General
-
Target
e9da6f7d09227a19403a349a2252d2ed.exe
-
Size
293KB
-
Sample
220721-ya8d3shfh4
-
MD5
e9da6f7d09227a19403a349a2252d2ed
-
SHA1
fa94b24fc9a1357c3cf3c1c0ebac3ff1e6da8e81
-
SHA256
e64afadba25eededfb3259f10671cf5551e53341e13702489a7c334fcf6514b0
-
SHA512
501583258564f6f5ee722d6503503a4f56ec46ebd571e8ae8d671fb11462e0c02ff6c3bfd85e6ff709dc0f6d7d1c6d0aa89165c187d8e889efc2a41d2df92a27
Static task
static1
Behavioral task
behavioral1
Sample
e9da6f7d09227a19403a349a2252d2ed.exe
Resource
win7-20220718-en
Malware Config
Extracted
tofsee
svartalfheim.top
jotunheim.name
Targets
-
-
Target
e9da6f7d09227a19403a349a2252d2ed.exe
-
Size
293KB
-
MD5
e9da6f7d09227a19403a349a2252d2ed
-
SHA1
fa94b24fc9a1357c3cf3c1c0ebac3ff1e6da8e81
-
SHA256
e64afadba25eededfb3259f10671cf5551e53341e13702489a7c334fcf6514b0
-
SHA512
501583258564f6f5ee722d6503503a4f56ec46ebd571e8ae8d671fb11462e0c02ff6c3bfd85e6ff709dc0f6d7d1c6d0aa89165c187d8e889efc2a41d2df92a27
-
XMRig Miner payload
-
Creates new service(s)
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-