db067888fed95e4e3b520e4bc3bb8c1f0648e5e5
MD5 02b7ffc620622971a7d6242cf53f6cac
SHA1 e17fd7c42bfb88ae471671244ffd4bc0f47b43d8
SHA512 4513996a14b0101c04cc8091b5e62ed507e8a015bd38c1b1ce87380f7752855ea279af619426a398de73a58d70ef753a3152b472da9405133971b709b63f1eae
SSDEEP 49152:1TbDJ4gnpFzjE0Z3Vhs1QLWLWGfdTNRs0u+:1TCgpFzjE0Z3rs1QLWCG
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

212333

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WaitForSingleObject LocalAlloc GetCurrentThreadId GetModuleHandleA GetLocaleInfoA OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar Sleep GetTempPathA GetModuleHandleExA GetTimeZoneInformation GetTickCount64 CopyFileA GetLastError GetFileAttributesA TzSpecificLocalTimeToSystemTime CreateFileA SetEvent TerminateThread LoadLibraryA GetVersionExA DeleteFileA Process32Next CloseHandle GetSystemInfo CreateThread ResetEvent GetWindowsDirectoryA HeapAlloc SetFileAttributesA GetLocalTime GetProcAddress VirtualAllocEx LocalFree IsProcessorFeaturePresent GetFileSize RemoveDirectoryA ReadProcessMemory GetCurrentProcessId GetProcessHeap GlobalMemoryStatusEx SetThreadExecutionState FreeLibrary WideCharToMultiByte CreateRemoteThread GetComputerNameExA CreateDirectoryA GetSystemTime GetVolumeInformationA CreateEventA GetPrivateProfileStringA IsWow64Process IsDebuggerPresent VirtualQueryEx GetComputerNameA SetUnhandledExceptionFilter FindNextFileA lstrcpynA SetFilePointer CreateFileW AreFileApisANSI EnterCriticalSection GetFullPathNameW GetDiskFreeSpaceW LockFile LeaveCriticalSection InitializeCriticalSection GetFullPathNameA SetEndOfFile GetTempPathW GetFileAttributesW FormatMessageW GetDiskFreeSpaceA DeleteFileW UnlockFile LockFileEx DeleteCriticalSection GetSystemTimeAsFileTime FormatMessageA QueryPerformanceCounter GetTickCount FlushFileBuffers VirtualQuery VirtualProtect WriteConsoleW HeapSize SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage CreateMutexA FindClose lstrlenA InitializeCriticalSectionEx GetProcessId GetUserDefaultLocaleName TerminateProcess OutputDebugStringA WriteFile GetCurrentProcess SetPriorityClass SetLastError ReadFile HeapFree FindFirstFileA WriteProcessMemory Process32First GetPrivateProfileSectionNamesA SetStdHandle HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetFileSizeEx GetConsoleOutputCP ReadConsoleW GetConsoleMode GetStdHandle GetModuleFileNameW GetModuleHandleExW ExitProcess GetFileType GetModuleFileNameA SetFilePointerEx LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RaiseException RtlUnwind InitializeSListHead GetStartupInfoW UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable GetStringTypeW GetLocaleInfoEx FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetModuleHandleW GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive LCMapStringEx EncodePointer DecodePointer CompareStringEx GetCPInfo LoadLibraryExA

user32

wsprintfA GetSystemMetrics MessageBoxA GetWindowRect EnumDisplayDevicesA GetDC GetKeyboardLayoutList CharNextA GetCursorPos GetDesktopWindow ReleaseDC

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC DeleteObject BitBlt

advapi32

RegQueryValueExA LsaClose LsaOpenPolicy RegEnumKeyA RegCloseKey RegGetValueA GetCurrentHwProfileA LsaFreeMemory CredEnumerateA RegCreateKeyExA GetUserNameA RegSetValueExA RegOpenKeyExA LsaQueryInformationPolicy RegEnumKeyExA

shell32

ShellExecuteA SHGetFolderPathA

ole32

CoInitialize CoCreateInstance CoInitializeEx CoUninitialize

ws2_32

WSAStartup socket connect recv freeaddrinfo setsockopt WSAGetLastError shutdown WSACleanup closesocket getaddrinfo

crypt32

CryptUnprotectData

shlwapi

PathFindExtensionA

gdiplus

GdipGetImageEncoders GdipCloneImage GdipAlloc GdiplusShutdown GdiplusStartup GdipSaveImageToFile GdipGetImageEncodersSize GdipFree GdipDisposeImage GdipCreateBitmapFromHBITMAP

setupapi

SetupDiEnumDeviceInfo SetupDiGetDeviceInterfaceDetailA SetupDiGetClassDevsA SetupDiEnumDeviceInterfaces

ntdll

RtlUnicodeStringToAnsiString

rstrtmgr

RmStartSession RmGetList RmRegisterResources RmShutdown RmEndSession