General
-
Target
b44b9f4497332c165effe7e5aebbe4d9.exe
-
Size
197KB
-
Sample
220925-crwwqaebem
-
MD5
b44b9f4497332c165effe7e5aebbe4d9
-
SHA1
2691cd88c4ae2c351cd292a551da798f6023440e
-
SHA256
6f5f412f4100c88ca174a6c35bb1c0e91b366782ac87ecd4751d95329941e818
-
SHA512
cf9cd66677ba92618a646a959efb4603d5c2ff2aa808b848be6215e976aa7e4686723963970c87a4d021c9b82fe675d201837cf54d99750f88e29cf7f8643cbf
-
SSDEEP
3072:Wiz4MyLvL4klKN51fIR6BtbV9AZEbyeWyfElB1X/PkkXx:kLvblSh7oqbrEN
Static task
static1
Behavioral task
behavioral1
Sample
b44b9f4497332c165effe7e5aebbe4d9.exe
Resource
win7-20220812-en
Malware Config
Extracted
tofsee
svartalfheim.top
jotunheim.name
Targets
-
-
Target
b44b9f4497332c165effe7e5aebbe4d9.exe
-
Size
197KB
-
MD5
b44b9f4497332c165effe7e5aebbe4d9
-
SHA1
2691cd88c4ae2c351cd292a551da798f6023440e
-
SHA256
6f5f412f4100c88ca174a6c35bb1c0e91b366782ac87ecd4751d95329941e818
-
SHA512
cf9cd66677ba92618a646a959efb4603d5c2ff2aa808b848be6215e976aa7e4686723963970c87a4d021c9b82fe675d201837cf54d99750f88e29cf7f8643cbf
-
SSDEEP
3072:Wiz4MyLvL4klKN51fIR6BtbV9AZEbyeWyfElB1X/PkkXx:kLvblSh7oqbrEN
-
XMRig Miner payload
-
Creates new service(s)
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-