General
-
Target
5e77fbec71fd7c8e9f62588ba0e61da560f17031fa9741669ff7b9aedcf8bb56
-
Size
2.6MB
-
Sample
231207-wrt7nsed33
-
MD5
39d35e8c8e4433e17dc3623ce5acccb0
-
SHA1
fd9b0ae54371c5e4919083587eae9b8df739e436
-
SHA256
5e77fbec71fd7c8e9f62588ba0e61da560f17031fa9741669ff7b9aedcf8bb56
-
SHA512
89725f5b33eb05902751f1ebb7b46c5779f3bbcc78d821645c7997e69408555b4d726affbd47c67abab68a8a69db68d458bbe9590de553a64a4f3f8ae93aa48d
-
SSDEEP
49152:r8MkvCAXIIxwFtazLzWHhUUTBh2VlFlbSAiEheG31t+RBv1cI5R7PT7LcT6a7H1:IMkqAXODfLY3iEJlgv1cI5RbTcTTH
Static task
static1
Behavioral task
behavioral1
Sample
5e77fbec71fd7c8e9f62588ba0e61da560f17031fa9741669ff7b9aedcf8bb56.exe
Resource
win10v2004-20231127-en
Malware Config
Extracted
risepro
193.233.132.51
Extracted
smokeloader
2022
http://81.19.131.34/fks/index.php
Targets
-
-
Target
5e77fbec71fd7c8e9f62588ba0e61da560f17031fa9741669ff7b9aedcf8bb56
-
Size
2.6MB
-
MD5
39d35e8c8e4433e17dc3623ce5acccb0
-
SHA1
fd9b0ae54371c5e4919083587eae9b8df739e436
-
SHA256
5e77fbec71fd7c8e9f62588ba0e61da560f17031fa9741669ff7b9aedcf8bb56
-
SHA512
89725f5b33eb05902751f1ebb7b46c5779f3bbcc78d821645c7997e69408555b4d726affbd47c67abab68a8a69db68d458bbe9590de553a64a4f3f8ae93aa48d
-
SSDEEP
49152:r8MkvCAXIIxwFtazLzWHhUUTBh2VlFlbSAiEheG31t+RBv1cI5R7PT7LcT6a7H1:IMkqAXODfLY3iEJlgv1cI5RbTcTTH
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Drops startup file
-
Executes dropped EXE
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1