Behavioral task
behavioral1
Sample
1700-35-0x0000000000370000-0x0000000001405000-memory.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
1700-35-0x0000000000370000-0x0000000001405000-memory.exe
Resource
win10v2004-20240802-en
General
-
Target
1700-35-0x0000000000370000-0x0000000001405000-memory.dmp
-
Size
16.6MB
-
MD5
0da4e278f329c206e70b887ba0c6aeaa
-
SHA1
07078e387cc7dfb2f1be5360dc31671663d2e9bb
-
SHA256
049a9bd81aeca060cfe167059fdaa5d43e5a2429da76769c433f1d060c9d02ea
-
SHA512
cfdab31ff08b8f6ef2fa6cb6c4fba1e93c2ecb391ad7650d5ea7a138589094aeb62a3e849d35c274c1fa41772308db60232cbfd1a7082b33b609d45c6105e0e0
-
SSDEEP
393216:u0RosukFd50Ls8jjOuGe01zFtHArw3URm:CgAsQAH1zFtCw
Malware Config
Extracted
risepro
5.42.96.55:50500
Signatures
-
Risepro family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1700-35-0x0000000000370000-0x0000000001405000-memory.dmp
Files
-
1700-35-0x0000000000370000-0x0000000001405000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 159KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmpk¨� Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmpk¨� Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmpk¨� Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmpn† Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmpn† Size: 8.7MB - Virtual size: 8.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 212KB - Virtual size: 211KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ