General
-
Target
13d2063c4b52fc127970c1d1bde5a730.bin
-
Size
151KB
-
Sample
240727-byzeraybrk
-
MD5
13d2063c4b52fc127970c1d1bde5a730
-
SHA1
520a74fb30dbd091e574679a2fba54be28e387bb
-
SHA256
4a64c457c8ad2ff6e90cf46e3a7586da574f223b10b926e63d7f41e9a8ed886d
-
SHA512
e655a2efd06bc80a1976ac20937f0a6dfb078acb4b4377788fb8c74bbd9cced13dd684dc3923c9d9058f0dbae4d3523462c14b2e77d79b3be88e7a641f314c4e
-
SSDEEP
3072:0PfLv9vOx8hbxSCL4b5zGEArun5I85iNUKZ:uLv9vDhb4CMXKZ
Static task
static1
Behavioral task
behavioral1
Sample
13d2063c4b52fc127970c1d1bde5a730.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
13d2063c4b52fc127970c1d1bde5a730.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
tofsee
vanaheim.cn
jotunheim.name
Targets
-
-
Target
13d2063c4b52fc127970c1d1bde5a730.bin
-
Size
151KB
-
MD5
13d2063c4b52fc127970c1d1bde5a730
-
SHA1
520a74fb30dbd091e574679a2fba54be28e387bb
-
SHA256
4a64c457c8ad2ff6e90cf46e3a7586da574f223b10b926e63d7f41e9a8ed886d
-
SHA512
e655a2efd06bc80a1976ac20937f0a6dfb078acb4b4377788fb8c74bbd9cced13dd684dc3923c9d9058f0dbae4d3523462c14b2e77d79b3be88e7a641f314c4e
-
SSDEEP
3072:0PfLv9vOx8hbxSCL4b5zGEArun5I85iNUKZ:uLv9vDhb4CMXKZ
-
Creates new service(s)
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
2Disable or Modify System Firewall
1Disable or Modify Tools
1Modify Registry
2