Behavioral task
behavioral1
Sample
3444-3-0x0000000000DD0000-0x00000000013C0000-memory.exe
Resource
win7-20240708-en
General
-
Target
3444-3-0x0000000000DD0000-0x00000000013C0000-memory.dmp
-
Size
5.9MB
-
MD5
37eba17ed7203a081b3c77b7252c3e1e
-
SHA1
58c2e5250cc65c2ada051d72e4a1e84994aa02e8
-
SHA256
610ab704da52b402560a47f549062d23b90e6abf10ac5f6f9e7eed1a365f8bb7
-
SHA512
08b4b149315eb2f6cddb8efeb9c8e989796fcc6840fa9eea203c6bc9ffc304dac94fe44120dee0767158a75a91760ca0e7f279c5c3a78e751f6f14a328b4eb4d
-
SSDEEP
98304:00DJR/RbdlmCXqIQLp+AyjN4V5XHaPOGABWd0QRX0jrKJOeQl0Hlg+V7FWSe1B6v:7//Rpl1XrQLp+LuA1tzwX0g+L+Bm
Malware Config
Extracted
risepro
147.45.47.126:58709
Signatures
-
Risepro family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 3444-3-0x0000000000DD0000-0x00000000013C0000-memory.dmp
Files
-
3444-3-0x0000000000DD0000-0x00000000013C0000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 685KB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
mxeojzwh Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
qbrinonr Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE