Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    19/12/2022, 02:09

General

  • Target

    99d7b0b82235515c6fa26b24044ef57c3dd4fdb845ee3630ca3d0589e89da751.exe

  • Size

    215KB

  • MD5

    d5dd1af970503b683a685c0fae23faa5

  • SHA1

    9daca0aa9643391b468e6ac781d79bd5de11fdb7

  • SHA256

    99d7b0b82235515c6fa26b24044ef57c3dd4fdb845ee3630ca3d0589e89da751

  • SHA512

    d07fc28b34f0c3eb6df0af598b98135b64ccebeccce6068bd0f84690637c43faee65a4e7b446f22535b5c9f09e903227f62e09b936913a536725352486c50cca

  • SSDEEP

    3072:U363Lypc5daRSa05jlkgBo9pk8GAgZrr2x9aNRAtOba+G8EwjcbImdzmuX:UK3LAc5X5jlkgslGzZmxc0z8EwjcbXF

Malware Config

Extracted

Family

tofsee

C2

svartalfheim.top

jotunheim.name

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs 1 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 1 IoCs
  • Creates new service(s) 1 TTPs
  • Executes dropped EXE 1 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies data under HKEY_USERS 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\99d7b0b82235515c6fa26b24044ef57c3dd4fdb845ee3630ca3d0589e89da751.exe
    "C:\Users\Admin\AppData\Local\Temp\99d7b0b82235515c6fa26b24044ef57c3dd4fdb845ee3630ca3d0589e89da751.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4124
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ddadfaow\
      2⤵
        PID:1652
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\lkjklvxa.exe" C:\Windows\SysWOW64\ddadfaow\
        2⤵
          PID:3508
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create ddadfaow binPath= "C:\Windows\SysWOW64\ddadfaow\lkjklvxa.exe /d\"C:\Users\Admin\AppData\Local\Temp\99d7b0b82235515c6fa26b24044ef57c3dd4fdb845ee3630ca3d0589e89da751.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:4284
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description ddadfaow "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:4696
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start ddadfaow
          2⤵
          • Launches sc.exe
          PID:4504
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:3804
      • C:\Windows\SysWOW64\ddadfaow\lkjklvxa.exe
        C:\Windows\SysWOW64\ddadfaow\lkjklvxa.exe /d"C:\Users\Admin\AppData\Local\Temp\99d7b0b82235515c6fa26b24044ef57c3dd4fdb845ee3630ca3d0589e89da751.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3064
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          2⤵
          • Windows security bypass
          • Sets service image path in registry
          • Deletes itself
          • Drops file in System32 directory
          • Suspicious use of SetThreadContext
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:4948
          • C:\Windows\SysWOW64\svchost.exe
            svchost.exe -o fastpool.xyz:10060 -u 9mLwUkiK8Yp89zQQYodWKN29jVVVz1cWDFZctWxge16Zi3TpHnSBnnVcCDhSRXdesnMBdVjtDwh1N71KD9z37EzgKSM1tmS.60000 -p x -k -a cn/half
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4784

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\lkjklvxa.exe

        Filesize

        12.5MB

        MD5

        981b9b78e81ab55745d6e780f5e29cf4

        SHA1

        a70e5a1af77614a7e047fded78334051aac9f122

        SHA256

        659d706ed08916c6949e6d0495a3733b2bffb54f213355220fe0f2472f3ef71a

        SHA512

        89b0731b2c9263fcc6e7cd059540dbc788b0036d22b5026026c706b4d4b6383971d3e144089a9f7d428dfda35499331653c816cef784abb24156c73f8b09201b

      • C:\Windows\SysWOW64\ddadfaow\lkjklvxa.exe

        Filesize

        12.5MB

        MD5

        981b9b78e81ab55745d6e780f5e29cf4

        SHA1

        a70e5a1af77614a7e047fded78334051aac9f122

        SHA256

        659d706ed08916c6949e6d0495a3733b2bffb54f213355220fe0f2472f3ef71a

        SHA512

        89b0731b2c9263fcc6e7cd059540dbc788b0036d22b5026026c706b4d4b6383971d3e144089a9f7d428dfda35499331653c816cef784abb24156c73f8b09201b

      • memory/1652-171-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/1652-167-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/1652-168-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/1652-169-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/1652-170-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/3064-343-0x0000000000400000-0x000000000045D000-memory.dmp

        Filesize

        372KB

      • memory/3064-340-0x0000000000751000-0x0000000000761000-memory.dmp

        Filesize

        64KB

      • memory/3508-175-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/3508-173-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/3508-174-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/3508-176-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/3508-182-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-137-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-133-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-135-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-116-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-136-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-138-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-139-0x0000000000646000-0x0000000000657000-memory.dmp

        Filesize

        68KB

      • memory/4124-140-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-142-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-141-0x00000000004C0000-0x000000000060A000-memory.dmp

        Filesize

        1.3MB

      • memory/4124-143-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-144-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-145-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-146-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-147-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-148-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-149-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-150-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-151-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-152-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-153-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-154-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-155-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-156-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-157-0x0000000000400000-0x000000000045D000-memory.dmp

        Filesize

        372KB

      • memory/4124-158-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-159-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-160-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-161-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-162-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-163-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-164-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-165-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-134-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-132-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-131-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-130-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-129-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-128-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-127-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-126-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-125-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-124-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-123-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-117-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-118-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-119-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-214-0x0000000000400000-0x000000000045D000-memory.dmp

        Filesize

        372KB

      • memory/4124-211-0x0000000000646000-0x0000000000657000-memory.dmp

        Filesize

        68KB

      • memory/4124-122-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-121-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4124-120-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4284-179-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4284-186-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4284-185-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4284-178-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4284-181-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4284-180-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4696-187-0x0000000077480000-0x000000007760E000-memory.dmp

        Filesize

        1.6MB

      • memory/4948-416-0x0000000002AB0000-0x0000000002AC5000-memory.dmp

        Filesize

        84KB

      • memory/4948-482-0x0000000002AB0000-0x0000000002AC5000-memory.dmp

        Filesize

        84KB