risepro | 2968-4-0x00000000000D0000-0x0000000000602000-memory[.]dmp

Sharing

Copy URL Twitter E-mail

General

Target
2968-4-0x00000000000D0000-0x0000000000602000-memory.dmp
Size 5.2MB
Sample240616-e9r2lazepc
SHA256 97bf59bb499c1fc0631663760f5633aa054167a54fd19a147a1edf00baccb8be
MD5 fbc17789bc08e9116f494bfe94d4c9a5
SHA1 5f9ffd12b103312bb8825f3b041745647196c4c2
SHA512 4b20b49b269852080c39e7018e8fe89a1c5997b795db0445c1f1f48a875ca097693273d75e073cb46b0f311cb22aa521d0358e3e9664c459c8b22f0aa592fa48
SSDEEP 98304:+O25Rfx7y1CafWyQL9ebtIahzlWpviXYQHMp:H+fxW1FftQL9ebGaVlNYcM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

risepro

Malware Config

Extracted

Family

risepro

147.45.47.126:58709

Signatures

Risepro family
risepro

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2968-4-0x00000000000D0000-0x0000000000602000-memory.dmp

File Explorer

2968-4-0x00000000000D0000-0x0000000000602000-memory.dmp

.exe 5.2MB

2968-4-0x00000000000D0000-0x0000000000602000-memory.dmp

SHA256 97bf59bb499c1fc0631663760f5633aa054167a54fd19a147a1edf00baccb8be
MD5 fbc17789bc08e9116f494bfe94d4c9a5
SHA1 5f9ffd12b103312bb8825f3b041745647196c4c2
SHA512 4b20b49b269852080c39e7018e8fe89a1c5997b795db0445c1f1f48a875ca097693273d75e073cb46b0f311cb22aa521d0358e3e9664c459c8b22f0aa592fa48
SSDEEP 98304:+O25Rfx7y1CafWyQL9ebtIahzlWpviXYQHMp:H+fxW1FftQL9ebGaVlNYcM
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5439732

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

591KB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

64KB

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

2KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

630KB

Virtual Size

632KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

2968-4-0x00000000000D0000-0x0000000000602000-memory.dmp

generic