General
-
Target
file.exe
-
Size
299KB
-
Sample
230206-1bwg1sfh84
-
MD5
8715223621d5976639b97a5ddc2e5709
-
SHA1
ae98afdb97ae8ebb0fd47f899c94c6401a7f3a0d
-
SHA256
d34c1b52c165505b7cd0130deead88ef3493c1dd118689d9300b6f8d3e496ee9
-
SHA512
22e11a71707019233d98bb4c518decccf117059339c139ad7820aff31cbb690958ff434d53f9555e43b5714cdc1150ce01a92785df382cb9a307e7b82e7269f9
-
SSDEEP
6144:C0UmLTex+0dLoQ7ioyeUB1XOuQj9i7xah:CzmvI+0dL1a/Oljw7x
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20221111-en
Malware Config
Extracted
tofsee
svartalfheim.top
jotunheim.name
Targets
-
-
Target
file.exe
-
Size
299KB
-
MD5
8715223621d5976639b97a5ddc2e5709
-
SHA1
ae98afdb97ae8ebb0fd47f899c94c6401a7f3a0d
-
SHA256
d34c1b52c165505b7cd0130deead88ef3493c1dd118689d9300b6f8d3e496ee9
-
SHA512
22e11a71707019233d98bb4c518decccf117059339c139ad7820aff31cbb690958ff434d53f9555e43b5714cdc1150ce01a92785df382cb9a307e7b82e7269f9
-
SSDEEP
6144:C0UmLTex+0dLoQ7ioyeUB1XOuQj9i7xah:CzmvI+0dL1a/Oljw7x
-
XMRig Miner payload
-
Creates new service(s)
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-