General
-
Target
437037db7a33fb435588e924ad6cab7dc39d7d5da16def6bd06293e7d1b1bb62
-
Size
167KB
-
Sample
240417-p8r1bagc84
-
MD5
c5b85705b78773deeaac72dbbe413b3b
-
SHA1
0071f6bebe2e919c95e7d0373e6f387a3d8e4c6b
-
SHA256
437037db7a33fb435588e924ad6cab7dc39d7d5da16def6bd06293e7d1b1bb62
-
SHA512
128d1ae10661b239d83459d86c60a3d7d63766bfa111076995d1ce6645ff612e620c228d97b1a6c80a2ffdacdc99774bc46c8823437947f3859bbe45c72eda38
-
SSDEEP
3072:YRATOaGXDAnufgDJmuoK2StUpNKOYE7YKfDwPvWAVlKfs+GEpVlAMVa:YaTOnfgDJmuttqBYf6DevTVSs+hGJ
Static task
static1
Behavioral task
behavioral1
Sample
b09798c07fc468fb557b044326305a10d5b4a7b19c0d6adb88f794990c3634b9.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
b09798c07fc468fb557b044326305a10d5b4a7b19c0d6adb88f794990c3634b9.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
tofsee
vanaheim.cn
jotunheim.name
Targets
-
-
Target
b09798c07fc468fb557b044326305a10d5b4a7b19c0d6adb88f794990c3634b9.exe
-
Size
281KB
-
MD5
45c66a2034297abfc6b5543dfbac04f2
-
SHA1
21aea98d43c6d0aa86b8ee1777cc51cfae5a634f
-
SHA256
b09798c07fc468fb557b044326305a10d5b4a7b19c0d6adb88f794990c3634b9
-
SHA512
a341910130e4a040f02405c553556851cddf6ac2396f7e0d38aa0c7a97894aa9dece5cb9a7ce323bb50f221cfbc27d29641a4ccdc4843af09f9f54a14e6c19ce
-
SSDEEP
3072:auyDaJPZdL7cHeyf3XJ+rs+MlhxMMKe4uquK9RbPf65xfzW5ffXq3B1k48cV1JD2:auyWJDLwHzf8412Mebd36/fkfAB1pJd
Score10/10-
Creates new service(s)
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Deletes itself
-
Executes dropped EXE
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1