General

  • Target

    daa8eec3b749adda8a13dfea811a86a7.exe

  • Size

    281KB

  • Sample

    211019-qv9hwaggdl

  • MD5

    daa8eec3b749adda8a13dfea811a86a7

  • SHA1

    f8015806491d2e808feb6078ccf7de472425b8ad

  • SHA256

    1dfb58a81f3624b21eb10ce87795e1aa2b3fd928ae83f7c52a37d6cb19e25cf8

  • SHA512

    4b8cc01245ddfdb69310570e2c127ab027d10ca55b572542b9a03e8023a06a57e2faaa08800abab195ae3ce3247c5d143ebe2e03b29bedb913b6349eb84e8ee9

Malware Config

Extracted

Family

tofsee

C2

quadoil.ru

lakeflex.ru

Targets

    • Target

      daa8eec3b749adda8a13dfea811a86a7.exe

    • Size

      281KB

    • MD5

      daa8eec3b749adda8a13dfea811a86a7

    • SHA1

      f8015806491d2e808feb6078ccf7de472425b8ad

    • SHA256

      1dfb58a81f3624b21eb10ce87795e1aa2b3fd928ae83f7c52a37d6cb19e25cf8

    • SHA512

      4b8cc01245ddfdb69310570e2c127ab027d10ca55b572542b9a03e8023a06a57e2faaa08800abab195ae3ce3247c5d143ebe2e03b29bedb913b6349eb84e8ee9

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Windows security bypass

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner Payload

    • Creates new service(s)

    • Executes dropped EXE

    • Modifies Windows Firewall

    • Sets service image path in registry

    • Deletes itself

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

New Service

1
T1050

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

New Service

1
T1050

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

2
T1112

Discovery

System Information Discovery

1
T1082

Tasks