General
-
Target
738632816e687b5d9ba550e5b64de5fdbba1736e4dcaa11fd15f6cc7fe88c078
-
Size
145KB
-
Sample
240417-qtexwabc4t
-
MD5
129280f72ecd10b59479f21728f1c413
-
SHA1
1d5bc8632c1dde68cb16f926282d95a437bf46b8
-
SHA256
738632816e687b5d9ba550e5b64de5fdbba1736e4dcaa11fd15f6cc7fe88c078
-
SHA512
897f7e9f9d35132af153abdc94a6fc494cf6bf08cd486021f2d9a847569ea73cf63c1e15fc9fa6545e1406aa6e31925b1e87e4e9f0c90b94ef51ef054e7ce0e5
-
SSDEEP
3072:QH0rjFDr37K9Hrbma3jlPbcYvrhWdUCF88h5ie:xrpH7K1rB3jlDcYvre8gie
Static task
static1
Behavioral task
behavioral1
Sample
9dc0085f64473ca82753f59552bae76c64b5165e72899d727cd18f4d1afbd9d1.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9dc0085f64473ca82753f59552bae76c64b5165e72899d727cd18f4d1afbd9d1.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
tofsee
vanaheim.cn
jotunheim.name
Targets
-
-
Target
9dc0085f64473ca82753f59552bae76c64b5165e72899d727cd18f4d1afbd9d1.exe
-
Size
233KB
-
MD5
e1fd44ce08b0383dc59e732bb0b1f2d9
-
SHA1
70dc0dba88f5b4d02f554627ec8fce32b9237fcc
-
SHA256
9dc0085f64473ca82753f59552bae76c64b5165e72899d727cd18f4d1afbd9d1
-
SHA512
7db8ae6bbead6c8603fda377b70cf05f793a795ca29cef50a97c6df148c4ecf5677880177016d7e65e51b204bbeed22b07e31f9d021305ea7a350b7130121d0d
-
SSDEEP
3072:TcYelBc/ctFykDqPogVwsvhQNW3k1QxCJ18YcRfIBvd4rm5qe4EY3jXO9ZJwVQk:TcdBJ+PojEk1QEJq1FIBv74E2OTF
Score10/10-
Creates new service(s)
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1