Overview

overview

10

Static

static

2bdd7b1248...db.exe

windows7_x64

10

2bdd7b1248...db.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2bdd7b1248e121f05616fe3e3760a0fe18e0b05ced118fe7ce12f913df2361db

  • Size

    14.8MB

  • Sample

    210716-k48g3xm9vn

  • MD5

    98ebf84c4cde159c9a70cf371b64275b

  • SHA1

    9cf16fab93c58bd1bc4be454f00e67a1fe19e791

  • SHA256

    2bdd7b1248e121f05616fe3e3760a0fe18e0b05ced118fe7ce12f913df2361db

  • SHA512

    27e19d56f0024270cd4c367bd9f8865e307987be8f3267f3ca47a9d77c9847338ccc6ba5e2c1e8aadc414f0a12798ddfcd3f9e24c164259ea181b76d89684d26

Score
10/10
tofseexmrigevasionminerpersistencetrojan

Malware Config

Targets

    • Target

      2bdd7b1248e121f05616fe3e3760a0fe18e0b05ced118fe7ce12f913df2361db

    • Size

      14.8MB

    • MD5

      98ebf84c4cde159c9a70cf371b64275b

    • SHA1

      9cf16fab93c58bd1bc4be454f00e67a1fe19e791

    • SHA256

      2bdd7b1248e121f05616fe3e3760a0fe18e0b05ced118fe7ce12f913df2361db

    • SHA512

      27e19d56f0024270cd4c367bd9f8865e307987be8f3267f3ca47a9d77c9847338ccc6ba5e2c1e8aadc414f0a12798ddfcd3f9e24c164259ea181b76d89684d26

    Score
    10/10
    tofseexmrigevasionminerpersistencetrojan

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

      trojantofsee

    • Windows security bypass

      evasiontrojan

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner Payload

      miner

    • Creates new service(s)

      persistence

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Sets service image path in registry

      persistence

    • Deletes itself

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

New Service

1
T1050

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

New Service

1
T1050

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks