Behavioral task
behavioral1
Sample
328-158-0x0000000000400000-0x0000000000460000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
328-158-0x0000000000400000-0x0000000000460000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
328-158-0x0000000000400000-0x0000000000460000-memory.dmp
-
Size
384KB
-
MD5
9d5949772b8726a45a1c41bb085f833d
-
SHA1
9a0ed6cfd4e07d6d61b158ead0b16488669b2d47
-
SHA256
e1e725cea0023d1dcf72dbc9527501ee72831daa7aebb1565cf56455b8b60393
-
SHA512
3181c6c2da68aa3edcb5c727552e9b60817c5c5d25431a7c637f25a83b64e1185cb14a52169c4072c5d491debf5fc721baa2d5c8019f9a8bab161ed4199371b5
-
SSDEEP
6144:6PVCneO+XFwpIvbde5WgTlE/ia+aDO+jlVklPH:u8p6FwpBEh5D5lU
Malware Config
Extracted
tofsee
svartalfheim.top
jotunheim.name
Signatures
-
Tofsee family
Files
-
328-158-0x0000000000400000-0x0000000000460000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 57KB - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ