General
-
Target
7a671c39de13263618835f6bd4398613.exe
-
Size
2.6MB
-
Sample
231209-jwj62shaa9
-
MD5
7a671c39de13263618835f6bd4398613
-
SHA1
d83f3db585934ab53ec5d530e4b3a8fa28bf7cfe
-
SHA256
17888fab3eb99dcd83dde833713325b23e849141ed387353a4be0fe060f3936b
-
SHA512
bf5777eaf175c3cbb2460a93b11d78ddfe0c1bc9de725e7e2c5ab688bad9eae8bd350720c37f75fd276a77bf2b8cdf8996b2d60ac3848702d5f3d9468cda6375
-
SSDEEP
49152:k2aVvzWo8vhJDxy6cFiupcyXjzk1qYdRXBHf1y4N1DK:rAzWdpJDxOiuuyzolnXB/jN1
Static task
static1
Behavioral task
behavioral1
Sample
7a671c39de13263618835f6bd4398613.exe
Resource
win7-20231130-en
Behavioral task
behavioral2
Sample
7a671c39de13263618835f6bd4398613.exe
Resource
win10v2004-20231201-en
Malware Config
Extracted
risepro
193.233.132.51
Extracted
smokeloader
2022
http://81.19.131.34/fks/index.php
Targets
-
-
Target
7a671c39de13263618835f6bd4398613.exe
-
Size
2.6MB
-
MD5
7a671c39de13263618835f6bd4398613
-
SHA1
d83f3db585934ab53ec5d530e4b3a8fa28bf7cfe
-
SHA256
17888fab3eb99dcd83dde833713325b23e849141ed387353a4be0fe060f3936b
-
SHA512
bf5777eaf175c3cbb2460a93b11d78ddfe0c1bc9de725e7e2c5ab688bad9eae8bd350720c37f75fd276a77bf2b8cdf8996b2d60ac3848702d5f3d9468cda6375
-
SSDEEP
49152:k2aVvzWo8vhJDxy6cFiupcyXjzk1qYdRXBHf1y4N1DK:rAzWdpJDxOiuuyzolnXB/jN1
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1