�� ���k�^ˋ�%���<�7�'��8�r�����>��ҝ��09��l��Pg3SUψ�d����� �z�_8�%�E����q�mm�|4��h=��D��U2Kռ�/��꺭�0���8���j~K�����\V:�@cW������Ŏ��h�ܟCP��X��XX�H2j���F_�a>v�w��D��Jr�R �cc��r$�n�*]uG1����Uܳ~;�5��ۡ\�Ԓ�{����hILb�n�T�nMp4����!�^�-�+3L\]\�'��:����a���u���O<_b�������GJ|�3н&���5\�8@�:�9��w1�����ׅ�;8Y�UCw�^�� %������pG�s��qƢh|���n����MĖ�s^���B�,y�i���$b0���d/�UN ���"�Ig[y_t�5ty�S�/YW=rB\� G�M����q?˾^t�Bq��I����_�� =��t����\�Oz��A�Q�9U2z��ppF5���>.���UaPx��_?u1��yV��"���Q�� 8L����}�r��-/���U����y���DfƂ磺+�%�T�iw����[�"!q.�y��?vo+��;Q�� �p(��6w��.���.�F.����f������p��p;���R]w��s�RI�M��.k��Bb������h}\Ő�x:"��ܣ����b���g��q�~a�*���n��s����3c/���,��هĖ1�B�}�7��)�6�m��S�$?H�:��kP��C������{j�z�\=�{�}��MS���1������ZB�ɀs�,�� i���Aj�<a���=�ӌ�L���j�R�W�±7�\*���#pY>��q\WB��n$��s�q���\�J����(o���/��Q�o+��u�?�;��!�j���5�`͞Oʆ}@������"���)�10 k`�J�϶EMc�O��׀p���;E6�l��س�T�}��$�W �Qm�qA�?M��T�eJ�<�@��^�MP�?!�J�%�����+àf�Dv�u��~/�v���*Ҕi��?�� �_ֿ��M��*O�O�y��ʅnaڠ�����}H��,c�X@���B=���$�z�b��}ޯ!�TEm��Ք<�Q�%�^�Y�B��V����T���M�w��G?=�~� ���^��.07�ĭ�f*�3��Y�1t�Nd}�凝�)�u�Kw'\��l���m��+1���b�Pe썴H�����n� ���P])��/����D�.�"����?Ý5]E��'vqpO�u�}��Ғd�lh���2����r����9�r⯍AZ� k)�w L��.�NQ�$+��=zty�A�W#V�M��@�ٿ��+�xP������#K�!�r��B D�~�l崥֧���Z{�:��]�����V��Ѕ��Y�BPiP�oOm߽�i�_i^�9%�� X�'rV���m�i<�M6�;�����%�?8�(Z���uG�OIq��PW��d�fe��`��L/W�Lጫ;��1�\~x6�I����~���~����0�x)�rm�h_:ˬ>��~*�h�3L?"#Ž�K���[D�II�z�%FP�qϱd(M4כS��U���s&t"EI\Έ���$�������Mdz��(���˭L ��8?k�H]8��D��&���DOt�h��O����o��b�ƃ��!�$���d|E`i�z��*��U�D�٭�J7v���նe)��?J"|�h����#���k⢀,I��H�O��u�����#9����:��(�Z���r�H��T*���,y�۩��`�(�X�D�|?�{�;�$�~�u���[� �ė����e��;�^M��1L�{�a ����9�;���}5���^�����3I��玄r���d� iP �C܍v� ���������8¢��I�"P���pA������٨yy/q>�������k��b���D��d��,��H�4��& ^+E�����۶����Uq��H�[��P�����ILTȲ���a2�����C�B��Y[�� �O�-,�z4y� ƾ�U��H���6=jS)�+Ry(3�\v�g�=�SAW�y������gg�%�2�R��v��Gq��9�&���բ/k�����yZP���Ec��v��G�~Oϧ�"�P���|���`&r�I��vn���2�l�M*��[�0�o���f;5[SɻV�Q'j����F'�{���Gs )-����)zp������Km����?ړ<��2��4��(�̀yi$9A��~Vhiw3=C{.��Y�H�mk��+��!D���;;�F�������W�9bܤ�������-�����m� ���鱟��Wڑ�����IT���n���0<��jۃ���=��j����5F�����s>e5���j�b#� ����t���C� >�-a@��%>�M�����9> �N��]A^� �'�.�� ���:w��5�"���,E�Ts��]����]�~.�YB�N��~@Y��� }1l�r�:��z:�����pǸM��Yˢm� �����z*��R��p����}e�`�>��$��ܭ�xfߑ*�T f+'a��]yaK��矂�-�nϻ�iw��� �������|a\?�dsɿ!߹g���w�mA0j���A����H��\���:b.U;��uRO��﨩*Д��ε4����֧c8�c�ۼn� ���0hޑ[#��?J±���v�{$��lJ����g��9��q.j?@�e�{V&�K�B���7��d��D����>m��\�.H�fW���X��I��7vֲZN�}(�=7K�W�/��o�*��"�;���cE{����=���5ɨ;$9�L5< ,���f�LX���=���ǖ�p����&���F�ci��P��x�1Bp�Dkj�SDr�������%g�T8�ek9�<ЍZ��Ả%Y}��������P+�rv,c�� �G]����mƄ���K���g=�ɘ�������.�&��lY�,�
Static task
static1
Behavioral task
behavioral1
Sample
RisePro_Server.exe
Resource
win10-20240404-en
General
-
Target
RisePro_Server.exe
-
Size
57.5MB
-
MD5
1e09287be79ea9e8970b009c60ec71e4
-
SHA1
fa44121e58fd7115842269053c0434d90a0dda2d
-
SHA256
3f1065fe34fb5335fcf26d96565d669af0eb18a8ff0b1dc5ab2f4cd172e27272
-
SHA512
902f0ba30ff8a3c72b32c8693c56dfa0aaa9955b42f65a1181873c710383fd76ca922752ffbcb81be4eebf6926f80f0a8f8dfdb467e77fbe935843f009f00174
-
SSDEEP
1572864:LcMpLABVCAtQbu4P5im/GpXyNqDK2vERS:LrpLaVFtQS4P6pZa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource RisePro_Server.exe
Files
-
RisePro_Server.exe.exe windows:6 windows x86 arch:x86
b42aa69409fff273c6ce70741b4db5cd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapFree
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
crypt32
CryptStringToBinaryA
ws2_32
accept
mswsock
AcceptEx
advapi32
CryptReleaseContext
ole32
CoGetObjectContext
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 552KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 126KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rise0 Size: - Virtual size: 55.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rise1 Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rise2 Size: 56.6MB - Virtual size: 56.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 953KB - Virtual size: 952KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ