risepro | 2024-06-16_a0716209945992928c2dd71dba908414_magniber

Sharing

Copy URL Twitter E-mail

General

Target
2024-06-16_a0716209945992928c2dd71dba908414_magniber
Size 5.9MB
Sample240616-y7at3sweph
SHA256 372decbc4c99f56dac0259d986e412f0951af286abecab30e53f5846bfc28420
MD5 a0716209945992928c2dd71dba908414
SHA1 4ef5707325a2e7466cbc9a8c95ea801e154d442d
SHA512 0ba166158bb84c799d3ba24ca8169e333175e72656ad32018acbeb5b1a192bf4258132d6e37a879c37228b92d218d2e526d4bf10fcee6e1a8723f22b613be728
SSDEEP 98304:DCBbQ2H/oEMjghbO76uAqrngBNXsH7zMdDwPgLcM3qn8V/cwduNJKf+tLN6woKMK:D4Rf/JTNXsH7z0DwPg8vwduGf6jr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

risepro

Malware Config

Signatures

Risepro family
risepro

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-16_a0716209945992928c2dd71dba908414_magniber

File Explorer

2024-06-16_a0716209945992928c2dd71dba908414_magniber

.exe 5.9MB

2024-06-16_a0716209945992928c2dd71dba908414_magniber

IMPHASH f01c8d93cc9496502abbc27ddcf50833
SHA256 372decbc4c99f56dac0259d986e412f0951af286abecab30e53f5846bfc28420
MD5 a0716209945992928c2dd71dba908414
SHA1 4ef5707325a2e7466cbc9a8c95ea801e154d442d
SHA512 0ba166158bb84c799d3ba24ca8169e333175e72656ad32018acbeb5b1a192bf4258132d6e37a879c37228b92d218d2e526d4bf10fcee6e1a8723f22b613be728
SSDEEP 98304:DCBbQ2H/oEMjghbO76uAqrngBNXsH7zMdDwPgLcM3qn8V/cwduNJKf+tLN6woKMK:D4Rf/JTNXsH7z0DwPg8vwduGf6jr
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3199167

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\BuildServer\bna-2\work-git\agent-repository\build\bin\win32-i386-vc141-release\Agent.pdb

wintrust

WinVerifyTrust

bcrypt

BCryptGenRandom

advapi32

CryptSetHashParam RegOpenKeyExA CryptEncrypt CryptImportKey OpenProcessToken AdjustTokenPrivileges AllocateAndInitializeSid CheckTokenMembership DuplicateTokenEx FreeSid GetTokenInformation SetTokenInformation LookupPrivilegeValueW CreateProcessWithTokenW CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceConfigW ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW ChangeServiceConfigW ControlService CreateServiceW DeleteService QueryServiceStatus StartServiceW RegCloseKey RegCreateKeyExW RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW RegDeleteTreeW GetSecurityInfo SetSecurityInfo OpenThreadToken AccessCheck DuplicateToken EqualSid GetFileSecurityW GetSecurityDescriptorDacl InitializeSecurityDescriptor MapGenericMask SetSecurityDescriptorDacl QueryServiceObjectSecurity SetServiceObjectSecurity SetEntriesInAclW GetExplicitEntriesFromAclW GetNamedSecurityInfoW SetNamedSecurityInfoW BuildTrusteeWithSidW ConvertStringSidToSidW GetAce InitializeAcl RegDeleteKeyW RegEnumValueW RegQueryInfoKeyW DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptHashData CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptCreateHash CryptDestroyHash CryptSignHashW CryptEnumProvidersW RegGetValueW CryptGetHashParam CryptGenRandom

dxgi

CreateDXGIFactory1

iphlpapi

GetExtendedTcpTable

powrprof

CallNtPowerInformation

rpcrt4

RpcStringFreeA UuidCreate UuidToStringA

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

winhttp

WinHttpGetIEProxyConfigForCurrentUser WinHttpOpen WinHttpCloseHandle WinHttpGetProxyForUrl

crypt32

CertCreateCertificateChainEngine CertFindExtension CertGetNameStringA CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertGetCertificateContextProperty CertDuplicateCertificateContext CertOpenSystemStoreA CryptStringToBinaryA CertFreeCertificateChainEngine CertVerifyCertificateChainPolicy CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateContext CertDeleteCertificateFromStore CertAddCertificateContextToStore CertCreateCertificateContext CertEnumCertificatesInStore CertOpenStore CryptQueryObject CertGetNameStringW CryptProtectData CryptUnprotectData CryptMsgClose CryptMsgGetParam CertCloseStore CertFindCertificateInStore

kernel32

HeapSize HeapFree HeapAlloc GetDateFormatW GetTimeFormatW ExitThread GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc GetLocaleInfoA OutputDebugStringA IsValidLocale ExitProcess GetProcessHeap IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW ConvertFiberToThread MultiByteToWideChar WideCharToMultiByte GetConsoleWindow SetErrorMode SetConsoleCtrlHandler DecodePointer CloseHandle RaiseException GetLastError InitializeCriticalSectionEx DeleteCriticalSection WaitForSingleObject GetCurrentProcess GetCurrentProcessId GetExitCodeProcess GetProcessId OpenProcess GetWindowsDirectoryW GetVersionExW CreateJobObjectW OpenJobObjectW AssignProcessToJobObject SetInformationJobObject QueryInformationJobObject GetModuleFileNameW GetModuleHandleW GetProcAddress LocalAlloc LocalFree QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW ExpandEnvironmentStringsW CreateDirectoryW CreateFileW GetDiskFreeSpaceExW GetDriveTypeW GetFileAttributesExW GetVolumePathNameW ReadFile SetFileAttributesW SetFilePointer WriteFile CopyFileW MoveFileExW FileTimeToSystemTime CreateFileMappingW OpenFileMappingW MapViewOfFile FlushViewOfFile UnmapViewOfFile GlobalMemoryStatusEx GetModuleHandleA GlobalMemoryStatus FormatMessageA GetCurrentThread GlobalFree lstrlenW IsWow64Process FreeLibrary LoadLibraryExW SetUnhandledExceptionFilter GetCurrentThreadId RtlCaptureContext IsDebuggerPresent TerminateProcess OpenThread SuspendThread ResumeThread GetThreadContext VirtualQuery InitializeCriticalSection EnterCriticalSection LeaveCriticalSection Thread32First Thread32Next SetEvent CreateEventW CreateThread LoadLibraryW FindClose FindFirstFileW GetFileAttributesW GetTempPathW SetLastError CreateProcessW Module32FirstW Module32NextW GetSystemTime SystemTimeToFileTime WriteConsoleW GetModuleHandleExW InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetStdHandle GetFileType DeleteFiber FormatMessageW QueryPerformanceCounter GetSystemTimeAsFileTime SetStdHandle LoadLibraryA FindNextFileW GetEnvironmentVariableW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW CreateMutexW OpenMutexW Sleep GetFullPathNameW DeleteFileW GetFileSizeEx CreateIoCompletionPort GetQueuedCompletionStatusEx PostQueuedCompletionStatus GetOverlappedResult CancelIoEx SetThreadPriority GetThreadPriority GetProcessAffinityMask SetThreadAffinityMask InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetCurrentDirectoryW RemoveDirectoryW MoveFileW FlushFileBuffers SetEndOfFile SetFilePointerEx GetSystemInfo GetLogicalProcessorInformationEx GetNativeSystemInfo QueryPerformanceFrequency GetTimeZoneInformation ReleaseSRWLockShared AcquireSRWLockShared TryEnterCriticalSection ResetEvent ReleaseSemaphore CreateSemaphoreExW CreateActCtxW ActivateActCtx DeactivateActCtx DuplicateHandle VirtualProtect ReleaseMutex SetEnvironmentVariableW GetComputerNameW OutputDebugStringW SleepEx VerSetConditionMask GetSystemDirectoryW VerifyVersionInfoW GetTickCount WaitForSingleObjectEx GetEnvironmentVariableA SwitchToThread GetExitCodeThread EncodePointer GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW UnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead GetStartupInfoW CreateTimerQueue SignalObjectAndWait GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread VirtualAlloc VirtualFree InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx RtlUnwind GetCommandLineA GetCommandLineW FindFirstFileExW SystemTimeToTzSpecificLocalTime GetFileInformationByHandle PeekNamedPipe GetConsoleOutputCP FreeEnvironmentStringsW

shell32

CommandLineToArgvW SHChangeNotify SHGetKnownFolderPath ShellExecuteExW ShellExecuteW

ole32

CoCreateInstance CoInitializeEx CoSetProxyBlanket CoTaskMemFree CoUninitialize CoInitializeSecurity

ws2_32

inet_ntop WSAIoctl getpeername WSASetLastError __WSAFDIsSet shutdown getsockname connect freeaddrinfo getaddrinfo send recv ioctlsocket inet_pton socket setsockopt listen htons htonl getsockopt closesocket bind accept WSCEnumProtocols WSACleanup WSAStartup ntohs ntohl WSAGetLastError select

user32

ShowWindow TranslateMessage DispatchMessageW PeekMessageW GetForegroundWindow GetShellWindow GetWindowThreadProcessId DefWindowProcW CreateWindowExW GetWindow EnumThreadWindows GetDesktopWindow IsWindowVisible MessageBoxW GetUserObjectInformationW GetProcessWindowStation LoadStringW LoadIconW LoadCursorW UpdateWindow RegisterClassExW

oleaut32

SysAllocString SysFreeString VariantInit VariantClear VariantChangeType SysStringLen SafeArrayGetUBound SafeArrayGetLBound SafeArrayAccessData SafeArrayUnaccessData VariantCopy