Behavioral task
behavioral1
Sample
3260-3-0x0000000000760000-0x0000000000D65000-memory.exe
Resource
win7-20240508-en
General
-
Target
3260-3-0x0000000000760000-0x0000000000D65000-memory.dmp
-
Size
6.0MB
-
MD5
88d156b4ddda3ff4a9141c25872df0e2
-
SHA1
6508d125568937f9f66855586146bd5f3d4464a7
-
SHA256
3a0efe166d837bd6f3923e9b5f2f2f1bae8bbdf6bb49642fe7f9a7881d044f0e
-
SHA512
1ea64fcdc19b193f43c40adb14448f91da3721dfbf1094a933e9ff7896d3a09976ef01ee8548d1c5777b26e9062f51a1e841c80aea32a83b9b641f7734bf7bfb
-
SSDEEP
98304:W3iaMpDnZeCAkQ/QLkmvLs/F+TyuoligRtUNDrDBU60u76OOZnXJn:OwpDZe/kGQLkmDB2mhll7UZn5n
Malware Config
Signatures
-
Risepro family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3260-3-0x0000000000760000-0x0000000000D65000-memory.dmp
Files
-
3260-3-0x0000000000760000-0x0000000000D65000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 685KB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
yeacmuck Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
kigegngc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE