General
-
Target
50112cddd8679a13b2394b500d1cd8c78392c734af232e4aaf8dce2b5ecfadad
-
Size
145KB
-
Sample
240417-p8metsgc76
-
MD5
b8b2247e0fa73b1cb6fb21fda07c0207
-
SHA1
6797fe674a93acbf7b6b438b528d5d54560c6442
-
SHA256
50112cddd8679a13b2394b500d1cd8c78392c734af232e4aaf8dce2b5ecfadad
-
SHA512
9f4dc4f86fb9ea184aacf2b526f66ac811f9de3f8dbb446a64a06b3b8803ab34ec1a946e9a76f5f6e472f86be89b6f38728ac40af315c7b9b0dd838a88ae53b3
-
SSDEEP
3072:fjvgJZhm7RUclRU0hWyttrCEBbGHDMG8r1BybOZptNFML7Cvr1i:fEDSUclVWytxVADqnq6t3SmT1i
Static task
static1
Behavioral task
behavioral1
Sample
f379c2c732470dbce8e17423baf7f6fcca63bcb13c4ade33a15df1225e3841be.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f379c2c732470dbce8e17423baf7f6fcca63bcb13c4ade33a15df1225e3841be.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
tofsee
vanaheim.cn
jotunheim.name
Targets
-
-
Target
f379c2c732470dbce8e17423baf7f6fcca63bcb13c4ade33a15df1225e3841be.exe
-
Size
232KB
-
MD5
b5f3dc95c09fa3bfdf009a404736f94e
-
SHA1
03e471e7edf9bbcbe2483ebd1ba05364c93a190a
-
SHA256
f379c2c732470dbce8e17423baf7f6fcca63bcb13c4ade33a15df1225e3841be
-
SHA512
f63cba660384d5296e2f8aeeceba1a2d4707311a242cd5f12220008670cb5c2bf686b546fafe03cc6c5363bd62fe4c067a1f9dc73a8388488e13854b631ee546
-
SSDEEP
6144:j6zxC0r84BWnfZUH7SFcQU+9HFsvKMXOCU:kY0r9BeZUbSiy9HSvKwO
Score10/10-
Creates new service(s)
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1