General
-
Target
5083b1192a324408f6d051f056f67dccc84fed4142482ad2c3d5c98ae3b2f3b0
-
Size
127KB
-
Sample
240417-qkwt2aaf5s
-
MD5
8023b15dbe62f42f022bdbc6688b947f
-
SHA1
1c3f70eb39700700a78bb0ccbeee2d22d986f3a6
-
SHA256
5083b1192a324408f6d051f056f67dccc84fed4142482ad2c3d5c98ae3b2f3b0
-
SHA512
a6ca2d20b42d8ffa0883883661ca65c204490491e5bf77bf12afdeef340fe8eb8219b1e29ba8571147486b334b878b4de9f9a40b5e1fe6a891d7ea06eebe49d6
-
SSDEEP
3072:btXeK60UIAMe5dfFEa0Wux7CNvhOycoZRe:ZAcer0WuCNpOycoZRe
Static task
static1
Behavioral task
behavioral1
Sample
3555ecd8bb270312994e03bf64695a3f1c0213a2abf85b890ebe2bb40a9648a3.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3555ecd8bb270312994e03bf64695a3f1c0213a2abf85b890ebe2bb40a9648a3.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
tofsee
vanaheim.cn
jotunheim.name
Targets
-
-
Target
3555ecd8bb270312994e03bf64695a3f1c0213a2abf85b890ebe2bb40a9648a3.exe
-
Size
203KB
-
MD5
e80ed6ccb333b7fc33ffc98bca43b57d
-
SHA1
170281a608fe94eee06a9f45466f6a47bd2272e3
-
SHA256
3555ecd8bb270312994e03bf64695a3f1c0213a2abf85b890ebe2bb40a9648a3
-
SHA512
3209c004cebb1e2f544f7d8457175a62da8a225bc08bcbb051c240eddc610ca8e1ddfe7f6d758d2e09517030afad689b6805fc2b8b801a1f182c04369191a30d
-
SSDEEP
3072:eafjdfYraZJXENc8uCXJiXK1K2LEpzUCV+PaIh9bwdANblLNBNKRrxbU+cmH:eafjqQ15OCyLLkCVkxbDco
Score10/10-
Creates new service(s)
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1