General
-
Target
d544bf09b45f461cc3b0e1241ea3d74d4a3737ae1a27c53839ffd74957c18ace
-
Size
193KB
-
Sample
240417-qkz7fshb45
-
MD5
642b5a3591a2520bc51704f1fcd2fce9
-
SHA1
3bab609267bc0d7956d60ce1bd68fc0e3402ae0d
-
SHA256
d544bf09b45f461cc3b0e1241ea3d74d4a3737ae1a27c53839ffd74957c18ace
-
SHA512
d73673f0dc9ab5f57cf326695354ba9a14806cf82fefa76e549cfd875792c0292365b088b2d9ff8d4c04bd3fcfa8ab7f3e520999005343a66ce91de55d2e421c
-
SSDEEP
6144:1KUO+MTovnl80j3W90jB390otBScwujdFmIo9R:1KkMkvOe3W9039btocwYUI6R
Static task
static1
Behavioral task
behavioral1
Sample
8e94ab9df264de254c2961478a718dd9e960b8701a4aa75015fde99d1f1020b1.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8e94ab9df264de254c2961478a718dd9e960b8701a4aa75015fde99d1f1020b1.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
tofsee
vanaheim.cn
jotunheim.name
Targets
-
-
Target
8e94ab9df264de254c2961478a718dd9e960b8701a4aa75015fde99d1f1020b1.exe
-
Size
331KB
-
MD5
3424a650d03640ec89fbb499d6674480
-
SHA1
1ea36d7a77ec67039e67f944280dfdcdf1582991
-
SHA256
8e94ab9df264de254c2961478a718dd9e960b8701a4aa75015fde99d1f1020b1
-
SHA512
5f8bed9cf3da89216af3b87d580535a29a67a617b8bee82e448ae2d02f4cf38975058d2a0d02cf3d48411745a8fc19d09eb5936b66d7be1c75d31087142e2411
-
SSDEEP
6144:/K6gQvvYlQo7wU9TZlSmHgafhoeyz5xYmX/M:C5QvvYlhbCmHgGhoeYxYmE
Score10/10-
Creates new service(s)
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1