General
-
Target
ec0c5d09960de9aa001e994e07155bfae016bc5b90e64c1d301021e4abf6ae64
-
Size
145KB
-
Sample
240417-r6948aec5w
-
MD5
ae82cb83c2730b6445f8da3d90cea402
-
SHA1
2e64945a9dbe45b3d6d6b7e6dc76dbd846539909
-
SHA256
ec0c5d09960de9aa001e994e07155bfae016bc5b90e64c1d301021e4abf6ae64
-
SHA512
fbf603c4ac8b397a21e4f3cece08d669d1b7892a09d28318001db8e2df55b6c6bbde9b3f2f6a9d2278d239f85fe69b0c503fa9441e20caab8c0f6b00693fb961
-
SSDEEP
3072:auub4z1DxowMi99Hg+1z+tKi8/8J5uITYEsK0tvH+ptmHWs:aNbMXowBg2zrkJc5vqtmH3
Static task
static1
Behavioral task
behavioral1
Sample
f379c2c732470dbce8e17423baf7f6fcca63bcb13c4ade33a15df1225e3841be.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
f379c2c732470dbce8e17423baf7f6fcca63bcb13c4ade33a15df1225e3841be.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
tofsee
vanaheim.cn
jotunheim.name
Targets
-
-
Target
f379c2c732470dbce8e17423baf7f6fcca63bcb13c4ade33a15df1225e3841be.exe
-
Size
232KB
-
MD5
b5f3dc95c09fa3bfdf009a404736f94e
-
SHA1
03e471e7edf9bbcbe2483ebd1ba05364c93a190a
-
SHA256
f379c2c732470dbce8e17423baf7f6fcca63bcb13c4ade33a15df1225e3841be
-
SHA512
f63cba660384d5296e2f8aeeceba1a2d4707311a242cd5f12220008670cb5c2bf686b546fafe03cc6c5363bd62fe4c067a1f9dc73a8388488e13854b631ee546
-
SSDEEP
6144:j6zxC0r84BWnfZUH7SFcQU+9HFsvKMXOCU:kY0r9BeZUbSiy9HSvKwO
Score10/10-
Creates new service(s)
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1