Analysis

  • max time kernel
    143s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-10-2023 02:04

General

  • Target

    37a05f0402fb0ec7ef73e94924e06af497d80d79d9ec01824e4aa2a14d7cc0e0.exe

  • Size

    293KB

  • MD5

    a178fe15ebf9a19326d91ed3ad96e9d0

  • SHA1

    8b1f3fffdbf5bf5e790b08a64880596b15b590c1

  • SHA256

    37a05f0402fb0ec7ef73e94924e06af497d80d79d9ec01824e4aa2a14d7cc0e0

  • SHA512

    252eaa46ea80b0ca08471c7e73a34060f990cc1b33f35f762c1fb7358fd156c053e16a07339483fe0be5f5c94af1e49df042d6f9ff85da504c0653b351dbbbfe

  • SSDEEP

    3072:zqZwkRFuZlLi8x0CIBg3Lip5umjTWz+UFb0DRh1T8k5MU:2NRERi8d0MLaTWzZb0JM

Malware Config

Extracted

Family

tofsee

C2

vanaheim.cn

jotunheim.name

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Creates new service(s) 1 TTPs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 6 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\37a05f0402fb0ec7ef73e94924e06af497d80d79d9ec01824e4aa2a14d7cc0e0.exe
    "C:\Users\Admin\AppData\Local\Temp\37a05f0402fb0ec7ef73e94924e06af497d80d79d9ec01824e4aa2a14d7cc0e0.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3040
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\efqekqzt\
      2⤵
        PID:1060
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\wiylzyqu.exe" C:\Windows\SysWOW64\efqekqzt\
        2⤵
          PID:1224
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create efqekqzt binPath= "C:\Windows\SysWOW64\efqekqzt\wiylzyqu.exe /d\"C:\Users\Admin\AppData\Local\Temp\37a05f0402fb0ec7ef73e94924e06af497d80d79d9ec01824e4aa2a14d7cc0e0.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:1960
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description efqekqzt "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:4692
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start efqekqzt
          2⤵
          • Launches sc.exe
          PID:652
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:4860
      • C:\Windows\SysWOW64\efqekqzt\wiylzyqu.exe
        C:\Windows\SysWOW64\efqekqzt\wiylzyqu.exe /d"C:\Users\Admin\AppData\Local\Temp\37a05f0402fb0ec7ef73e94924e06af497d80d79d9ec01824e4aa2a14d7cc0e0.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3476
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          2⤵
          • Sets service image path in registry
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          PID:3336

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\wiylzyqu.exe

        Filesize

        14.1MB

        MD5

        b68582bffaddaa69799f8592b9c181b6

        SHA1

        abacb5e191da9a3e604af4cbd3ef757a1f62b0aa

        SHA256

        e4e8a94ceae7f1e350524ca8b428d1e9d414807ede4e8a2990e085e32dbcb775

        SHA512

        27159d6fb897095e52d1458fab20e9cdfcf6b3f10b106e74ad323c741544c08cafdc3f7189fb3cc17658a7d00c18c5eb18816157daa436d9f1e8396b483bb103

      • C:\Windows\SysWOW64\efqekqzt\wiylzyqu.exe

        Filesize

        14.1MB

        MD5

        b68582bffaddaa69799f8592b9c181b6

        SHA1

        abacb5e191da9a3e604af4cbd3ef757a1f62b0aa

        SHA256

        e4e8a94ceae7f1e350524ca8b428d1e9d414807ede4e8a2990e085e32dbcb775

        SHA512

        27159d6fb897095e52d1458fab20e9cdfcf6b3f10b106e74ad323c741544c08cafdc3f7189fb3cc17658a7d00c18c5eb18816157daa436d9f1e8396b483bb103

      • memory/3040-1-0x00000000025C0000-0x00000000026C0000-memory.dmp

        Filesize

        1024KB

      • memory/3040-2-0x00000000024F0000-0x0000000002503000-memory.dmp

        Filesize

        76KB

      • memory/3040-4-0x0000000000400000-0x000000000228F000-memory.dmp

        Filesize

        30.6MB

      • memory/3040-6-0x0000000000400000-0x000000000228F000-memory.dmp

        Filesize

        30.6MB

      • memory/3040-8-0x00000000024F0000-0x0000000002503000-memory.dmp

        Filesize

        76KB

      • memory/3336-42-0x0000000002570000-0x0000000002580000-memory.dmp

        Filesize

        64KB

      • memory/3336-36-0x0000000002570000-0x0000000002580000-memory.dmp

        Filesize

        64KB

      • memory/3336-15-0x0000000000EB0000-0x0000000000EC5000-memory.dmp

        Filesize

        84KB

      • memory/3336-56-0x00000000025F0000-0x00000000025F7000-memory.dmp

        Filesize

        28KB

      • memory/3336-55-0x0000000007F40000-0x000000000834B000-memory.dmp

        Filesize

        4.0MB

      • memory/3336-17-0x0000000000EB0000-0x0000000000EC5000-memory.dmp

        Filesize

        84KB

      • memory/3336-18-0x0000000000EB0000-0x0000000000EC5000-memory.dmp

        Filesize

        84KB

      • memory/3336-20-0x0000000000EB0000-0x0000000000EC5000-memory.dmp

        Filesize

        84KB

      • memory/3336-21-0x0000000002E00000-0x000000000300F000-memory.dmp

        Filesize

        2.1MB

      • memory/3336-24-0x0000000002E00000-0x000000000300F000-memory.dmp

        Filesize

        2.1MB

      • memory/3336-28-0x0000000002570000-0x0000000002580000-memory.dmp

        Filesize

        64KB

      • memory/3336-25-0x0000000002560000-0x0000000002566000-memory.dmp

        Filesize

        24KB

      • memory/3336-31-0x0000000002570000-0x0000000002580000-memory.dmp

        Filesize

        64KB

      • memory/3336-32-0x0000000002570000-0x0000000002580000-memory.dmp

        Filesize

        64KB

      • memory/3336-33-0x0000000002570000-0x0000000002580000-memory.dmp

        Filesize

        64KB

      • memory/3336-35-0x0000000002570000-0x0000000002580000-memory.dmp

        Filesize

        64KB

      • memory/3336-34-0x0000000002570000-0x0000000002580000-memory.dmp

        Filesize

        64KB

      • memory/3336-11-0x0000000000EB0000-0x0000000000EC5000-memory.dmp

        Filesize

        84KB

      • memory/3336-37-0x0000000002570000-0x0000000002580000-memory.dmp

        Filesize

        64KB

      • memory/3336-38-0x0000000002570000-0x0000000002580000-memory.dmp

        Filesize

        64KB

      • memory/3336-39-0x0000000002570000-0x0000000002580000-memory.dmp

        Filesize

        64KB

      • memory/3336-40-0x0000000002570000-0x0000000002580000-memory.dmp

        Filesize

        64KB

      • memory/3336-41-0x0000000002570000-0x0000000002580000-memory.dmp

        Filesize

        64KB

      • memory/3336-52-0x0000000007F40000-0x000000000834B000-memory.dmp

        Filesize

        4.0MB

      • memory/3336-43-0x0000000002570000-0x0000000002580000-memory.dmp

        Filesize

        64KB

      • memory/3336-44-0x0000000002570000-0x0000000002580000-memory.dmp

        Filesize

        64KB

      • memory/3336-45-0x0000000002570000-0x0000000002580000-memory.dmp

        Filesize

        64KB

      • memory/3336-46-0x0000000002570000-0x0000000002580000-memory.dmp

        Filesize

        64KB

      • memory/3336-47-0x0000000002570000-0x0000000002580000-memory.dmp

        Filesize

        64KB

      • memory/3336-48-0x00000000025E0000-0x00000000025E5000-memory.dmp

        Filesize

        20KB

      • memory/3336-51-0x00000000025E0000-0x00000000025E5000-memory.dmp

        Filesize

        20KB

      • memory/3476-10-0x0000000002430000-0x0000000002530000-memory.dmp

        Filesize

        1024KB

      • memory/3476-14-0x0000000000400000-0x000000000228F000-memory.dmp

        Filesize

        30.6MB

      • memory/3476-16-0x0000000000400000-0x000000000228F000-memory.dmp

        Filesize

        30.6MB