risepro | ConsoleApplication2[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
ConsoleApplication2.exe
Size 4.5MB
Sample240607-2sjefsdf9y
SHA256 7988742bd4e94d6d397b5272447c2c746934ae28d9ac97d309a29d787c38cdb6
MD5 9a4898ab1a25b3b48e251d2124c5e88e
SHA1 ed6fbc74ef0e99a6b119994be1879262054850a4
SHA512 d933265160cb56f5ff655c1958a945fa886e6f7c1e4f129e8953f1798f32d304388600ae9d3f7814709640fec1bc748c1f0c3a4b908702aa52b1f4e5ec729820
SSDEEP 49152:mIvkUejzmcMewo3KUda1REXY3DF11tB+ugT6zmRK6HeLzb4Mb7fJPgDEWzIawLy9:mIvkUcIAa1ZDFzBEMeDE2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

risepro

Malware Config

Signatures

Risepro family
risepro

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ConsoleApplication2.exe

File Explorer

ConsoleApplication2.exe

.exe 4.5MB

ConsoleApplication2.exe

IMPHASH 5278d9c5b70842f6172326a7d54162b7
SHA256 7988742bd4e94d6d397b5272447c2c746934ae28d9ac97d309a29d787c38cdb6
MD5 9a4898ab1a25b3b48e251d2124c5e88e
SHA1 ed6fbc74ef0e99a6b119994be1879262054850a4
SHA512 d933265160cb56f5ff655c1958a945fa886e6f7c1e4f129e8953f1798f32d304388600ae9d3f7814709640fec1bc748c1f0c3a4b908702aa52b1f4e5ec729820
SSDEEP 49152:mIvkUejzmcMewo3KUda1REXY3DF11tB+ugT6zmRK6HeLzb4Mb7fJPgDEWzIawLy9:mIvkUcIAa1ZDFzBEMeDE2
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3424684

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\fadi\source\repos\ConsoleApplication2\Release\ConsoleApplication2.pdb

shlwapi

PathFindFileNameW PathFindExtensionW PathFindFileNameA

iphlpapi

GetAdaptersAddresses

winmm

waveInUnprepareHeader waveInGetNumDevs waveInPrepareHeader waveInOpen waveInAddBuffer waveInStop waveInClose waveInStart

kernel32

LockFileEx GetProcAddress UnlockFile HeapDestroy HeapCompact HeapAlloc LoadLibraryW HeapReAlloc DeleteFileW DeleteFileA WaitForSingleObjectEx LoadLibraryA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA HeapSize HeapValidate UnmapViewOfFile CreateFileW WaitForSingleObject CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile HeapFree HeapCreate ReadFile AreFileApisANSI InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx QueryPerformanceFrequency GetSystemDirectoryW GetModuleHandleW SetLastError MoveFileExW GetEnvironmentVariableA GetStdHandle QueryPerformanceCounter PeekNamedPipe WaitForMultipleObjects SleepEx VerSetConditionMask GetModuleHandleA VerifyVersionInfoW GetFileSizeEx InitializeSRWLock ReleaseSRWLockShared AcquireSRWLockShared TlsAlloc TlsGetValue TlsSetValue TlsFree GetEnvironmentVariableW GetModuleHandleExW VirtualFree GetACP GetFileSize GetSystemDirectoryA FindFirstFileW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW GetFileTime SetFilePointerEx CompareStringW GetTimeFormatW GetDateFormatW CreatePipe GetExitCodeProcess GetConsoleOutputCP GetCommandLineW GetCommandLineA SetConsoleCtrlHandler FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW FreeLibraryAndExitThread GetCurrentProcessId GetProcessHeap SystemTimeToFileTime FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime FormatMessageA CreateFileMappingW ExitThread CreateThread GetTickCount FlushFileBuffers GlobalUnlock GetSystemTime CreateDirectoryA GetConsoleWindow GlobalMemoryStatusEx LocalFree GlobalLock GetLocalTime GetSystemInfo CloseHandle Process32FirstW GetDiskFreeSpaceExW Process32NextW GetLastError WriteConsoleW CopyFileA Sleep MultiByteToWideChar CreateToolhelp32Snapshot SetFileAttributesW OpenProcess GetFileAttributesW FindClose FindNextFileA GetModuleFileNameW TerminateProcess lstrlenW CreateProcessW DuplicateHandle ExitProcess LoadLibraryExW InitializeCriticalSectionAndSpinCount FindNextFileW GetFullPathNameW FindFirstFileExW FindFirstFileA GetModuleFileNameA LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW MapViewOfFile SetEnvironmentVariableW GetTimeZoneInformation SetStdHandle GetFileType RtlUnwind InitializeSListHead GetStartupInfoW IsDebuggerPresent GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo DecodePointer EncodePointer CompareStringEx LCMapStringEx GetExitCodeThread TryAcquireSRWLockExclusive GetStringTypeW InitOnceBeginInitialize InitOnceComplete SleepConditionVariableSRW WakeAllConditionVariable GetFileInformationByHandleEx CopyFileW SetFileInformationByHandle GetFileInformationByHandle CreateDirectoryW GetCurrentDirectoryW GetLocaleInfoEx CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns IsProcessorFeaturePresent RaiseException

user32

GetWindowRect GetDC GetSystemMetrics GetUserObjectInformationW MessageBoxW OpenClipboard CloseClipboard MessageBoxA GetProcessWindowStation ReleaseDC GetClipboardData GetDesktopWindow ShowWindow

gdi32

SelectObject DeleteDC BitBlt CreateCompatibleBitmap DeleteObject CreateCompatibleDC GetBitmapBits

winspool.drv

EnumPrintersW

advapi32

CryptEncrypt RegEnumValueW GetUserNameW RegOpenKeyExW RegSetValueExW RegEnumKeyExW GetUserNameA RegCloseKey CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey DeregisterEventSource RegisterEventSourceW ReportEventW CryptSetHashParam CryptGetProvParam GetSecurityInfo CryptEnumProvidersW CryptSignHashW CryptDecrypt CryptExportKey CryptGetUserKey RegQueryValueExW

ole32

CoInitializeEx CoTaskMemFree CoCreateInstance CoUninitialize

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CryptUnprotectData CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertDuplicateCertificateContext CertGetCertificateContextProperty CertAddCertificateContextToStore

ws2_32

listen htonl getsockname connect bind accept select getservbyport inet_pton socket htons WSAIoctl setsockopt WSACleanup WSAStartup recvfrom recv ntohs WSAGetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockopt getservbyname shutdown getaddrinfo sendto getpeername WSASetLastError freeaddrinfo ioctlsocket gethostname gethostbyname inet_addr inet_ntoa inet_ntop gethostbyaddr __WSAFDIsSet

bcrypt

BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptDeriveKeyPBKDF2 BCryptCloseAlgorithmProvider BCryptGenRandom BCryptOpenAlgorithmProvider BCryptGetProperty BCryptSetProperty BCryptDestroyKey BCryptGenerateSymmetricKey BCryptEncrypt BCryptCreateHash