General
-
Target
105febf74de6f49371c61a0b23362510729921ea3aef5e2e839ac60f2077123a
-
Size
129KB
-
Sample
240417-qt2fwabc7w
-
MD5
ed9fc04436a33530c7c86531bcf2389b
-
SHA1
9d9373a9d420fcfdb7294d0dedda689bf4ef2671
-
SHA256
105febf74de6f49371c61a0b23362510729921ea3aef5e2e839ac60f2077123a
-
SHA512
c6418ae81209d2190ecbface0d7fefd8a9de60068b0e68fcb2a3103c0ea5054a396dd7d3a90d1b30d7637aeb59b493c248a2658123b36ed79d8ff773537c9e5e
-
SSDEEP
3072:+piLoq6fk/tlD8qQ3BR0sMaHkxLV4B2TtUHVAh/COzRwJ3kEJCJ:3DtaMAkx6sT+2BCOlEJi
Static task
static1
Behavioral task
behavioral1
Sample
43428294fd339a6c66b4ba9af723593f386808db747f2b2ba7a0dc0117379171.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
43428294fd339a6c66b4ba9af723593f386808db747f2b2ba7a0dc0117379171.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
tofsee
vanaheim.cn
jotunheim.name
Targets
-
-
Target
43428294fd339a6c66b4ba9af723593f386808db747f2b2ba7a0dc0117379171.exe
-
Size
235KB
-
MD5
85899a98881db336949f636dfd6f3d5b
-
SHA1
6b59c57d02a4fa9f503e064585e6dba562c63a8f
-
SHA256
43428294fd339a6c66b4ba9af723593f386808db747f2b2ba7a0dc0117379171
-
SHA512
df506d5fd86ae2c7c906b328e25d99d0362eda272eb0a4381449a836c69acf999d5942fabfc4960529482a98b8c71f6eadec1ca153de2e2d4f8042c50bfa69db
-
SSDEEP
3072:j72kySmwWaXJVCadJizA1KSB2sxhXM3tl64C5ARvc:j7236qahM3tLc
Score10/10-
Creates new service(s)
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1