Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231025-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/11/2023, 20:28

General

  • Target

    file.exe

  • Size

    253KB

  • MD5

    cc2a72f82d92baff8f3f98da48101ab4

  • SHA1

    e2377c18ce0858f84b50ac9317de81f15c196b8c

  • SHA256

    f8c2e197d36f46b8189a0e58d3afeabe154d523f406ac760a2b1797ca6ba1199

  • SHA512

    369ae41f47dbb81fd7a0afb2504aadf2713b887a6c424c63a5cb7b7ceda28cae1eef4fa1c005fa33cde8ec0c93d51f8cfb25aaa0ec0039cc2277b9160e491e7f

  • SSDEEP

    3072:HFRhzXDDoLnJJDCEtGKL+5mDyHZMctBDnuUY7yHjP4q5XWtlV1f:lRhzXPoLnvDPtGE6gyHdtfYmHj3WpV

Malware Config

Extracted

Family

tofsee

C2

vanaheim.cn

jotunheim.name

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Creates new service(s) 1 TTPs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Modifies data under HKEY_USERS 7 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2592
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\xxisvlqq\
      2⤵
        PID:4040
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\brroamca.exe" C:\Windows\SysWOW64\xxisvlqq\
        2⤵
          PID:4712
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create xxisvlqq binPath= "C:\Windows\SysWOW64\xxisvlqq\brroamca.exe /d\"C:\Users\Admin\AppData\Local\Temp\file.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:2408
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description xxisvlqq "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:4340
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start xxisvlqq
          2⤵
          • Launches sc.exe
          PID:560
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:2312
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 1164
          2⤵
          • Program crash
          PID:3548
      • C:\Windows\SysWOW64\xxisvlqq\brroamca.exe
        C:\Windows\SysWOW64\xxisvlqq\brroamca.exe /d"C:\Users\Admin\AppData\Local\Temp\file.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:5020
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          2⤵
          • Sets service image path in registry
          • Deletes itself
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          PID:3540
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 524
          2⤵
          • Program crash
          PID:4400
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2592 -ip 2592
        1⤵
          PID:2068
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5020 -ip 5020
          1⤵
            PID:1144

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\brroamca.exe

                  Filesize

                  14.4MB

                  MD5

                  e460d14561c60f1a3b93893d91182096

                  SHA1

                  3d0dae8423f8884eb703e6ba90a82c8c25c37bfe

                  SHA256

                  977a9fc34573360c4af0ec09ae93b13206c42e712e9d52d65fe1fdf80d5f1a4f

                  SHA512

                  9191926f52719569f9f52b1c171d7e08f99b18258dfd639347e862be4f43c4edf2b1f7c3dc3e6bfd16e95d96a4e940b4ccf5cdf0a39c91ad9d4f926b6f9d9559

                • C:\Windows\SysWOW64\xxisvlqq\brroamca.exe

                  Filesize

                  14.4MB

                  MD5

                  e460d14561c60f1a3b93893d91182096

                  SHA1

                  3d0dae8423f8884eb703e6ba90a82c8c25c37bfe

                  SHA256

                  977a9fc34573360c4af0ec09ae93b13206c42e712e9d52d65fe1fdf80d5f1a4f

                  SHA512

                  9191926f52719569f9f52b1c171d7e08f99b18258dfd639347e862be4f43c4edf2b1f7c3dc3e6bfd16e95d96a4e940b4ccf5cdf0a39c91ad9d4f926b6f9d9559

                • memory/2592-14-0x0000000000400000-0x00000000004F3000-memory.dmp

                  Filesize

                  972KB

                • memory/2592-2-0x00000000006A0000-0x00000000006B3000-memory.dmp

                  Filesize

                  76KB

                • memory/2592-3-0x0000000000400000-0x00000000004F3000-memory.dmp

                  Filesize

                  972KB

                • memory/2592-1-0x0000000000770000-0x0000000000870000-memory.dmp

                  Filesize

                  1024KB

                • memory/2592-15-0x0000000000770000-0x0000000000870000-memory.dmp

                  Filesize

                  1024KB

                • memory/3540-33-0x00000000017E0000-0x00000000017F0000-memory.dmp

                  Filesize

                  64KB

                • memory/3540-37-0x00000000017E0000-0x00000000017F0000-memory.dmp

                  Filesize

                  64KB

                • memory/3540-57-0x00000000025D0000-0x00000000025D7000-memory.dmp

                  Filesize

                  28KB

                • memory/3540-56-0x0000000007040000-0x000000000744B000-memory.dmp

                  Filesize

                  4.0MB

                • memory/3540-16-0x0000000000450000-0x0000000000465000-memory.dmp

                  Filesize

                  84KB

                • memory/3540-18-0x0000000000450000-0x0000000000465000-memory.dmp

                  Filesize

                  84KB

                • memory/3540-19-0x0000000000450000-0x0000000000465000-memory.dmp

                  Filesize

                  84KB

                • memory/3540-21-0x0000000000450000-0x0000000000465000-memory.dmp

                  Filesize

                  84KB

                • memory/3540-22-0x0000000002000000-0x000000000220F000-memory.dmp

                  Filesize

                  2.1MB

                • memory/3540-25-0x0000000002000000-0x000000000220F000-memory.dmp

                  Filesize

                  2.1MB

                • memory/3540-26-0x00000000009F0000-0x00000000009F6000-memory.dmp

                  Filesize

                  24KB

                • memory/3540-29-0x00000000017E0000-0x00000000017F0000-memory.dmp

                  Filesize

                  64KB

                • memory/3540-32-0x00000000017E0000-0x00000000017F0000-memory.dmp

                  Filesize

                  64KB

                • memory/3540-9-0x0000000000450000-0x0000000000465000-memory.dmp

                  Filesize

                  84KB

                • memory/3540-34-0x00000000017E0000-0x00000000017F0000-memory.dmp

                  Filesize

                  64KB

                • memory/3540-35-0x00000000017E0000-0x00000000017F0000-memory.dmp

                  Filesize

                  64KB

                • memory/3540-36-0x00000000017E0000-0x00000000017F0000-memory.dmp

                  Filesize

                  64KB

                • memory/3540-53-0x0000000007040000-0x000000000744B000-memory.dmp

                  Filesize

                  4.0MB

                • memory/3540-38-0x00000000017E0000-0x00000000017F0000-memory.dmp

                  Filesize

                  64KB

                • memory/3540-40-0x00000000017E0000-0x00000000017F0000-memory.dmp

                  Filesize

                  64KB

                • memory/3540-41-0x00000000017E0000-0x00000000017F0000-memory.dmp

                  Filesize

                  64KB

                • memory/3540-39-0x00000000017E0000-0x00000000017F0000-memory.dmp

                  Filesize

                  64KB

                • memory/3540-42-0x00000000017E0000-0x00000000017F0000-memory.dmp

                  Filesize

                  64KB

                • memory/3540-43-0x00000000017E0000-0x00000000017F0000-memory.dmp

                  Filesize

                  64KB

                • memory/3540-44-0x00000000017E0000-0x00000000017F0000-memory.dmp

                  Filesize

                  64KB

                • memory/3540-45-0x00000000017E0000-0x00000000017F0000-memory.dmp

                  Filesize

                  64KB

                • memory/3540-46-0x00000000017E0000-0x00000000017F0000-memory.dmp

                  Filesize

                  64KB

                • memory/3540-47-0x00000000017E0000-0x00000000017F0000-memory.dmp

                  Filesize

                  64KB

                • memory/3540-48-0x00000000017E0000-0x00000000017F0000-memory.dmp

                  Filesize

                  64KB

                • memory/3540-49-0x00000000017F0000-0x00000000017F5000-memory.dmp

                  Filesize

                  20KB

                • memory/3540-52-0x00000000017F0000-0x00000000017F5000-memory.dmp

                  Filesize

                  20KB

                • memory/5020-12-0x0000000000400000-0x00000000004F3000-memory.dmp

                  Filesize

                  972KB

                • memory/5020-10-0x0000000000760000-0x0000000000773000-memory.dmp

                  Filesize

                  76KB

                • memory/5020-8-0x00000000007E0000-0x00000000008E0000-memory.dmp

                  Filesize

                  1024KB