Behavioral task
behavioral1
Sample
2372-3-0x00000000001A0000-0x000000000079A000-memory.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2372-3-0x00000000001A0000-0x000000000079A000-memory.exe
Resource
win10v2004-20240508-en
General
-
Target
2372-3-0x00000000001A0000-0x000000000079A000-memory.dmp
-
Size
6.0MB
-
MD5
016d3891c2ff7e3dd52e4bf1c5ed3a1d
-
SHA1
d5bf787dab7558069e8573e0c26d9739818732b0
-
SHA256
e7b035a81960a0be800e27033170674fae967b820ee27f2935f27fdcc94b766d
-
SHA512
4213cf7d8e61e44467e7c55a53dc4cf234b8cfd285352a88333e5cd5f0640b63b6cd00fe64e66bb69caed5b040d61fec9a1f37b247fd65b271dfc111d63382b1
-
SSDEEP
98304:SdGm6RrH5y8eOZMQLXmnVqOcDuz/0YGW2ACV3Z92Yj6LIvY54:g+RrZyvOiQLXmlz/t2lL0YiX
Malware Config
Signatures
-
Risepro family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2372-3-0x00000000001A0000-0x000000000079A000-memory.dmp
Files
-
2372-3-0x00000000001A0000-0x000000000079A000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 685KB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
yrfjduxv Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
tamzyrqw Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE