Behavioral task
behavioral1
Sample
1376-113-0x0000000000AF0000-0x00000000010D6000-memory.exe
Resource
win7-20240221-en
General
-
Target
1376-113-0x0000000000AF0000-0x00000000010D6000-memory.dmp
-
Size
5.9MB
-
MD5
60fb81f941c1c7141b6eec8ad178f73a
-
SHA1
f2335bd227df6f5bb3fa84cbe9e65e69c021c95a
-
SHA256
c370cdd52b96770f8c55a870c6a19f792f5213ba1c74f9da34b0ba5606862e3f
-
SHA512
66929e2b527713c48850b1dafcad3cdd94fcaeeb2bb4c6c1869a9f1a0f4cb78a51e691ea3ae20a3cb88aef703840f83c16c8e7da776ea97b0010186cc1e53ee8
-
SSDEEP
98304:UTcvKPtXZrzwcr6QLXWl4f16RL8ZE3nB89CGP+c3uZt4+t9x29:4pPtprscmQLXWz3nB89aRZW4x29
Malware Config
Extracted
risepro
77.91.77.66:58709
Signatures
-
Risepro family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1376-113-0x0000000000AF0000-0x00000000010D6000-memory.dmp
Files
-
1376-113-0x0000000000AF0000-0x00000000010D6000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 685KB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
rteaxmih Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
focuuojc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE