Behavioral task
behavioral1
Sample
1032-4-0x0000000000BA0000-0x00000000010D2000-memory.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1032-4-0x0000000000BA0000-0x00000000010D2000-memory.exe
Resource
win10v2004-20240611-en
General
-
Target
1032-4-0x0000000000BA0000-0x00000000010D2000-memory.dmp
-
Size
5.2MB
-
MD5
68ad8ea34272b95f95b011835c8ee682
-
SHA1
da04a8468a0309edc05eea937c48f57ad5bbb4e0
-
SHA256
02ad9c894bd60c505b509761a80def2217fd1b7b564f02008619776a720563da
-
SHA512
feac7ee77ae35ec3561993d546d66d637923bac6c15279c09de5530a1b985736ba2d193ab1db7363de2b26cc419081ef3f31cfcc303a79266f64df74e8286cd0
-
SSDEEP
98304:eJCGlRrHUS3F3AHQLFmjr41DqDmx0Rx+uaLYxB:U9Rr0S13OQLFmjr42DIa
Malware Config
Extracted
risepro
147.45.47.126:58709
Signatures
-
Risepro family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1032-4-0x0000000000BA0000-0x00000000010D2000-memory.dmp
Files
-
1032-4-0x0000000000BA0000-0x00000000010D2000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 3.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 630KB - Virtual size: 632KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE