Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/11/2023, 14:44

General

  • Target

    49d338bc0aff700c861cea2620b98d673f0378a8c0813275722e08933bf0cf07_payload.bin.exe

  • Size

    71KB

  • MD5

    a050f3c88055b70ddf52d04747d4f527

  • SHA1

    3cc54919cb27b047127a1d14708794f0eeff5739

  • SHA256

    ca07ed841c430fedf79b2696148963cc5c5c989641e40aa34c022d4685e8ba3e

  • SHA512

    57ba537c2341dbe69265c808d829b12f1947f55c76bc7041bd55df5e74dc7b127d8090170d2fc31103ad0ac3de7ddac0135868ae043ff4a1a99e908431e2a1ad

  • SSDEEP

    1536:6kes21VCy1nTxSYg3CXTjFWL9ydpIHUc:6DVCyFxSYACXF3pI0

Malware Config

Extracted

Family

tofsee

C2

vanaheim.cn

jotunheim.name

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Creates new service(s) 1 TTPs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • GoLang User-Agent 3 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Modifies data under HKEY_USERS 7 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\49d338bc0aff700c861cea2620b98d673f0378a8c0813275722e08933bf0cf07_payload.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\49d338bc0aff700c861cea2620b98d673f0378a8c0813275722e08933bf0cf07_payload.bin.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:452
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\spjwmqzi\
      2⤵
        PID:4732
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\htjwkjbf.exe" C:\Windows\SysWOW64\spjwmqzi\
        2⤵
          PID:4460
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create spjwmqzi binPath= "C:\Windows\SysWOW64\spjwmqzi\htjwkjbf.exe /d\"C:\Users\Admin\AppData\Local\Temp\49d338bc0aff700c861cea2620b98d673f0378a8c0813275722e08933bf0cf07_payload.bin.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:4164
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description spjwmqzi "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:4112
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start spjwmqzi
          2⤵
          • Launches sc.exe
          PID:1548
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:2284
      • C:\Windows\SysWOW64\spjwmqzi\htjwkjbf.exe
        C:\Windows\SysWOW64\spjwmqzi\htjwkjbf.exe /d"C:\Users\Admin\AppData\Local\Temp\49d338bc0aff700c861cea2620b98d673f0378a8c0813275722e08933bf0cf07_payload.bin.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4808
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          2⤵
          • Sets service image path in registry
          • Deletes itself
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          PID:1420

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\htjwkjbf.exe

              Filesize

              10.6MB

              MD5

              9eef43d344e20403970cd9b723be93b0

              SHA1

              00c6d75f16b4d6cd71be69cccbee3744084a6bde

              SHA256

              365421204bbb80dd682bb2f81f9691fc7305e74295252767ad9d62e63e90b674

              SHA512

              28e57d5ae7545fe411264c72ca4f9d0c7c9693c5f5bdc8fdbb4f0d1201ecd5d3973aeb00e028653e27b8eea1a70d09a8fcfa214aad907b24a1e5424fb960f11f

            • C:\Windows\SysWOW64\spjwmqzi\htjwkjbf.exe

              Filesize

              10.6MB

              MD5

              9eef43d344e20403970cd9b723be93b0

              SHA1

              00c6d75f16b4d6cd71be69cccbee3744084a6bde

              SHA256

              365421204bbb80dd682bb2f81f9691fc7305e74295252767ad9d62e63e90b674

              SHA512

              28e57d5ae7545fe411264c72ca4f9d0c7c9693c5f5bdc8fdbb4f0d1201ecd5d3973aeb00e028653e27b8eea1a70d09a8fcfa214aad907b24a1e5424fb960f11f

            • memory/1420-3-0x0000000000900000-0x0000000000915000-memory.dmp

              Filesize

              84KB

            • memory/1420-7-0x0000000000900000-0x0000000000915000-memory.dmp

              Filesize

              84KB

            • memory/1420-8-0x0000000000900000-0x0000000000915000-memory.dmp

              Filesize

              84KB

            • memory/1420-10-0x0000000000900000-0x0000000000915000-memory.dmp

              Filesize

              84KB

            • memory/1420-11-0x0000000002600000-0x000000000280F000-memory.dmp

              Filesize

              2.1MB

            • memory/1420-14-0x0000000002600000-0x000000000280F000-memory.dmp

              Filesize

              2.1MB

            • memory/1420-15-0x0000000000B90000-0x0000000000B96000-memory.dmp

              Filesize

              24KB

            • memory/1420-18-0x0000000000BF0000-0x0000000000C00000-memory.dmp

              Filesize

              64KB

            • memory/1420-24-0x0000000000BF0000-0x0000000000C00000-memory.dmp

              Filesize

              64KB

            • memory/1420-23-0x0000000000BF0000-0x0000000000C00000-memory.dmp

              Filesize

              64KB

            • memory/1420-22-0x0000000000BF0000-0x0000000000C00000-memory.dmp

              Filesize

              64KB

            • memory/1420-21-0x0000000000BF0000-0x0000000000C00000-memory.dmp

              Filesize

              64KB

            • memory/1420-25-0x0000000000BF0000-0x0000000000C00000-memory.dmp

              Filesize

              64KB

            • memory/1420-26-0x0000000000BF0000-0x0000000000C00000-memory.dmp

              Filesize

              64KB

            • memory/1420-31-0x0000000000BF0000-0x0000000000C00000-memory.dmp

              Filesize

              64KB

            • memory/1420-30-0x0000000000BF0000-0x0000000000C00000-memory.dmp

              Filesize

              64KB

            • memory/1420-35-0x0000000000BF0000-0x0000000000C00000-memory.dmp

              Filesize

              64KB

            • memory/1420-34-0x0000000000BF0000-0x0000000000C00000-memory.dmp

              Filesize

              64KB

            • memory/1420-36-0x0000000000BF0000-0x0000000000C00000-memory.dmp

              Filesize

              64KB

            • memory/1420-37-0x0000000000BF0000-0x0000000000C00000-memory.dmp

              Filesize

              64KB

            • memory/1420-42-0x0000000007500000-0x000000000790B000-memory.dmp

              Filesize

              4.0MB

            • memory/1420-41-0x0000000001DE0000-0x0000000001DE5000-memory.dmp

              Filesize

              20KB

            • memory/1420-38-0x0000000001DE0000-0x0000000001DE5000-memory.dmp

              Filesize

              20KB

            • memory/1420-33-0x0000000000BF0000-0x0000000000C00000-memory.dmp

              Filesize

              64KB

            • memory/1420-32-0x0000000000BF0000-0x0000000000C00000-memory.dmp

              Filesize

              64KB

            • memory/1420-29-0x0000000000BF0000-0x0000000000C00000-memory.dmp

              Filesize

              64KB

            • memory/1420-28-0x0000000000BF0000-0x0000000000C00000-memory.dmp

              Filesize

              64KB

            • memory/1420-45-0x0000000007500000-0x000000000790B000-memory.dmp

              Filesize

              4.0MB

            • memory/1420-27-0x0000000000BF0000-0x0000000000C00000-memory.dmp

              Filesize

              64KB

            • memory/1420-46-0x0000000001DF0000-0x0000000001DF7000-memory.dmp

              Filesize

              28KB