Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-05-2023 01:14

General

  • Target

    53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe

  • Size

    292KB

  • MD5

    4e39579f1251ae570e145e352e7393f7

  • SHA1

    07497b310187f77e2c18364c7a0e31068be822d1

  • SHA256

    53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462

  • SHA512

    29dd728463e77e3988a074a97b36ebba3f0876e684ea96746b3ec0aeaf78e4ee25182b34a51900b6400fd8a22ea9a911bb15ae195bd04419f8303b9412920009

  • SSDEEP

    3072:Xk6e+HiNFjbrieXWP72/BRczZpgAhtBE3k2Bxz+4a2GMW/ft/Dr05xK:7zkjbrFi78BkpgKC3z2YK

Malware Config

Extracted

Family

tofsee

C2

vanaheim.cn

jotunheim.name

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Creates new service(s) 1 TTPs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe
    "C:\Users\Admin\AppData\Local\Temp\53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1220
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\sshwvudn\
      2⤵
        PID:2316
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\oaqdrqim.exe" C:\Windows\SysWOW64\sshwvudn\
        2⤵
          PID:3228
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create sshwvudn binPath= "C:\Windows\SysWOW64\sshwvudn\oaqdrqim.exe /d\"C:\Users\Admin\AppData\Local\Temp\53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:3204
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description sshwvudn "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:4456
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start sshwvudn
          2⤵
          • Launches sc.exe
          PID:1488
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:3460
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 1272
          2⤵
          • Program crash
          PID:1112
      • C:\Windows\SysWOW64\sshwvudn\oaqdrqim.exe
        C:\Windows\SysWOW64\sshwvudn\oaqdrqim.exe /d"C:\Users\Admin\AppData\Local\Temp\53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3860
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          2⤵
          • Sets service image path in registry
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          PID:2784
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 508
          2⤵
          • Program crash
          PID:4776
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 1220 -ip 1220
        1⤵
          PID:3492
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3860 -ip 3860
          1⤵
            PID:2220

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\oaqdrqim.exe

            Filesize

            14.6MB

            MD5

            3e77e039f6639b6ca3938e5efa785a3e

            SHA1

            304c50482b14619ca56a5c135f29d3b0576edcd5

            SHA256

            f82216cb96fffd41ee5c28649ce274a886b60757fb755e0fade44b636188c76a

            SHA512

            0a92f11ed241bc83ea417f1ddfdba53931653e40f917f8d1c70f24299527687ec55772061a3f63c0fc6d68218959c8a9d771cf37de5f3fb7b9155633fc825cfb

          • C:\Windows\SysWOW64\sshwvudn\oaqdrqim.exe

            Filesize

            14.6MB

            MD5

            3e77e039f6639b6ca3938e5efa785a3e

            SHA1

            304c50482b14619ca56a5c135f29d3b0576edcd5

            SHA256

            f82216cb96fffd41ee5c28649ce274a886b60757fb755e0fade44b636188c76a

            SHA512

            0a92f11ed241bc83ea417f1ddfdba53931653e40f917f8d1c70f24299527687ec55772061a3f63c0fc6d68218959c8a9d771cf37de5f3fb7b9155633fc825cfb

          • memory/1220-135-0x0000000000710000-0x0000000000723000-memory.dmp

            Filesize

            76KB

          • memory/1220-138-0x0000000000400000-0x00000000006C7000-memory.dmp

            Filesize

            2.8MB

          • memory/2784-140-0x0000000000190000-0x00000000001A5000-memory.dmp

            Filesize

            84KB

          • memory/2784-143-0x0000000000190000-0x00000000001A5000-memory.dmp

            Filesize

            84KB

          • memory/2784-144-0x0000000000190000-0x00000000001A5000-memory.dmp

            Filesize

            84KB

          • memory/2784-146-0x0000000000190000-0x00000000001A5000-memory.dmp

            Filesize

            84KB

          • memory/2784-147-0x0000000000190000-0x00000000001A5000-memory.dmp

            Filesize

            84KB

          • memory/3860-145-0x0000000000400000-0x00000000006C7000-memory.dmp

            Filesize

            2.8MB