Behavioral task
behavioral1
Sample
1016-3-0x0000000000A50000-0x000000000103C000-memory.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
1016-3-0x0000000000A50000-0x000000000103C000-memory.exe
Resource
win10v2004-20240508-en
General
-
Target
1016-3-0x0000000000A50000-0x000000000103C000-memory.dmp
-
Size
5.9MB
-
MD5
ea413f9067ff88f794696fe9a3852aed
-
SHA1
338e6dcbe87e8107b3fa67a3639f587a1eafbaec
-
SHA256
44270ef1fcfbbaa14a8bca8f20feb882cad04337ec1b69d9ffcf2ea81f0d008f
-
SHA512
70e7e34212541864698ec39b64f8eb716cc14352791ee75929974cc1f4f1edb0c76b1d752c916044aceb9ac8609b138b0f97e77634037f4bd41c1e316a87dc82
-
SSDEEP
98304:15kK/xlPhLs9ifF4jQLQuBV9NFXOFwdroRu32VXbucY5mTzlnzY8Rx3gF:PDPho9EFCQLQuB6wdyrY5mTzlzbR
Malware Config
Signatures
-
Risepro family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 1016-3-0x0000000000A50000-0x000000000103C000-memory.dmp
Files
-
1016-3-0x0000000000A50000-0x000000000103C000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 685KB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
dhkfppvs Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
fpnofqjy Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE