risepro | ConsoleApplication2[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
ConsoleApplication2.exe
Size 4.4MB
Sample240608-qlc4babh71
SHA256 1df9cdbd354ec869260e374d995aa38486c0d4958cf7f0203f055b929468bc06
MD5 518e321098bdf466dfbb30455114bd95
SHA1 be0a16be68ab67b298d5004679fb16372851a033
SHA512 bf857f3ccd91ed6d76abd835dacb7bc5b44b25a84043361b9d27e166efddc0222eb168192f31b640c2b08053aa2747422f0a38ed6076d36b29445e7f7f5e70c2
SSDEEP 49152:P9vkKj13FnEa8BQLjImx8dpAEoJow1Xo4yCw1xDB+zztRNAUcGEPgiVrCPRRxz1N:P9vkKpS6Xm0MxzvPgzR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

risepro

Malware Config

Signatures

Risepro family
risepro

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ConsoleApplication2.exe

File Explorer

ConsoleApplication2.exe

.exe 4.4MB

ConsoleApplication2.exe

IMPHASH 9b3f403619bee0f3a3d0df0dc0c1bd8e
SHA256 1df9cdbd354ec869260e374d995aa38486c0d4958cf7f0203f055b929468bc06
MD5 518e321098bdf466dfbb30455114bd95
SHA1 be0a16be68ab67b298d5004679fb16372851a033
SHA512 bf857f3ccd91ed6d76abd835dacb7bc5b44b25a84043361b9d27e166efddc0222eb168192f31b640c2b08053aa2747422f0a38ed6076d36b29445e7f7f5e70c2
SSDEEP 49152:P9vkKj13FnEa8BQLjImx8dpAEoJow1Xo4yCw1xDB+zztRNAUcGEPgiVrCPRRxz1N:P9vkKpS6Xm0MxzvPgzR
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3359440

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\fadi\source\repos\ConsoleApplication2\Release\ConsoleApplication2.pdb

shlwapi

PathFindFileNameA

iphlpapi

GetAdaptersAddresses

kernel32

LockFileEx GetProcAddress UnlockFile HeapDestroy HeapCompact HeapAlloc LoadLibraryW HeapReAlloc DeleteFileW DeleteFileA WaitForSingleObjectEx LoadLibraryA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA HeapSize HeapValidate UnmapViewOfFile CreateFileW WaitForSingleObject CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile HeapFree HeapCreate ReadFile AreFileApisANSI InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx QueryPerformanceFrequency GetSystemDirectoryW GetModuleHandleW SetLastError MoveFileExW GetEnvironmentVariableA GetStdHandle QueryPerformanceCounter PeekNamedPipe WaitForMultipleObjects SleepEx VerSetConditionMask GetModuleHandleA VerifyVersionInfoW GetFileSizeEx InitializeSRWLock ReleaseSRWLockShared AcquireSRWLockShared TlsAlloc TlsGetValue TlsSetValue TlsFree GetEnvironmentVariableW GetModuleHandleExW VirtualFree GetACP GetFileSize GetSystemDirectoryA FindFirstFileW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW GetFileTime SetFilePointerEx CompareStringW GetTimeFormatW GetDateFormatW CreatePipe GetExitCodeProcess GetConsoleOutputCP GetCommandLineW GetCommandLineA SetConsoleCtrlHandler FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW FreeLibraryAndExitThread GetCurrentProcessId GetProcessHeap SystemTimeToFileTime FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime FormatMessageA CreateFileMappingW ExitThread CreateThread GetTickCount FlushFileBuffers GlobalUnlock GetSystemTime CreateDirectoryA GlobalMemoryStatusEx LocalFree GlobalLock GetLocalTime GetSystemInfo CloseHandle GetDiskFreeSpaceExW GetLastError WriteConsoleW CopyFileA Sleep MultiByteToWideChar SetFileAttributesW GetFileAttributesW FindClose FindNextFileA GetModuleFileNameW TerminateProcess CreateProcessW DuplicateHandle ExitProcess LoadLibraryExW InitializeCriticalSectionAndSpinCount FindNextFileW GetFullPathNameW FindFirstFileExW FindFirstFileA LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW MapViewOfFile SetEnvironmentVariableW GetTimeZoneInformation SetStdHandle GetFileType RtlUnwind InitializeSListHead GetStartupInfoW IsDebuggerPresent GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo DecodePointer EncodePointer CompareStringEx LCMapStringEx TryAcquireSRWLockExclusive GetStringTypeW InitOnceBeginInitialize InitOnceComplete SleepConditionVariableSRW WakeAllConditionVariable GetFileInformationByHandleEx SetFileInformationByHandle GetFileInformationByHandle CreateDirectoryW GetCurrentDirectoryW GetLocaleInfoEx CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns IsProcessorFeaturePresent RaiseException

user32

GetWindowRect GetDC GetSystemMetrics GetUserObjectInformationW MessageBoxW OpenClipboard CloseClipboard GetProcessWindowStation ReleaseDC GetClipboardData GetDesktopWindow

gdi32

SelectObject DeleteDC BitBlt CreateCompatibleBitmap DeleteObject CreateCompatibleDC GetBitmapBits

winspool.drv

EnumPrintersW

advapi32

CryptEncrypt RegEnumValueW GetUserNameW RegOpenKeyExW RegEnumKeyExW RegCloseKey CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey DeregisterEventSource RegisterEventSourceW ReportEventW CryptSetHashParam CryptGetProvParam GetSecurityInfo CryptEnumProvidersW CryptSignHashW CryptDecrypt CryptExportKey CryptGetUserKey RegQueryValueExW

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CryptUnprotectData CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertDuplicateCertificateContext CertGetCertificateContextProperty CertAddCertificateContextToStore

ws2_32

listen htonl getsockname connect bind accept select getservbyport inet_pton socket htons WSAIoctl setsockopt WSACleanup WSAStartup recvfrom recv ntohs WSAGetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockopt getservbyname shutdown getaddrinfo sendto getpeername WSASetLastError freeaddrinfo ioctlsocket gethostname gethostbyname inet_addr inet_ntoa inet_ntop gethostbyaddr __WSAFDIsSet

bcrypt

BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptDeriveKeyPBKDF2 BCryptCloseAlgorithmProvider BCryptGenRandom BCryptOpenAlgorithmProvider BCryptGetProperty BCryptSetProperty BCryptDestroyKey BCryptGenerateSymmetricKey BCryptEncrypt BCryptCreateHash