General
-
Target
b40b6b9bd2f7d17a65c72469ee2e2cfa.bin
-
Size
140KB
-
Sample
240708-ecmqls1cpp
-
MD5
ceae2dcf40afca7f816ab564aa7d50f9
-
SHA1
43fa404c1845a49c8509bf1d0ff018cdf75c3c5a
-
SHA256
40e25ec79404f2534127dfc8a6882aba97518bd06545fb5be285f5aafd1bdefd
-
SHA512
14ccdc998510bacadbff2a04dab5c86bbe56097cff9d5817b5547ac38049d9c7645925332a05860bfc5515b8976d1851cddd9481307fa403a125f4771efcca9d
-
SSDEEP
3072:8Fx0SpBLMjmTVAASiJyUlztFDDxA21J5Uj4nNqviQ7CbQOw/:8FFpBL+mpAAhLpFDD62DNqviQO3w/
Static task
static1
Behavioral task
behavioral1
Sample
f37f32eb1c859541773f55297fb1e05bbfc2874851fc7bbd4e185d3a6a1b6583.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
f37f32eb1c859541773f55297fb1e05bbfc2874851fc7bbd4e185d3a6a1b6583.exe
Resource
win10v2004-20240704-en
Malware Config
Extracted
tofsee
vanaheim.cn
jotunheim.name
Targets
-
-
Target
f37f32eb1c859541773f55297fb1e05bbfc2874851fc7bbd4e185d3a6a1b6583.exe
-
Size
229KB
-
MD5
b40b6b9bd2f7d17a65c72469ee2e2cfa
-
SHA1
859ffdfda568b34e1c3ded9f846dea6e8774f5b5
-
SHA256
f37f32eb1c859541773f55297fb1e05bbfc2874851fc7bbd4e185d3a6a1b6583
-
SHA512
7a4b7171000f8dad0eed766e212ee6c9ebf6431175291442524383232f5455f6bc3e8b224c31dc8bf48ad0cba4ef7637edd4dcc8f32e48f93fb9ea7036adeae1
-
SSDEEP
3072:DI/quXXuYu/IdYKV97eRuWYxYBouZdSzBS7sy4iIb:DYqKXzEIzSbYxYTAS7W
-
Creates new service(s)
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1