General
-
Target
e174d233d68a245e73a98eefd91475ffbc09b779708480e58158e28f2e0465c6
-
Size
2.7MB
-
Sample
231209-l6z2cshdd5
-
MD5
91d92587a0e2294fcb472f6f506759b5
-
SHA1
b61980e17481060ff98eff834d24ed6b47016d0b
-
SHA256
e174d233d68a245e73a98eefd91475ffbc09b779708480e58158e28f2e0465c6
-
SHA512
0c5a5777384c87e72f512d8c4a29ccb064551cbb7062066784d37cdbd51b42ec5432f389084d999d98b2dfe76512564b8b83a1616bea3945bedc72cbf4e01ee3
-
SSDEEP
49152:zdkOnsGjJv3xlmnqB+w6zsGkhBImnegsZUpB0mhGVPLCUN6EmYmyuiTCohvDuJ:BkOn9Fynhw6zypnEG0RViY5KWA
Static task
static1
Behavioral task
behavioral1
Sample
e174d233d68a245e73a98eefd91475ffbc09b779708480e58158e28f2e0465c6.exe
Resource
win10v2004-20231130-en
Malware Config
Extracted
risepro
193.233.132.51
Extracted
smokeloader
2022
http://81.19.131.34/fks/index.php
Targets
-
-
Target
e174d233d68a245e73a98eefd91475ffbc09b779708480e58158e28f2e0465c6
-
Size
2.7MB
-
MD5
91d92587a0e2294fcb472f6f506759b5
-
SHA1
b61980e17481060ff98eff834d24ed6b47016d0b
-
SHA256
e174d233d68a245e73a98eefd91475ffbc09b779708480e58158e28f2e0465c6
-
SHA512
0c5a5777384c87e72f512d8c4a29ccb064551cbb7062066784d37cdbd51b42ec5432f389084d999d98b2dfe76512564b8b83a1616bea3945bedc72cbf4e01ee3
-
SSDEEP
49152:zdkOnsGjJv3xlmnqB+w6zsGkhBImnegsZUpB0mhGVPLCUN6EmYmyuiTCohvDuJ:BkOn9Fynhw6zypnEG0RViY5KWA
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Drops startup file
-
Executes dropped EXE
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1