General
-
Target
3289502006a84fdf3228454fcfdb37cc8b070a85a9f1ddcea523f1f0627045df.exe
-
Size
184KB
-
Sample
221202-3h4s3sed39
-
MD5
198adec9193e9d8439446c2e7162f587
-
SHA1
c1dbffe0751a4b1aad8bb14b116cbbac5a94dce2
-
SHA256
3289502006a84fdf3228454fcfdb37cc8b070a85a9f1ddcea523f1f0627045df
-
SHA512
de0bf5aec25e3daf785751290ccda4a4da84f8685863e5ccd7147f5e4ab6ee4cf7f8482cb688f33802fbe6d788303c0edec4d8a5c62a218228e54ef2ab3e95b8
-
SSDEEP
3072:r0My61L0m+/AcOMn5tN4NOg1dY9RiD1b/P21XGKRw+6HOqw3:IMCm+/AchWd1GRiDtn21XG+Mu
Static task
static1
Behavioral task
behavioral1
Sample
3289502006a84fdf3228454fcfdb37cc8b070a85a9f1ddcea523f1f0627045df.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3289502006a84fdf3228454fcfdb37cc8b070a85a9f1ddcea523f1f0627045df.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
tofsee
svartalfheim.top
jotunheim.name
Targets
-
-
Target
3289502006a84fdf3228454fcfdb37cc8b070a85a9f1ddcea523f1f0627045df.exe
-
Size
184KB
-
MD5
198adec9193e9d8439446c2e7162f587
-
SHA1
c1dbffe0751a4b1aad8bb14b116cbbac5a94dce2
-
SHA256
3289502006a84fdf3228454fcfdb37cc8b070a85a9f1ddcea523f1f0627045df
-
SHA512
de0bf5aec25e3daf785751290ccda4a4da84f8685863e5ccd7147f5e4ab6ee4cf7f8482cb688f33802fbe6d788303c0edec4d8a5c62a218228e54ef2ab3e95b8
-
SSDEEP
3072:r0My61L0m+/AcOMn5tN4NOg1dY9RiD1b/P21XGKRw+6HOqw3:IMCm+/AchWd1GRiDtn21XG+Mu
-
XMRig Miner payload
-
Creates new service(s)
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-