General
-
Target
df25b5ee37062aa2edc6aabc9bf68411a4f77d580e29d55a41bdd858cf4b9fcf
-
Size
2.6MB
-
Sample
231207-2nbh2sga58
-
MD5
a32032f4e20ffd50219360bcf3ac699b
-
SHA1
700800744e31c0131539aa126d067517cda58a51
-
SHA256
df25b5ee37062aa2edc6aabc9bf68411a4f77d580e29d55a41bdd858cf4b9fcf
-
SHA512
f8068dca6727fcad40c0dae6ad357531309b54fa90760554e66b2901a8f6f26262c037c53c923a423e75ad88afb91871314135a1caf37586452654956486340c
-
SSDEEP
49152:d8IgrB2ptN/PWzB6/7B2n8C4y6rP5+vK4lZewMuP2xTMZLGmm4:MrBuL3hEn/W5+vK4ZfKmm
Static task
static1
Behavioral task
behavioral1
Sample
df25b5ee37062aa2edc6aabc9bf68411a4f77d580e29d55a41bdd858cf4b9fcf.exe
Resource
win10v2004-20231201-en
Malware Config
Extracted
risepro
193.233.132.51
Extracted
smokeloader
2022
http://81.19.131.34/fks/index.php
Targets
-
-
Target
df25b5ee37062aa2edc6aabc9bf68411a4f77d580e29d55a41bdd858cf4b9fcf
-
Size
2.6MB
-
MD5
a32032f4e20ffd50219360bcf3ac699b
-
SHA1
700800744e31c0131539aa126d067517cda58a51
-
SHA256
df25b5ee37062aa2edc6aabc9bf68411a4f77d580e29d55a41bdd858cf4b9fcf
-
SHA512
f8068dca6727fcad40c0dae6ad357531309b54fa90760554e66b2901a8f6f26262c037c53c923a423e75ad88afb91871314135a1caf37586452654956486340c
-
SSDEEP
49152:d8IgrB2ptN/PWzB6/7B2n8C4y6rP5+vK4lZewMuP2xTMZLGmm4:MrBuL3hEn/W5+vK4ZfKmm
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Drops startup file
-
Executes dropped EXE
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1