General
-
Target
26ebd2cf3cbee4dd5faa1f38c7b1ed58f352a7453ecbe962f95476c4c98a816e
-
Size
160KB
-
Sample
240417-qtdd2sbc31
-
MD5
b96015f515fb1cc66ccadc0054efd5e4
-
SHA1
0b7b2e7cdc41429f793907bc9e4cffa9bf155b7d
-
SHA256
26ebd2cf3cbee4dd5faa1f38c7b1ed58f352a7453ecbe962f95476c4c98a816e
-
SHA512
876672bfeaaed23a6836a1f63a10e0ebc44eebd4fbf3d2defd6636360306ccecfdf33663b935ce4d32118e7d35a1cc7202e34913e1f63f0b3989c02fbc72d2dd
-
SSDEEP
3072:ejZwQ5QPvnfId1T/dZ+MuwjQkj0koFbQWMT3seGYDZXt0DdVVL07uqv12:ET5QwdPQJwjtnImjPGWZSh07ue12
Static task
static1
Behavioral task
behavioral1
Sample
aedba5939122af54e928bc355fbd3ffce10cc95f8d7efd007b8f9960d3c0cfe5.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
aedba5939122af54e928bc355fbd3ffce10cc95f8d7efd007b8f9960d3c0cfe5.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
tofsee
vanaheim.cn
jotunheim.name
Targets
-
-
Target
aedba5939122af54e928bc355fbd3ffce10cc95f8d7efd007b8f9960d3c0cfe5.exe
-
Size
256KB
-
MD5
11d6fdab8ce0a4462699d12d8cc6e181
-
SHA1
f79dd773636fb0c46346f08e9a36bea666e34350
-
SHA256
aedba5939122af54e928bc355fbd3ffce10cc95f8d7efd007b8f9960d3c0cfe5
-
SHA512
dd582a962bc9d3c50782a528a1c635d065530b96f7e1325d0c254f299b10b29218a8626b15f18b11aaf234b7393cea39d8025fa8d023fa9e79bdbdce2d6478a6
-
SSDEEP
3072:DlrJL/wyRvNQG+FiOf5hqBNDo0Rpv01b8FbuW5hL4WeNH601:D3L/wUkFiOf5Ybon1gL4WeNa
Score10/10-
Creates new service(s)
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1