risepro | 4876-67-0x00000000003D0000-0x00000000009D7000-memory[.]dmp

Sharing

Copy URL Twitter E-mail

General

Target
4876-67-0x00000000003D0000-0x00000000009D7000-memory.dmp
Size 6.0MB
Sample240621-sd8lcsvdmb
SHA256 48633b6af68bb0a724796860df813aa2444e2dc48d9b4a408e03481a7d7a7b0a
MD5 3ac74d77fabb1981d8cdf2c911e38071
SHA1 43ab4bbed983e9c859d75abecf947d54f41942b8
SHA512 68b37363149b4778ab459801bb614f94f100f5d1c1a1e44cf7174638734abb1739389b8b1ccd1d91304ca0a927c9b546f6930dd285a47c0d22efc891c600a69c
SSDEEP 98304:QZ+pB/RbaFTrWH/QLv+v+f7ZKv98/tCHylh/20x0B0PNWEAz3rX+rU0bBspdOn:ey/ROFnWfQLv+vUDPNWEAz3aNbBspd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

risepro

Malware Config

Extracted

Family

risepro

77.91.77.66:58709

Signatures

Risepro family
risepro

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4876-67-0x00000000003D0000-0x00000000009D7000-memory.dmp

File Explorer

4876-67-0x00000000003D0000-0x00000000009D7000-memory.dmp

.exe 6.0MB

4876-67-0x00000000003D0000-0x00000000009D7000-memory.dmp

SHA256 48633b6af68bb0a724796860df813aa2444e2dc48d9b4a408e03481a7d7a7b0a
MD5 3ac74d77fabb1981d8cdf2c911e38071
SHA1 43ab4bbed983e9c859d75abecf947d54f41942b8
SHA512 68b37363149b4778ab459801bb614f94f100f5d1c1a1e44cf7174638734abb1739389b8b1ccd1d91304ca0a927c9b546f6930dd285a47c0d22efc891c600a69c
SSDEEP 98304:QZ+pB/RbaFTrWH/QLv+v+f7ZKv98/tCHylh/20x0B0PNWEAz3rX+rU0bBspdOn:ey/ROFnWfQLv+vUDPNWEAz3aNbBspd
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6307840

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

685KB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

jpqntyca

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

cymphadb

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.taggant

Size

8KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

4876-67-0x00000000003D0000-0x00000000009D7000-memory.dmp

generic