risepro | 6c36e5d456335dd880fd2e168289af1a4af14d44df540ab55a3083eaa8dbf786

Analysis

max time kernel
56s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/02/2024, 15:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dik.rar
Size 14.0MB
Sample240229-szpelsdc2w
SHA256 6c36e5d456335dd880fd2e168289af1a4af14d44df540ab55a3083eaa8dbf786
MD5 1745beb096fa778edaa4af460963f6f1
SHA1 be8ce59abd516c8e20c9b7f48bbf6bf37ae9bd92
SHA512 d26857952e6bba78b80df44e1e3836e0031de8b7daa6ffe1327db85a1a8f50ace7ae8273811b825c6885e8a349d2391e0e8c0153b3b0688064f48aefbe73c681
SSDEEP 393216:SIerHUFihoO/zvu76vng32jewXDTdgBqyReTDeAZQ:Snr0QoKzvLvnlmBhe3hQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

risepro smokeloader tofsee pub3 backdoor evasion persistence stealer trojan

Malware Config

Extracted

Family

tofsee

vanaheim.cn
jotunheim.name

Extracted

Family

smokeloader

Version

2022

http://selebration17io.io/index.php
http://vacantion18ffeu.cc/index.php
http://valarioulinity1.net/index.php
http://buriatiarutuhuob.net/index.php
http://cassiosssionunu.me/index.php
http://sulugilioiu19.net/index.php
http://goodfooggooftool.net/index.php

rc4.i32

Extracted

Family

risepro

193.233.132.62

Extracted

Family

smokeloader

Botnet

pub3

Signatures

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2344	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
2004	setup.exe

Loads dropped DLL 1 IoCs

pid	Process
2588	7zFM.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
139	iplogger.org
140	iplogger.org

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	api.myip.com
8	ipinfo.io
9	ipinfo.io
3	api.myip.com

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	setup.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	setup.exe
File opened for modification	C:\Windows\System32\GroupPolicy	setup.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	setup.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2264	sc.exe
3048	sc.exe
968	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2132	schtasks.exe
2748	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2004	setup.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2588	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2588	7zFM.exe
Token: 35	2588	7zFM.exe
Token: SeSecurityPrivilege	2588	7zFM.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2588	7zFM.exe
2588	7zFM.exe
2588	7zFM.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2588	2320	cmd.exe	29
PID 2320 wrote to memory of 2588	2320	cmd.exe	29
PID 2320 wrote to memory of 2588	2320	cmd.exe	29
PID 2588 wrote to memory of 2004	2588	7zFM.exe	32
PID 2588 wrote to memory of 2004	2588	7zFM.exe	32
PID 2588 wrote to memory of 2004	2588	7zFM.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\dik.rar
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\dik.rar"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Users\Admin\AppData\Local\Temp\7zOC1A18607\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\7zOC1A18607\setup.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    PID:2004
  - - C:\Users\Admin\Documents\GuardFox\wWk4x8wNYe_aFg2vJ4NCG8_l.exe
      "C:\Users\Admin\Documents\GuardFox\wWk4x8wNYe_aFg2vJ4NCG8_l.exe"
      4⤵
      PID:2392
  - - C:\Users\Admin\Documents\GuardFox\JcMCiFZT17kta4QSeM45rliY.exe
      "C:\Users\Admin\Documents\GuardFox\JcMCiFZT17kta4QSeM45rliY.exe"
      4⤵
      PID:2780
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\cifjhuqt\
        5⤵
        
        PID:3016
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\sbhsqfx.exe" C:\Windows\SysWOW64\cifjhuqt\
        5⤵
        
        PID:2156
    - - C:\Windows\SysWOW64\sc.exe
        
        "C:\Windows\System32\sc.exe" create cifjhuqt binPath= "C:\Windows\SysWOW64\cifjhuqt\sbhsqfx.exe /d\"C:\Users\Admin\Documents\GuardFox\JcMCiFZT17kta4QSeM45rliY.exe\"" type= own start= auto DisplayName= "wifi support"
        5⤵
        Launches sc.exe
        
        PID:2264
    - - C:\Windows\SysWOW64\sc.exe
        
        "C:\Windows\System32\sc.exe" description cifjhuqt "wifi internet conection"
        5⤵
        Launches sc.exe
        
        PID:3048
    - - C:\Windows\SysWOW64\sc.exe
        
        "C:\Windows\System32\sc.exe" start cifjhuqt
        5⤵
        Launches sc.exe
        
        PID:968
    - - C:\Windows\SysWOW64\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
        5⤵
        Modifies Windows Firewall
        
        PID:2344
  - - C:\Users\Admin\Documents\GuardFox\HTutfvKVd7rcVfj1gIBbBsSm.exe
      "C:\Users\Admin\Documents\GuardFox\HTutfvKVd7rcVfj1gIBbBsSm.exe"
      4⤵
      PID:2440
  - - C:\Users\Admin\Documents\GuardFox\9aNFsnehEQpNWnr9Iz6FWBer.exe
      "C:\Users\Admin\Documents\GuardFox\9aNFsnehEQpNWnr9Iz6FWBer.exe"
      4⤵
      PID:1636
  - - C:\Users\Admin\Documents\GuardFox\fSULV3Qqb49jcdQ5IZO_QICo.exe
      "C:\Users\Admin\Documents\GuardFox\fSULV3Qqb49jcdQ5IZO_QICo.exe"
      4⤵
      PID:3060
  - - C:\Users\Admin\Documents\GuardFox\EKJDc7JWeQlY61wHdwy1Kmg5.exe
      "C:\Users\Admin\Documents\GuardFox\EKJDc7JWeQlY61wHdwy1Kmg5.exe"
      4⤵
      PID:1248
  - - C:\Users\Admin\Documents\GuardFox\MqzIzq7exrVoeeDzSl1EZzVR.exe
      "C:\Users\Admin\Documents\GuardFox\MqzIzq7exrVoeeDzSl1EZzVR.exe"
      4⤵
      PID:1940
  - - C:\Users\Admin\Documents\GuardFox\na8ken00y5_RMekqalz8PEDd.exe
      "C:\Users\Admin\Documents\GuardFox\na8ken00y5_RMekqalz8PEDd.exe"
      4⤵
      PID:2572
  - - C:\Users\Admin\Documents\GuardFox\3ql1XCuag3Hoxm8VstghNU2R.exe
      "C:\Users\Admin\Documents\GuardFox\3ql1XCuag3Hoxm8VstghNU2R.exe"
      4⤵
      PID:2768
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
        5⤵
        Creates scheduled task(s)
        
        PID:2132
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
        5⤵
        Creates scheduled task(s)
        
        PID:2748
  - - C:\Users\Admin\Documents\GuardFox\P5lFrPW7arB7aHX_sKHa86vi.exe
      "C:\Users\Admin\Documents\GuardFox\P5lFrPW7arB7aHX_sKHa86vi.exe"
      4⤵
      PID:1564
    - - C:\Users\Admin\AppData\Local\Temp\7zSC2D2.tmp\Install.exe
        
        .\Install.exe
        5⤵
        
        PID:2644
      - C:\Users\Admin\AppData\Local\Temp\7zS3987.tmp\Install.exe
        
        .\Install.exe /GrJdidW "525403" /S
        6⤵
        
        PID:2400
  - - C:\Users\Admin\Documents\GuardFox\lrH1cxKPedhrXi8gZXSHUPPX.exe
      "C:\Users\Admin\Documents\GuardFox\lrH1cxKPedhrXi8gZXSHUPPX.exe"
      4⤵
      PID:1884
  - - C:\Users\Admin\Documents\GuardFox\0HIOZ_EM3NzUkLWMyklJ0UIB.exe
      "C:\Users\Admin\Documents\GuardFox\0HIOZ_EM3NzUkLWMyklJ0UIB.exe"
      4⤵
      PID:1576
  - - C:\Users\Admin\Documents\GuardFox\hs09WdVwIwtdTMQYiOPqQ8EH.exe
      "C:\Users\Admin\Documents\GuardFox\hs09WdVwIwtdTMQYiOPqQ8EH.exe"
      4⤵
      PID:820

C:\Users\Admin\AppData\Local\Temp\is-HRNCD.tmp\na8ken00y5_RMekqalz8PEDd.tmp
"C:\Users\Admin\AppData\Local\Temp\is-HRNCD.tmp\na8ken00y5_RMekqalz8PEDd.tmp" /SL5="$90152,2131949,56832,C:\Users\Admin\Documents\GuardFox\na8ken00y5_RMekqalz8PEDd.exe"
1⤵
PID:2088

C:\Users\Admin\AppData\Local\Temp\is-L5D5S.tmp\MqzIzq7exrVoeeDzSl1EZzVR.tmp
"C:\Users\Admin\AppData\Local\Temp\is-L5D5S.tmp\MqzIzq7exrVoeeDzSl1EZzVR.tmp" /SL5="$701D8,17223878,792064,C:\Users\Admin\Documents\GuardFox\MqzIzq7exrVoeeDzSl1EZzVR.exe"
1⤵
PID:2632

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:2500

C:\Windows\SysWOW64\cifjhuqt\sbhsqfx.exe
C:\Windows\SysWOW64\cifjhuqt\sbhsqfx.exe /d"C:\Users\Admin\Documents\GuardFox\JcMCiFZT17kta4QSeM45rliY.exe"
1⤵
PID:1528
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:1820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact