General
-
Target
bc7c2a8a4a55d3d8091b57b050721465.bin
-
Size
169KB
-
Sample
230514-ccswhscf5y
-
MD5
34e4cb8e7c6a8396ff96c91fc371f126
-
SHA1
77fad6a5e89161faaa4aef91b06540fd29a95d3b
-
SHA256
0660987089035eb85522a9892890babc497859d21dd79b1dad4d8ce566c94bb2
-
SHA512
4d04537a13464d9cfb9330fd8d7a7b60525b62b5f4ad577bb9f0a82655638627422738964046a91742a7202c5d81e5a7ce29c671f551b9d3a1b6f612e2e82cfa
-
SSDEEP
3072:He6zvO+LsqvEYRm3j7PkfNjE/BVuDlrfGGcTdrbBoLiirD7gS1JR9Qot5mT2:1LgqtmzDojEJVIlrf6TdRoJD7gS1v9Qc
Static task
static1
Behavioral task
behavioral1
Sample
664804be369abbc16ab815f94b340fda7c9bfe43372d706c85ead10d609725ba.exe
Resource
win7-20230220-en
Malware Config
Extracted
tofsee
vanaheim.cn
jotunheim.name
Targets
-
-
Target
664804be369abbc16ab815f94b340fda7c9bfe43372d706c85ead10d609725ba.exe
-
Size
321KB
-
MD5
bc7c2a8a4a55d3d8091b57b050721465
-
SHA1
585d80c0eca34a12f2ac79e6e6d1c97c1bf6ab62
-
SHA256
664804be369abbc16ab815f94b340fda7c9bfe43372d706c85ead10d609725ba
-
SHA512
b2dbd260ce0577db7e15f19f44373910678f885745eb54a288788b384a799d0d72dd533f1d7c28da846b12170600dd6cff943b541e9bd8b5c119103c5cf97eb5
-
SSDEEP
3072:4QZggfPJhkK5MZo43bw+2WMWYNRb/a+dK6TZHVuNCLPEqDYCYy5/9Q4kp7t:4APIXoWkWMWYNU+RTzHPEqDYDj
-
XMRig Miner payload
-
Creates new service(s)
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-