Behavioral task
behavioral1
Sample
4460-13-0x0000000000990000-0x0000000000F57000-memory.exe
Resource
win7-20240221-en
General
-
Target
4460-13-0x0000000000990000-0x0000000000F57000-memory.dmp
-
Size
5.8MB
-
MD5
62673968611a090a92f00177f961d7e5
-
SHA1
1a3cb4930a1b241e72d247317a991de39e3f95e7
-
SHA256
e760fbf092b23396ce280e99efcf21fb96333d8dab0b4ea96d948320cb8cb365
-
SHA512
abf2bd68f6f824c49d5beecb88663f49301dcedb5d5b34583fd99bcc525993d69f3843225ff456b58ce1c195d557ab41bd5e453303fc121597e5313822f41d10
-
SSDEEP
98304:dtNN6XZzPBfe7J5QLHWDcM7uTZScyuPuWfUbb/lQ4bBs1rik6za3AXayVbLZ08:DuXZbBG7rQLHWPXllVsEG3Oay4
Malware Config
Extracted
risepro
147.45.47.126:58709
Signatures
-
Risepro family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4460-13-0x0000000000990000-0x0000000000F57000-memory.dmp
Files
-
4460-13-0x0000000000990000-0x0000000000F57000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 685KB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ssvtmgcw Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
yjwubdxx Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE