Behavioral task
behavioral1
Sample
3148-3-0x0000000000960000-0x0000000000F4F000-memory.exe
Resource
win7-20231129-en
General
-
Target
3148-3-0x0000000000960000-0x0000000000F4F000-memory.dmp
-
Size
5.9MB
-
MD5
8c3dc8cd7ecc58a196b09a95578930c7
-
SHA1
8deb0df64dd0e46b3f27bfa07814379f7dc57084
-
SHA256
0da435e88077390d49b858492bca9950ff5aa881e449e67e78a06c25d535de6a
-
SHA512
64d919fefbd2c4670253a1c43d59e96dac83db5666fa0e3db6e71103ddc82f2206153d39e3d3d92ce8b79cee90366c7485844c8a9d59933396c1ef58214f6c75
-
SSDEEP
98304:9UTM6LpDnm+/TS1aKQLLmUc8jok4KYN2iBdnYbV9lKBe2if58YfnHnM+9xBnc1eS:uFpDm+LSUKQLLmUsLYx9we268YfHnM+g
Malware Config
Signatures
-
Risepro family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3148-3-0x0000000000960000-0x0000000000F4F000-memory.dmp
Files
-
3148-3-0x0000000000960000-0x0000000000F4F000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 685KB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
xbiuhlno Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
cffaedeq Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE