General
-
Target
50b9161f0e8bfbba697269af22c122b5772adb275fd485fb3a1136f7bfe5b2e6
-
Size
129KB
-
Sample
240417-rj6hhsbd44
-
MD5
23038d57e1e75a5a389573031f2a07f1
-
SHA1
eed6b8802a1f77e6aada759d10f9c49f52c3b391
-
SHA256
50b9161f0e8bfbba697269af22c122b5772adb275fd485fb3a1136f7bfe5b2e6
-
SHA512
113042005c6e669b7688b9285b54111596a42ba76f7b5bb4f4a976c8aaede53ed8ba000af7c9017e6933f2063d904b305c219abe8b3206f7523dad51b956efd7
-
SSDEEP
3072:IMPE8P7TOYedF1R2Bu8A6ByPqJTZCcDjH9SLlQSYNcR:pPEWTO51sHA6ByP/cDTclQD+
Static task
static1
Behavioral task
behavioral1
Sample
43428294fd339a6c66b4ba9af723593f386808db747f2b2ba7a0dc0117379171.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
43428294fd339a6c66b4ba9af723593f386808db747f2b2ba7a0dc0117379171.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
tofsee
vanaheim.cn
jotunheim.name
Targets
-
-
Target
43428294fd339a6c66b4ba9af723593f386808db747f2b2ba7a0dc0117379171.exe
-
Size
235KB
-
MD5
85899a98881db336949f636dfd6f3d5b
-
SHA1
6b59c57d02a4fa9f503e064585e6dba562c63a8f
-
SHA256
43428294fd339a6c66b4ba9af723593f386808db747f2b2ba7a0dc0117379171
-
SHA512
df506d5fd86ae2c7c906b328e25d99d0362eda272eb0a4381449a836c69acf999d5942fabfc4960529482a98b8c71f6eadec1ca153de2e2d4f8042c50bfa69db
-
SSDEEP
3072:j72kySmwWaXJVCadJizA1KSB2sxhXM3tl64C5ARvc:j7236qahM3tLc
Score10/10-
Creates new service(s)
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1