Overview

overview

10

Static

static

cd524a9867...96.exe

windows7-x64

10

cd524a9867...96.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cd524a9867b1196e9fd5103acdfa12b3a8b79b7469bf4eb36fce62d35c375796.exe

  • Size

    192KB

  • Sample

    221203-1z831sdd8y

  • MD5

    d4e0a9ff19277f89090ea5e4e558f7ef

  • SHA1

    cd3a22ef3f2a0a4f3b01b95b13c4946045e0cd63

  • SHA256

    cd524a9867b1196e9fd5103acdfa12b3a8b79b7469bf4eb36fce62d35c375796

  • SHA512

    585d62799f6fe5ce68018c20e8aecb6154959bfb8fc02a69dd9a3b249f94f85c1600d60cb2b74365fe4426de4f172fbc0df7e7e789bb06386895eb7bdf1241be

  • SSDEEP

    3072:9rbR6e6hM46gUIJ5qbMlCzgyQ4Iu0mE4GrtmxRs9E3AZxpR/c:9Mc46gUL4Bg01xxvp

Score
10/10
tofseexmrigevasionminerpersistencetrojan

Malware Config

Extracted

Family

tofsee

C2

svartalfheim.top

jotunheim.name

Targets

    • Target

      cd524a9867b1196e9fd5103acdfa12b3a8b79b7469bf4eb36fce62d35c375796.exe

    • Size

      192KB

    • MD5

      d4e0a9ff19277f89090ea5e4e558f7ef

    • SHA1

      cd3a22ef3f2a0a4f3b01b95b13c4946045e0cd63

    • SHA256

      cd524a9867b1196e9fd5103acdfa12b3a8b79b7469bf4eb36fce62d35c375796

    • SHA512

      585d62799f6fe5ce68018c20e8aecb6154959bfb8fc02a69dd9a3b249f94f85c1600d60cb2b74365fe4426de4f172fbc0df7e7e789bb06386895eb7bdf1241be

    • SSDEEP

      3072:9rbR6e6hM46gUIJ5qbMlCzgyQ4Iu0mE4GrtmxRs9E3AZxpR/c:9Mc46gUL4Bg01xxvp

    Score
    10/10
    tofseeevasionpersistencetrojanxmrigminer

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

      trojantofsee

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Creates new service(s)

      persistence

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Sets service image path in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

New Service

1
T1050

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

New Service

1
T1050

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks