risepro | ConsoleApplication2[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
ConsoleApplication2.exe
Size 4.4MB
Sample240608-rc975acc51
SHA256 bc77e6254d5b51fbc565a28fd016174736b52ef8f254428e040ef2ba4c943a51
MD5 8e1f20c04032147a7666937b8e4f5ab4
SHA1 cb1d73176367e0f17da6ee35cfd5faac68f05d08
SHA512 24759bfd13fb79130ddba194690393d95ef41432ce4c96cf353bc417fc0ac1645a6be4ec6a3bc041301aa7c59d356af4e8cf48a2bc2acf520781e5a59bfd6780
SSDEEP 49152:WtvS90woveH/WVGYtpli+b3nYy9Oci9rQc7c9l7L3T3GTOhgv/i3MPSunM7ztT2e:WtvS90w2lvIjyvvA/MZsp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

risepro

Malware Config

Signatures

Risepro family
risepro

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ConsoleApplication2.exe

File Explorer

ConsoleApplication2.exe

.exe 4.4MB

ConsoleApplication2.exe

IMPHASH 9b3f403619bee0f3a3d0df0dc0c1bd8e
SHA256 bc77e6254d5b51fbc565a28fd016174736b52ef8f254428e040ef2ba4c943a51
MD5 8e1f20c04032147a7666937b8e4f5ab4
SHA1 cb1d73176367e0f17da6ee35cfd5faac68f05d08
SHA512 24759bfd13fb79130ddba194690393d95ef41432ce4c96cf353bc417fc0ac1645a6be4ec6a3bc041301aa7c59d356af4e8cf48a2bc2acf520781e5a59bfd6780
SSDEEP 49152:WtvS90woveH/WVGYtpli+b3nYy9Oci9rQc7c9l7L3T3GTOhgv/i3MPSunM7ztT2e:WtvS90w2lvIjyvvA/MZsp
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3361792

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\fadi\source\repos\ConsoleApplication2\Release\ConsoleApplication2.pdb

shlwapi

PathFindFileNameA

iphlpapi

GetAdaptersAddresses

kernel32

LockFileEx GetProcAddress UnlockFile HeapDestroy HeapCompact HeapAlloc LoadLibraryW HeapReAlloc DeleteFileW DeleteFileA WaitForSingleObjectEx LoadLibraryA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA HeapSize HeapValidate UnmapViewOfFile CreateFileW WaitForSingleObject CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile HeapFree HeapCreate ReadFile AreFileApisANSI InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx QueryPerformanceFrequency GetSystemDirectoryW GetModuleHandleW SetLastError MoveFileExW GetEnvironmentVariableA GetStdHandle QueryPerformanceCounter PeekNamedPipe WaitForMultipleObjects SleepEx VerSetConditionMask GetModuleHandleA VerifyVersionInfoW GetFileSizeEx InitializeSRWLock ReleaseSRWLockShared AcquireSRWLockShared TlsAlloc TlsGetValue TlsSetValue TlsFree GetEnvironmentVariableW GetModuleHandleExW VirtualFree GetACP GetFileSize GetSystemDirectoryA FindFirstFileW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW GetFileTime SetFilePointerEx CompareStringW GetTimeFormatW GetDateFormatW CreatePipe GetExitCodeProcess GetConsoleOutputCP GetCommandLineW GetCommandLineA SetConsoleCtrlHandler FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW FreeLibraryAndExitThread GetCurrentProcessId GetProcessHeap SystemTimeToFileTime FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime FormatMessageA CreateFileMappingW ExitThread CreateThread GetTickCount FlushFileBuffers GlobalUnlock GetSystemTime CreateDirectoryA GlobalMemoryStatusEx LocalFree GlobalLock GetLocalTime GetSystemInfo CloseHandle GetDiskFreeSpaceExW GetLastError WriteConsoleW CopyFileA Sleep MultiByteToWideChar SetFileAttributesW GetFileAttributesW FindClose FindNextFileA GetModuleFileNameW TerminateProcess CreateProcessW DuplicateHandle ExitProcess LoadLibraryExW InitializeCriticalSectionAndSpinCount FindNextFileW GetFullPathNameW FindFirstFileExW FindFirstFileA LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW MapViewOfFile SetEnvironmentVariableW GetTimeZoneInformation SetStdHandle GetFileType RtlUnwind InitializeSListHead GetStartupInfoW IsDebuggerPresent GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo DecodePointer EncodePointer CompareStringEx LCMapStringEx TryAcquireSRWLockExclusive GetStringTypeW InitOnceBeginInitialize InitOnceComplete SleepConditionVariableSRW WakeAllConditionVariable GetFileInformationByHandleEx SetFileInformationByHandle GetFileInformationByHandle CreateDirectoryW GetCurrentDirectoryW GetLocaleInfoEx CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns IsProcessorFeaturePresent RaiseException

user32

GetWindowRect GetDC GetSystemMetrics GetUserObjectInformationW MessageBoxW OpenClipboard CloseClipboard GetProcessWindowStation ReleaseDC GetClipboardData GetDesktopWindow

gdi32

SelectObject DeleteDC BitBlt CreateCompatibleBitmap DeleteObject CreateCompatibleDC GetBitmapBits

winspool.drv

EnumPrintersW

advapi32

CryptEncrypt RegEnumValueW GetUserNameW RegOpenKeyExW RegEnumKeyExW RegCloseKey CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey DeregisterEventSource RegisterEventSourceW ReportEventW CryptSetHashParam CryptGetProvParam GetSecurityInfo CryptEnumProvidersW CryptSignHashW CryptDecrypt CryptExportKey CryptGetUserKey RegQueryValueExW

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CryptUnprotectData CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertDuplicateCertificateContext CertGetCertificateContextProperty CertAddCertificateContextToStore

ws2_32

listen htonl getsockname connect bind accept select getservbyport inet_pton socket htons WSAIoctl setsockopt WSACleanup WSAStartup recvfrom recv ntohs WSAGetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockopt getservbyname shutdown getaddrinfo sendto getpeername WSASetLastError freeaddrinfo ioctlsocket gethostname gethostbyname inet_addr inet_ntoa inet_ntop gethostbyaddr __WSAFDIsSet

bcrypt

BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptDeriveKeyPBKDF2 BCryptCloseAlgorithmProvider BCryptGenRandom BCryptOpenAlgorithmProvider BCryptGetProperty BCryptSetProperty BCryptDestroyKey BCryptGenerateSymmetricKey BCryptEncrypt BCryptCreateHash