General
-
Target
6522fa5f61dee8086fcc972547b6e169f58da291dd00b7365acc011f175666c4
-
Size
145KB
-
Sample
240417-qtm89ahf82
-
MD5
dbf547042a246dfec1ebea8d74e6e3e0
-
SHA1
64071f24cb3df9e226c0112ae1bc58fd16fe2ee1
-
SHA256
6522fa5f61dee8086fcc972547b6e169f58da291dd00b7365acc011f175666c4
-
SHA512
5669d62c8b76da79ed060df2721591e4d8fcb54d0c42716a7c5478ae5718a4ea9a017d80d3b84e699671d046399ec03363fea68157ef61a6fd7bb5066f5b252d
-
SSDEEP
3072:vAAvE3W9kwhqXHDqibVtEu5ddFtJLXweuDEx/laTA+sCJs3PYoVr:oUE3+ejxbVtEgtJseu4JlaTLsgK
Static task
static1
Behavioral task
behavioral1
Sample
b557b082890ce023270e4291073976f24d7e68b1ab58890bb95b310785142992.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b557b082890ce023270e4291073976f24d7e68b1ab58890bb95b310785142992.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
tofsee
vanaheim.cn
jotunheim.name
Targets
-
-
Target
b557b082890ce023270e4291073976f24d7e68b1ab58890bb95b310785142992.exe
-
Size
229KB
-
MD5
68502dbaf73be1eca888f78e3b06d55a
-
SHA1
14654e87e085e07b91535c7e4e8bc5f41ced65e4
-
SHA256
b557b082890ce023270e4291073976f24d7e68b1ab58890bb95b310785142992
-
SHA512
d87cad3ac8f7f18cb12e63c9bb6a74f29dabf09d5374c64d51ce7a1b3621fd65e454ecf6ff0d0551b80685117b450abf50494b669ad48d5a9906b44e7364d6cb
-
SSDEEP
3072:+nBlv1nZAbXsdUs0vEJier1K2x5b2CZ/P20DMb9rAn5M23R8Gj7mkg+cmH:+nBXk1fmK+G0DMb9rA6Gj7mkHco
Score10/10-
Creates new service(s)
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1