Analysis

  • max time kernel
    146s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/10/2023, 12:19

General

  • Target

    NEAS.6851e67bab60351b5fbfc00d8e4d5c454eb3a6bdd0cdf66cd324aa2828753c23exe_JC.exe

  • Size

    275KB

  • MD5

    51f78e75d410a09cb48d84209893135a

  • SHA1

    c25fba0d633bc073346bf733945b6d73053e63b0

  • SHA256

    6851e67bab60351b5fbfc00d8e4d5c454eb3a6bdd0cdf66cd324aa2828753c23

  • SHA512

    9b16e8a4df77b28374d60a16d3acb5a811248119901e04524e646d95fae12a853494d77915544bd49c09df22a5ec9713a5cc776c4982ed25bfeae3701e0e9da5

  • SSDEEP

    3072:CP1pDwPaFmYBQDzn2k+9a/WqnJGOg0Xhxz4l8QU:Q1qPnYBQPnv/WubFxK8Q

Malware Config

Extracted

Family

tofsee

C2

vanaheim.cn

jotunheim.name

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Creates new service(s) 1 TTPs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Modifies data under HKEY_USERS 6 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.6851e67bab60351b5fbfc00d8e4d5c454eb3a6bdd0cdf66cd324aa2828753c23exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6851e67bab60351b5fbfc00d8e4d5c454eb3a6bdd0cdf66cd324aa2828753c23exe_JC.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4916
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\wzvdzmnn\
      2⤵
        PID:1664
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\jhwexnie.exe" C:\Windows\SysWOW64\wzvdzmnn\
        2⤵
          PID:1460
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create wzvdzmnn binPath= "C:\Windows\SysWOW64\wzvdzmnn\jhwexnie.exe /d\"C:\Users\Admin\AppData\Local\Temp\NEAS.6851e67bab60351b5fbfc00d8e4d5c454eb3a6bdd0cdf66cd324aa2828753c23exe_JC.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:3204
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description wzvdzmnn "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:1724
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start wzvdzmnn
          2⤵
          • Launches sc.exe
          PID:3236
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:3292
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 1036
          2⤵
          • Program crash
          PID:3356
      • C:\Windows\SysWOW64\wzvdzmnn\jhwexnie.exe
        C:\Windows\SysWOW64\wzvdzmnn\jhwexnie.exe /d"C:\Users\Admin\AppData\Local\Temp\NEAS.6851e67bab60351b5fbfc00d8e4d5c454eb3a6bdd0cdf66cd324aa2828753c23exe_JC.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4132
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          2⤵
          • Sets service image path in registry
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          PID:4720
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 512
          2⤵
          • Program crash
          PID:924
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4916 -ip 4916
        1⤵
          PID:4744
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4132 -ip 4132
          1⤵
            PID:2872

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\jhwexnie.exe

                  Filesize

                  14.4MB

                  MD5

                  0a80ded51797daa9aa4a09149773119f

                  SHA1

                  3d5ed102d6ef0d04dc870c20e115ca4813484828

                  SHA256

                  3e4a28aabc27af6e09a69e6374309f2c0d8f4d0ba6899dcf656814b350517b23

                  SHA512

                  ca6a3fdd320668ac26d8b9f135dabd580d7f92e9d67f5e8012abeedf71dd05e57be9df1574748f42de4286563f9ad0b6136131508cc90177254122e5e88dffe2

                • C:\Windows\SysWOW64\wzvdzmnn\jhwexnie.exe

                  Filesize

                  14.4MB

                  MD5

                  0a80ded51797daa9aa4a09149773119f

                  SHA1

                  3d5ed102d6ef0d04dc870c20e115ca4813484828

                  SHA256

                  3e4a28aabc27af6e09a69e6374309f2c0d8f4d0ba6899dcf656814b350517b23

                  SHA512

                  ca6a3fdd320668ac26d8b9f135dabd580d7f92e9d67f5e8012abeedf71dd05e57be9df1574748f42de4286563f9ad0b6136131508cc90177254122e5e88dffe2

                • memory/4132-10-0x00000000023E0000-0x00000000024E0000-memory.dmp

                  Filesize

                  1024KB

                • memory/4132-16-0x0000000000400000-0x000000000228B000-memory.dmp

                  Filesize

                  30.5MB

                • memory/4132-15-0x0000000000400000-0x000000000228B000-memory.dmp

                  Filesize

                  30.5MB

                • memory/4720-32-0x0000000002610000-0x0000000002620000-memory.dmp

                  Filesize

                  64KB

                • memory/4720-46-0x0000000002610000-0x0000000002620000-memory.dmp

                  Filesize

                  64KB

                • memory/4720-33-0x0000000002610000-0x0000000002620000-memory.dmp

                  Filesize

                  64KB

                • memory/4720-11-0x0000000000530000-0x0000000000545000-memory.dmp

                  Filesize

                  84KB

                • memory/4720-14-0x0000000000530000-0x0000000000545000-memory.dmp

                  Filesize

                  84KB

                • memory/4720-34-0x0000000002610000-0x0000000002620000-memory.dmp

                  Filesize

                  64KB

                • memory/4720-18-0x0000000000530000-0x0000000000545000-memory.dmp

                  Filesize

                  84KB

                • memory/4720-17-0x0000000000530000-0x0000000000545000-memory.dmp

                  Filesize

                  84KB

                • memory/4720-35-0x0000000002610000-0x0000000002620000-memory.dmp

                  Filesize

                  64KB

                • memory/4720-20-0x0000000000530000-0x0000000000545000-memory.dmp

                  Filesize

                  84KB

                • memory/4720-21-0x0000000002400000-0x000000000260F000-memory.dmp

                  Filesize

                  2.1MB

                • memory/4720-24-0x0000000002400000-0x000000000260F000-memory.dmp

                  Filesize

                  2.1MB

                • memory/4720-25-0x0000000001BF0000-0x0000000001BF6000-memory.dmp

                  Filesize

                  24KB

                • memory/4720-28-0x0000000002610000-0x0000000002620000-memory.dmp

                  Filesize

                  64KB

                • memory/4720-31-0x0000000002610000-0x0000000002620000-memory.dmp

                  Filesize

                  64KB

                • memory/4720-37-0x0000000002610000-0x0000000002620000-memory.dmp

                  Filesize

                  64KB

                • memory/4720-42-0x0000000002610000-0x0000000002620000-memory.dmp

                  Filesize

                  64KB

                • memory/4720-36-0x0000000002610000-0x0000000002620000-memory.dmp

                  Filesize

                  64KB

                • memory/4720-51-0x00000000027E0000-0x00000000027E5000-memory.dmp

                  Filesize

                  20KB

                • memory/4720-52-0x0000000007300000-0x000000000770B000-memory.dmp

                  Filesize

                  4.0MB

                • memory/4720-48-0x00000000027E0000-0x00000000027E5000-memory.dmp

                  Filesize

                  20KB

                • memory/4720-47-0x0000000002610000-0x0000000002620000-memory.dmp

                  Filesize

                  64KB

                • memory/4720-45-0x0000000002610000-0x0000000002620000-memory.dmp

                  Filesize

                  64KB

                • memory/4720-44-0x0000000002610000-0x0000000002620000-memory.dmp

                  Filesize

                  64KB

                • memory/4720-43-0x0000000002610000-0x0000000002620000-memory.dmp

                  Filesize

                  64KB

                • memory/4720-41-0x0000000002610000-0x0000000002620000-memory.dmp

                  Filesize

                  64KB

                • memory/4720-55-0x0000000007300000-0x000000000770B000-memory.dmp

                  Filesize

                  4.0MB

                • memory/4720-56-0x00000000027F0000-0x00000000027F7000-memory.dmp

                  Filesize

                  28KB

                • memory/4720-40-0x0000000002610000-0x0000000002620000-memory.dmp

                  Filesize

                  64KB

                • memory/4720-39-0x0000000002610000-0x0000000002620000-memory.dmp

                  Filesize

                  64KB

                • memory/4720-38-0x0000000002610000-0x0000000002620000-memory.dmp

                  Filesize

                  64KB

                • memory/4916-8-0x0000000002530000-0x0000000002543000-memory.dmp

                  Filesize

                  76KB

                • memory/4916-1-0x00000000025B0000-0x00000000026B0000-memory.dmp

                  Filesize

                  1024KB

                • memory/4916-2-0x0000000002530000-0x0000000002543000-memory.dmp

                  Filesize

                  76KB

                • memory/4916-4-0x0000000000400000-0x000000000228B000-memory.dmp

                  Filesize

                  30.5MB

                • memory/4916-7-0x0000000000400000-0x000000000228B000-memory.dmp

                  Filesize

                  30.5MB