General
-
Target
dcf8056404bffc002e0d258c4dacfc0233fa0121ee1f8e4744fc547c90c98426
-
Size
127KB
-
Sample
240417-r7qrzach52
-
MD5
7ab5c9a806dd581e3e14f1f46b914e42
-
SHA1
a356ce03073311cf3f15ea0da60986a8e5be79ec
-
SHA256
dcf8056404bffc002e0d258c4dacfc0233fa0121ee1f8e4744fc547c90c98426
-
SHA512
5cbc29193f60795a1014158c3ebbb80572430a6bdd6f2105cabfb92eb193ae719560dccb457fd90a7c15adcebf173c1640d5c94152a6eec5a731e652d3db07c0
-
SSDEEP
3072:NjbnynCyMZUxS27I3GV7KifesvNY0/FmczdZJHMlDn4o5wxnDk:NnnMCF8eeK+gczdPHijwC
Static task
static1
Behavioral task
behavioral1
Sample
755b1b45c26d282f094d504074bbdf897f6460968db67dd7d88a4702e03ef7f9.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
755b1b45c26d282f094d504074bbdf897f6460968db67dd7d88a4702e03ef7f9.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
tofsee
vanaheim.cn
jotunheim.name
Targets
-
-
Target
755b1b45c26d282f094d504074bbdf897f6460968db67dd7d88a4702e03ef7f9.exe
-
Size
203KB
-
MD5
d88f7c78b3be6c96c33b80a8e1bb85de
-
SHA1
ce07fb26b0ec69cdf563f98560aa4f7f298e6e8d
-
SHA256
755b1b45c26d282f094d504074bbdf897f6460968db67dd7d88a4702e03ef7f9
-
SHA512
1c396a26da383d01ddc317bc4c565c5825b0e452bcf262ac849cd720acb6cb7abcc08e895041e59246dd7686e72424990728745716815a5879bce30769e3e898
-
SSDEEP
3072:Ef3B/ALaZdXUNc8iirJiM21K7uSbrF068c0E0rBNWRDxlH+cmH:Ef32clVO598c0EHxQco
Score10/10-
Creates new service(s)
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1