Analysis

  • max time kernel
    145s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-04-2024 13:18

General

  • Target

    c9ba75c3c2b17dd64211ae2d9859ced46f797f4f25d867c63c813462a857b524.exe

  • Size

    203KB

  • MD5

    90d047019c018e2188352f9aeee97192

  • SHA1

    e0d7eee14e19ddb119760d4e15e387f285d82076

  • SHA256

    c9ba75c3c2b17dd64211ae2d9859ced46f797f4f25d867c63c813462a857b524

  • SHA512

    4aa2fa4f364a398cb763cbd317ea91dbac17e9e5ed44e5ebe09ba16e62cedb588d98ad807adb84127b00c757bcfef31f229aed5294a71ce682ef494da558b5a7

  • SSDEEP

    3072:DkIfnM3Jq/AmlEkJiAj1K/2sv1p6Ti/ZVqJnctmLoQCCRLQ+cmk:DkIzXlEh5VqKtm8CXcL

Malware Config

Extracted

Family

tofsee

C2

vanaheim.cn

jotunheim.name

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Creates new service(s) 1 TTPs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Modifies data under HKEY_USERS 7 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c9ba75c3c2b17dd64211ae2d9859ced46f797f4f25d867c63c813462a857b524.exe
    "C:\Users\Admin\AppData\Local\Temp\c9ba75c3c2b17dd64211ae2d9859ced46f797f4f25d867c63c813462a857b524.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:6096
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\xrfimgiw\
      2⤵
        PID:2132
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\gsaxdqwu.exe" C:\Windows\SysWOW64\xrfimgiw\
        2⤵
          PID:4084
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create xrfimgiw binPath= "C:\Windows\SysWOW64\xrfimgiw\gsaxdqwu.exe /d\"C:\Users\Admin\AppData\Local\Temp\c9ba75c3c2b17dd64211ae2d9859ced46f797f4f25d867c63c813462a857b524.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:3988
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description xrfimgiw "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:6112
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start xrfimgiw
          2⤵
          • Launches sc.exe
          PID:3984
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:4980
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 6096 -s 1048
          2⤵
          • Program crash
          PID:392
      • C:\Windows\SysWOW64\xrfimgiw\gsaxdqwu.exe
        C:\Windows\SysWOW64\xrfimgiw\gsaxdqwu.exe /d"C:\Users\Admin\AppData\Local\Temp\c9ba75c3c2b17dd64211ae2d9859ced46f797f4f25d867c63c813462a857b524.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1840
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          2⤵
          • Sets service image path in registry
          • Deletes itself
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          PID:5056
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 520
          2⤵
          • Program crash
          PID:2436
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1840 -ip 1840
        1⤵
          PID:5656
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 6096 -ip 6096
          1⤵
            PID:5048

          Network

          MITRE ATT&CK Matrix ATT&CK v13

          Persistence

          Create or Modify System Process

          2
          T1543

          Windows Service

          2
          T1543.003

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Privilege Escalation

          Create or Modify System Process

          2
          T1543

          Windows Service

          2
          T1543.003

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Defense Evasion

          Impair Defenses

          1
          T1562

          Disable or Modify System Firewall

          1
          T1562.004

          Modify Registry

          1
          T1112

          Discovery

          Query Registry

          1
          T1012

          System Information Discovery

          2
          T1082

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\gsaxdqwu.exe
            Filesize

            13.3MB

            MD5

            72e65c896b4d44efb96e2016c8eef7fa

            SHA1

            68176f3edba5ae73189379eb6ea2332300cfe948

            SHA256

            ee49a64f7ef30f5ec127c524ba90573f567abce422718da5c96c132ddc115b91

            SHA512

            95af4cc9cc101048559e56b6c9a7f34487ba050cea7310321668049611f6687bc13dbdc92ba5182010dcce8ca90898411788d9ca594397fae704f32d78a4d2af

          • memory/1840-9-0x0000000000590000-0x00000000005A3000-memory.dmp
            Filesize

            76KB

          • memory/1840-15-0x0000000000400000-0x0000000000438000-memory.dmp
            Filesize

            224KB

          • memory/1840-10-0x0000000000400000-0x0000000000438000-memory.dmp
            Filesize

            224KB

          • memory/1840-8-0x0000000000600000-0x0000000000700000-memory.dmp
            Filesize

            1024KB

          • memory/5056-50-0x0000000002FD0000-0x0000000002FD5000-memory.dmp
            Filesize

            20KB

          • memory/5056-34-0x0000000002170000-0x0000000002180000-memory.dmp
            Filesize

            64KB

          • memory/5056-11-0x0000000000BC0000-0x0000000000BD5000-memory.dmp
            Filesize

            84KB

          • memory/5056-14-0x0000000000BC0000-0x0000000000BD5000-memory.dmp
            Filesize

            84KB

          • memory/5056-59-0x0000000000BC0000-0x0000000000BD5000-memory.dmp
            Filesize

            84KB

          • memory/5056-55-0x0000000002FE0000-0x0000000002FE7000-memory.dmp
            Filesize

            28KB

          • memory/5056-17-0x0000000000BC0000-0x0000000000BD5000-memory.dmp
            Filesize

            84KB

          • memory/5056-18-0x0000000000BC0000-0x0000000000BD5000-memory.dmp
            Filesize

            84KB

          • memory/5056-20-0x0000000002A00000-0x0000000002C0F000-memory.dmp
            Filesize

            2.1MB

          • memory/5056-23-0x0000000002A00000-0x0000000002C0F000-memory.dmp
            Filesize

            2.1MB

          • memory/5056-24-0x0000000002160000-0x0000000002166000-memory.dmp
            Filesize

            24KB

          • memory/5056-27-0x0000000002170000-0x0000000002180000-memory.dmp
            Filesize

            64KB

          • memory/5056-30-0x0000000002170000-0x0000000002180000-memory.dmp
            Filesize

            64KB

          • memory/5056-33-0x0000000002170000-0x0000000002180000-memory.dmp
            Filesize

            64KB

          • memory/5056-36-0x0000000002170000-0x0000000002180000-memory.dmp
            Filesize

            64KB

          • memory/5056-35-0x0000000002170000-0x0000000002180000-memory.dmp
            Filesize

            64KB

          • memory/5056-37-0x0000000002170000-0x0000000002180000-memory.dmp
            Filesize

            64KB

          • memory/5056-54-0x0000000007980000-0x0000000007D8B000-memory.dmp
            Filesize

            4.0MB

          • memory/5056-32-0x0000000002170000-0x0000000002180000-memory.dmp
            Filesize

            64KB

          • memory/5056-31-0x0000000002170000-0x0000000002180000-memory.dmp
            Filesize

            64KB

          • memory/5056-38-0x0000000002170000-0x0000000002180000-memory.dmp
            Filesize

            64KB

          • memory/5056-39-0x0000000002170000-0x0000000002180000-memory.dmp
            Filesize

            64KB

          • memory/5056-40-0x0000000002170000-0x0000000002180000-memory.dmp
            Filesize

            64KB

          • memory/5056-45-0x0000000002170000-0x0000000002180000-memory.dmp
            Filesize

            64KB

          • memory/5056-51-0x0000000007980000-0x0000000007D8B000-memory.dmp
            Filesize

            4.0MB

          • memory/5056-41-0x0000000002170000-0x0000000002180000-memory.dmp
            Filesize

            64KB

          • memory/5056-47-0x0000000002FD0000-0x0000000002FD5000-memory.dmp
            Filesize

            20KB

          • memory/5056-46-0x0000000002170000-0x0000000002180000-memory.dmp
            Filesize

            64KB

          • memory/5056-44-0x0000000002170000-0x0000000002180000-memory.dmp
            Filesize

            64KB

          • memory/5056-43-0x0000000002170000-0x0000000002180000-memory.dmp
            Filesize

            64KB

          • memory/5056-42-0x0000000002170000-0x0000000002180000-memory.dmp
            Filesize

            64KB

          • memory/6096-1-0x00000000004B0000-0x00000000005B0000-memory.dmp
            Filesize

            1024KB

          • memory/6096-4-0x0000000000400000-0x0000000000438000-memory.dmp
            Filesize

            224KB

          • memory/6096-16-0x0000000000400000-0x0000000000438000-memory.dmp
            Filesize

            224KB

          • memory/6096-2-0x00000000005F0000-0x0000000000603000-memory.dmp
            Filesize

            76KB