Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2df9e15a40383966d55fecd858259c770be5b70d537c24b416d5cf045bba2929

  • Size

    185KB

  • Sample

    221130-mheaeseg6x

  • MD5

    1c5e5f86fe3cca92894d215867094168

  • SHA1

    77b98b39a63a0513a5064833386d47b36855a908

  • SHA256

    2df9e15a40383966d55fecd858259c770be5b70d537c24b416d5cf045bba2929

  • SHA512

    68c4c4fac27b4938c009ce57adf8cffc1436d254a33ce798bde3c71f75e4204de2bd350ee09f1095c1c6896c91311ba73e86dc14fb7d6e3ab69fb5e92bfa7e13

  • SSDEEP

    3072:nXMMUyuwOttYAd5+ygOWkH6XwtKgyTmEs35I1kEY0upL90NQVYf:cMLOttDxWkmwUgyTmEuW1670Ny

Score
10/10
tofseexmrigevasionminerpersistencetrojan

Malware Config

Extracted

Family

tofsee

C2

svartalfheim.top

jotunheim.name

Targets

    • Target

      2df9e15a40383966d55fecd858259c770be5b70d537c24b416d5cf045bba2929

    • Size

      185KB

    • MD5

      1c5e5f86fe3cca92894d215867094168

    • SHA1

      77b98b39a63a0513a5064833386d47b36855a908

    • SHA256

      2df9e15a40383966d55fecd858259c770be5b70d537c24b416d5cf045bba2929

    • SHA512

      68c4c4fac27b4938c009ce57adf8cffc1436d254a33ce798bde3c71f75e4204de2bd350ee09f1095c1c6896c91311ba73e86dc14fb7d6e3ab69fb5e92bfa7e13

    • SSDEEP

      3072:nXMMUyuwOttYAd5+ygOWkH6XwtKgyTmEs35I1kEY0upL90NQVYf:cMLOttDxWkmwUgyTmEuW1670Ny

    Score
    10/10
    tofseexmrigevasionminerpersistencetrojan

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

      trojantofsee

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Creates new service(s)

      persistence

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Sets service image path in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

New Service

1
T1050

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

New Service

1
T1050

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks