Behavioral task
behavioral1
Sample
b3c1e9f75d14351aa6d078525ed891bbefdf29c0a609efa9ebd9db997c455936.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
b3c1e9f75d14351aa6d078525ed891bbefdf29c0a609efa9ebd9db997c455936.exe
Resource
win10v2004-20240802-en
General
-
Target
b3c1e9f75d14351aa6d078525ed891bbefdf29c0a609efa9ebd9db997c455936
-
Size
11.1MB
-
MD5
19ac32a44156aca36e14ad44a9a5e1c2
-
SHA1
900669e5aea78afc93bb894ac5d99066d7f21ad3
-
SHA256
b3c1e9f75d14351aa6d078525ed891bbefdf29c0a609efa9ebd9db997c455936
-
SHA512
461426485f7337a776f9ff8a47b27aa079507d61c6222fc035a7402c5647dac4331f0c3f1e25d229e42bd7fca5c134980c499e0db81607f695f964d0ce5f6648
-
SSDEEP
6144:zdVCxKg+IFppIHzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzD:B85tFpp
Malware Config
Extracted
tofsee
svartalfheim.top
jotunheim.name
Signatures
-
Tofsee family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource b3c1e9f75d14351aa6d078525ed891bbefdf29c0a609efa9ebd9db997c455936
Files
-
b3c1e9f75d14351aa6d078525ed891bbefdf29c0a609efa9ebd9db997c455936.exe windows:5 windows x86 arch:x86
0bdef4d92a94790d7d279561a490c5bb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
ioctlsocket
__WSAFDIsSet
WSAStartup
send
connect
setsockopt
bind
listen
accept
getsockname
htonl
gethostname
socket
select
recv
ntohs
htons
sendto
gethostbyaddr
inet_ntoa
gethostbyname
inet_addr
getpeername
closesocket
dbghelp
StackWalk64
kernel32
GetVolumeInformationA
GetComputerNameA
GetTickCount
GetCurrentProcess
GetModuleHandleA
GetSystemInfo
GetVersionExA
lstrcmpiA
lstrlenA
Sleep
lstrcpynA
InterlockedExchange
GetCurrentThreadId
ExitProcess
GetOverlappedResult
WaitForSingleObject
GetLastError
WriteFile
ReadFile
CreateFileA
DisconnectNamedPipe
ConnectNamedPipe
CreateNamedPipeA
CloseHandle
LoadLibraryA
GetEnvironmentVariableA
DeleteFileA
IsBadWritePtr
IsBadCodePtr
lstrcpyA
lstrcmpA
VirtualProtect
IsBadReadPtr
VirtualFree
WriteProcessMemory
VirtualAllocEx
VirtualAlloc
SetFilePointer
GetFileSize
SetFileAttributesA
GetDiskFreeSpaceA
GetWindowsDirectoryA
GetProcAddress
LocalFree
GetFileAttributesExA
LocalAlloc
CreateProcessA
GetTempPathA
SystemTimeToFileTime
GetSystemTime
DeviceIoControl
CreateFileW
GetModuleFileNameA
ResumeThread
SetThreadContext
TerminateProcess
GetThreadContext
lstrcatA
CreateThread
GetDriveTypeA
GetCommandLineA
SetUnhandledExceptionFilter
SetErrorMode
InterlockedIncrement
GetLocalTime
GetTimeZoneInformation
FileTimeToLocalFileTime
FileTimeToSystemTime
InterlockedDecrement
HeapSize
GetSystemTimeAsFileTime
MultiByteToWideChar
lstrlenW
GetStartupInfoW
GetProcessHeap
HeapAlloc
HeapReAlloc
HeapFree
FreeLibrary
CreateEventA
GetSystemDirectoryA
user32
wsprintfA
CharToOemA
advapi32
ConvertSidToStringSidA
AllocateAndInitializeSid
CreateProcessWithLogonW
RegCreateKeyExA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
SetServiceStatus
RegDeleteValueA
RegGetKeySecurity
RegSetKeySecurity
RegSetValueExA
GetLengthSid
GetFileSecurityA
GetSecurityDescriptorOwner
EqualSid
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
SetFileSecurityA
GetSecurityDescriptorDacl
GetAce
DeleteAce
SetSecurityDescriptorDacl
RegQueryValueExA
RegEnumKeyA
RegOpenKeyExA
RegEnumValueA
GetUserNameW
LookupAccountNameW
LookupAccountNameA
GetUserNameA
RegCloseKey
CheckTokenMembership
FreeSid
shell32
ShellExecuteA
ShellExecuteExW
oleaut32
SysAllocStringByteLen
Sections
.text Size: 57KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 11.0MB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ