Behavioral task
behavioral1
Sample
4308-3-0x0000000000010000-0x000000000062D000-memory.exe
Resource
win7-20240611-en
General
-
Target
4308-3-0x0000000000010000-0x000000000062D000-memory.dmp
-
Size
6.1MB
-
MD5
c0fa2c2e336828fbe64f1caa2d78ef8d
-
SHA1
d17663fbf96becbde6b12cf7eb7f8d6f03ca64b3
-
SHA256
3da0ae34f1926e27d7be36d8a2961e77b597e0d067e02eec544fdd14ecaae911
-
SHA512
47bccc9360b9e4740cda65ffe8a2b9ff2fc19e2620dcc1e819f69fda5c813ed33b913be4e35b06622c161f558a14d13c561233e4bc2ab95307781443e7266e56
-
SSDEEP
98304:AJNVFXZTnZFqeX4QLS4Wi46BM5ispIhE5za6XQ/OPWWrbq9BAG3X2DIXj3zZqB1g:2JXZDZAeIQLVWit6swMjsS
Malware Config
Signatures
-
Risepro family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4308-3-0x0000000000010000-0x000000000062D000-memory.dmp
Files
-
4308-3-0x0000000000010000-0x000000000062D000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 685KB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
znztfmqz Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
dsylryue Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE