Analysis
- max time kernel
40s - max time network
121s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
29/10/2022, 04:28
General
- Target file.exe
- Size 260KB
- Sample221029-e3nqlabbh6
- SHA256 49bb64bffbc1988c54e47833eeec3897d985f48c4a7689090fd3f1a7c2f1b4f1
Score
10/10
Malware Config
Extracted
Family
-
tofsee
C2
-
svartalfheim.top
-
jotunheim.name
Signatures
- Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
- Creates new service(s) 1 TTPs
- Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\grzgefqc\2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\xrhybzcl.exe" C:\Windows\SysWOW64\grzgefqc\2⤵
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create grzgefqc binPath= "C:\Windows\SysWOW64\grzgefqc\xrhybzcl.exe /d\"C:\Users\Admin\AppData\Local\Temp\file.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description grzgefqc "wifi internet conection"2⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start grzgefqc2⤵
- Launches sc.exe
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
xrhybzcl.exe
memory/1372-54-0x0000000076261000-0x0000000076263000-memory.dmp
memory/1372-56-0x0000000000220000-0x0000000000233000-memory.dmp
memory/1372-58-0x0000000000400000-0x0000000002C2F000-memory.dmp
memory/1372-55-0x0000000002D7A000-0x0000000002D8F000-memory.dmp