General
-
Target
74f0a558023ce9f1abd783e5607a855e
-
Size
12.9MB
-
Sample
240125-tm7absadc7
-
MD5
74f0a558023ce9f1abd783e5607a855e
-
SHA1
4a7bf8f987afa17c687723e2e644202ee5dc8733
-
SHA256
9590e3335bec08bbe68bd9a93fa6c15afb09fa74ea88921e4065fa45515b7b43
-
SHA512
235a016a678077987941cab392cfd1ec0cac76c7eae5ce20d4eff7d1b197901b306a9cc112624bacd94ffffcf87333018e02eb132d0a45a77c3c1dfa200254c2
-
SSDEEP
49152:bckGb2222222222222222222222222222222222222222222222222222222222H:bck
Static task
static1
Behavioral task
behavioral1
Sample
74f0a558023ce9f1abd783e5607a855e.exe
Resource
win7-20231215-en
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Targets
-
-
Target
74f0a558023ce9f1abd783e5607a855e
-
Size
12.9MB
-
MD5
74f0a558023ce9f1abd783e5607a855e
-
SHA1
4a7bf8f987afa17c687723e2e644202ee5dc8733
-
SHA256
9590e3335bec08bbe68bd9a93fa6c15afb09fa74ea88921e4065fa45515b7b43
-
SHA512
235a016a678077987941cab392cfd1ec0cac76c7eae5ce20d4eff7d1b197901b306a9cc112624bacd94ffffcf87333018e02eb132d0a45a77c3c1dfa200254c2
-
SSDEEP
49152:bckGb2222222222222222222222222222222222222222222222222222222222H:bck
-
Creates new service(s)
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2