Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10-20220414-en
  • submitted
    18-06-2022 18:21

General

  • Target

    6f240dfeafe54414ad03e062083c8e8ab9c513278c6dd32f4d4c2aa3435ae52c.exe

  • Size

    309KB

  • MD5

    92a61641bf24d199d0c246ee39dc2cb3

  • SHA1

    92b81fe6818b16a5a3f73236eb349b6ff6b3c6bb

  • SHA256

    6f240dfeafe54414ad03e062083c8e8ab9c513278c6dd32f4d4c2aa3435ae52c

  • SHA512

    2a11264b9252d1fc70ef4f59a8b7eb117fc47ee62c61601f223acb7d27afb75b0c4a37bf0b2fd84931cb1dc72094890940f9859c41b59c1914b22033e2996caa

Malware Config

Extracted

Family

tofsee

C2

svartalfheim.top

jotunheim.name

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs 1 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner Payload 1 IoCs
  • Creates new service(s) 1 TTPs
  • Executes dropped EXE 1 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies data under HKEY_USERS 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6f240dfeafe54414ad03e062083c8e8ab9c513278c6dd32f4d4c2aa3435ae52c.exe
    "C:\Users\Admin\AppData\Local\Temp\6f240dfeafe54414ad03e062083c8e8ab9c513278c6dd32f4d4c2aa3435ae52c.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3652
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\nuuxyocm\
      2⤵
        PID:4816
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\wlvzmnc.exe" C:\Windows\SysWOW64\nuuxyocm\
        2⤵
          PID:5072
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create nuuxyocm binPath= "C:\Windows\SysWOW64\nuuxyocm\wlvzmnc.exe /d\"C:\Users\Admin\AppData\Local\Temp\6f240dfeafe54414ad03e062083c8e8ab9c513278c6dd32f4d4c2aa3435ae52c.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:1416
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description nuuxyocm "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:984
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start nuuxyocm
          2⤵
          • Launches sc.exe
          PID:2948
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:4732
      • C:\Windows\SysWOW64\nuuxyocm\wlvzmnc.exe
        C:\Windows\SysWOW64\nuuxyocm\wlvzmnc.exe /d"C:\Users\Admin\AppData\Local\Temp\6f240dfeafe54414ad03e062083c8e8ab9c513278c6dd32f4d4c2aa3435ae52c.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4724
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          2⤵
          • Windows security bypass
          • Sets service image path in registry
          • Deletes itself
          • Drops file in System32 directory
          • Suspicious use of SetThreadContext
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:3068
          • C:\Windows\SysWOW64\svchost.exe
            svchost.exe -o fastpool.xyz:10060 -u 9mLwUkiK8Yp89zQQYodWKN29jVVVz1cWDFZctWxge16Zi3TpHnSBnnVcCDhSRXdesnMBdVjtDwh1N71KD9z37EzgKSM1tmS.60000 -p x -k -a cn/half
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1536

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Persistence

      New Service

      1
      T1050

      Modify Existing Service

      1
      T1031

      Registry Run Keys / Startup Folder

      1
      T1060

      Privilege Escalation

      New Service

      1
      T1050

      Defense Evasion

      Disabling Security Tools

      1
      T1089

      Modify Registry

      2
      T1112

      Discovery

      System Information Discovery

      1
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\wlvzmnc.exe
        Filesize

        10.9MB

        MD5

        e2dca2927765357a8b05dd8f2577366c

        SHA1

        f001dd967bfd06eb562cad90c2146dd8623046d7

        SHA256

        e173e7e176a0aab94e2ed78fc41b5a05d241296d4c243594f71f893767aa9d6f

        SHA512

        dde79a8f0e6bb4455c9c3fdfdbd58c35ec6b99cdfc86ae1f70c87ffa86b85f49aa7bea9a69f81ab6155e5e2c058f459e58de561a45d71d477e8029485a50f2ad

      • C:\Windows\SysWOW64\nuuxyocm\wlvzmnc.exe
        Filesize

        10.9MB

        MD5

        e2dca2927765357a8b05dd8f2577366c

        SHA1

        f001dd967bfd06eb562cad90c2146dd8623046d7

        SHA256

        e173e7e176a0aab94e2ed78fc41b5a05d241296d4c243594f71f893767aa9d6f

        SHA512

        dde79a8f0e6bb4455c9c3fdfdbd58c35ec6b99cdfc86ae1f70c87ffa86b85f49aa7bea9a69f81ab6155e5e2c058f459e58de561a45d71d477e8029485a50f2ad

      • memory/984-189-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/984-188-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/984-187-0x0000000000000000-mapping.dmp
      • memory/1416-185-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/1416-182-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/1416-183-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/1416-181-0x0000000000000000-mapping.dmp
      • memory/1416-184-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/1536-514-0x0000000002C9259C-mapping.dmp
      • memory/2948-192-0x0000000000000000-mapping.dmp
      • memory/3068-324-0x0000000002E89A6B-mapping.dmp
      • memory/3068-390-0x0000000002E80000-0x0000000002E95000-memory.dmp
        Filesize

        84KB

      • memory/3068-488-0x0000000002E80000-0x0000000002E95000-memory.dmp
        Filesize

        84KB

      • memory/3652-139-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-168-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-136-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-135-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-137-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-138-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-118-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-140-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-141-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-142-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-143-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-144-0x0000000002F0A000-0x0000000002F18000-memory.dmp
        Filesize

        56KB

      • memory/3652-145-0x0000000002DD0000-0x0000000002DE3000-memory.dmp
        Filesize

        76KB

      • memory/3652-146-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-147-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-148-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-149-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-150-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-151-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-152-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-153-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-154-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-155-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-156-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-157-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-158-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-159-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-160-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-161-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-162-0x0000000000400000-0x0000000002C6C000-memory.dmp
        Filesize

        40.4MB

      • memory/3652-163-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-164-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-165-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-166-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-167-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-134-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-119-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-120-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-121-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-122-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-123-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-230-0x0000000000400000-0x0000000002C6C000-memory.dmp
        Filesize

        40.4MB

      • memory/3652-218-0x0000000002DD0000-0x0000000002DE3000-memory.dmp
        Filesize

        76KB

      • memory/3652-217-0x0000000002F0A000-0x0000000002F18000-memory.dmp
        Filesize

        56KB

      • memory/3652-124-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-125-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-126-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-127-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-133-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-132-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-131-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-130-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-129-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/3652-128-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/4724-299-0x0000000002CF0000-0x0000000002D9E000-memory.dmp
        Filesize

        696KB

      • memory/4724-344-0x0000000000400000-0x0000000002C6C000-memory.dmp
        Filesize

        40.4MB

      • memory/4732-215-0x0000000000000000-mapping.dmp
      • memory/4816-169-0x0000000000000000-mapping.dmp
      • memory/4816-179-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/4816-170-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/4816-171-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/4816-173-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/4816-172-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/5072-178-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/5072-175-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/5072-176-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/5072-177-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/5072-180-0x0000000077520000-0x00000000776AE000-memory.dmp
        Filesize

        1.6MB

      • memory/5072-174-0x0000000000000000-mapping.dmp