General
-
Target
file
-
Size
193KB
-
Sample
231002-g9xm7ahd74
-
MD5
85566c0e8a1a7493e65abc47e1ed2f52
-
SHA1
0fc665eb362732bb0f3749968c60271439e606b4
-
SHA256
4f82ce0fc03fc61ebb8ee507e02d53c4ef047b612d32954d48679ec0e31857eb
-
SHA512
2b3d77f8a035d729e40e9285ea02eaff18b7b6383a05f1c9eba477eec4c988000a49c7a19013d53963b1c802ecd26968ca0e4c90423b342b11dc280803158892
-
SSDEEP
3072:VTeAgFiHFfxX/uC7TU8nS/USEeiHBSIykHrWzcE502+ovV:yilfxBm/dlihRyWqnZV
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20230915-en
Malware Config
Extracted
tofsee
vanaheim.cn
jotunheim.name
Targets
-
-
Target
file
-
Size
193KB
-
MD5
85566c0e8a1a7493e65abc47e1ed2f52
-
SHA1
0fc665eb362732bb0f3749968c60271439e606b4
-
SHA256
4f82ce0fc03fc61ebb8ee507e02d53c4ef047b612d32954d48679ec0e31857eb
-
SHA512
2b3d77f8a035d729e40e9285ea02eaff18b7b6383a05f1c9eba477eec4c988000a49c7a19013d53963b1c802ecd26968ca0e4c90423b342b11dc280803158892
-
SSDEEP
3072:VTeAgFiHFfxX/uC7TU8nS/USEeiHBSIykHrWzcE502+ovV:yilfxBm/dlihRyWqnZV
-
XMRig Miner payload
-
Creates new service(s)
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2