Analysis

  • max time kernel
    142s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    17-04-2024 13:32

General

  • Target

    e3cb143065ee2414007182694ceedcba541b748825eeae851eb395a24bd08053.exe

  • Size

    312KB

  • MD5

    2b41691ddeb229f6f01acd6f557cc319

  • SHA1

    104ec7b54ccd78b246fda9fd6cb73126f900dd96

  • SHA256

    e3cb143065ee2414007182694ceedcba541b748825eeae851eb395a24bd08053

  • SHA512

    f93a8141e145b21c1d07a93daa7685ff5916750d49119b3d1b5fbdc3e5727f1e7f7b0918a77d7ec49a3f8b478fe018bd1f0880c264a60e25b424d9abcb24698d

  • SSDEEP

    6144:pEE79GITkewAx4JkbdmdT7xJCsUuBT9p69a:pFGekTAx42h8TrCMB5II

Malware Config

Extracted

Family

tofsee

C2

vanaheim.cn

jotunheim.name

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs 1 IoCs
  • Creates new service(s) 1 TTPs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 3 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e3cb143065ee2414007182694ceedcba541b748825eeae851eb395a24bd08053.exe
    "C:\Users\Admin\AppData\Local\Temp\e3cb143065ee2414007182694ceedcba541b748825eeae851eb395a24bd08053.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2148
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\hvijsltw\
      2⤵
        PID:2200
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\yokzumks.exe" C:\Windows\SysWOW64\hvijsltw\
        2⤵
          PID:1996
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create hvijsltw binPath= "C:\Windows\SysWOW64\hvijsltw\yokzumks.exe /d\"C:\Users\Admin\AppData\Local\Temp\e3cb143065ee2414007182694ceedcba541b748825eeae851eb395a24bd08053.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:3000
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description hvijsltw "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:2568
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start hvijsltw
          2⤵
          • Launches sc.exe
          PID:2696
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:2552
      • C:\Windows\SysWOW64\hvijsltw\yokzumks.exe
        C:\Windows\SysWOW64\hvijsltw\yokzumks.exe /d"C:\Users\Admin\AppData\Local\Temp\e3cb143065ee2414007182694ceedcba541b748825eeae851eb395a24bd08053.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2688
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          2⤵
          • Windows security bypass
          • Sets service image path in registry
          • Deletes itself
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          PID:2456

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\yokzumks.exe
        Filesize

        10.5MB

        MD5

        a1dd427d777917ed4954772fb26aebe4

        SHA1

        5b4cb91d2a2eed098ba0bcbe22ff9ec3b4fe1a5e

        SHA256

        1321c5dc93ef4db157ac0b75f7e6760a2ed9c68ed895db84d84d57f9356da6f6

        SHA512

        43d383a266c713cdbb4ac3422803a8e1ad21d8a3877b1118f556a91646c656703ad03978dac39d27767a763c8fa2a6ebdf4a5e3833206cd282f5608fa7ae7b8c

      • memory/2148-2-0x00000000008F0000-0x00000000009F0000-memory.dmp
        Filesize

        1024KB

      • memory/2148-3-0x0000000000220000-0x0000000000233000-memory.dmp
        Filesize

        76KB

      • memory/2148-4-0x0000000000400000-0x00000000007D7000-memory.dmp
        Filesize

        3.8MB

      • memory/2148-7-0x0000000000400000-0x00000000007D7000-memory.dmp
        Filesize

        3.8MB

      • memory/2148-8-0x00000000008F0000-0x00000000009F0000-memory.dmp
        Filesize

        1024KB

      • memory/2456-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
        Filesize

        4KB

      • memory/2456-11-0x0000000000080000-0x0000000000095000-memory.dmp
        Filesize

        84KB

      • memory/2456-15-0x0000000000080000-0x0000000000095000-memory.dmp
        Filesize

        84KB

      • memory/2456-20-0x0000000000080000-0x0000000000095000-memory.dmp
        Filesize

        84KB

      • memory/2456-21-0x0000000000080000-0x0000000000095000-memory.dmp
        Filesize

        84KB

      • memory/2456-23-0x0000000000080000-0x0000000000095000-memory.dmp
        Filesize

        84KB

      • memory/2688-13-0x0000000000400000-0x00000000007D7000-memory.dmp
        Filesize

        3.8MB

      • memory/2688-10-0x00000000009A0000-0x0000000000AA0000-memory.dmp
        Filesize

        1024KB

      • memory/2688-16-0x0000000000400000-0x00000000007D7000-memory.dmp
        Filesize

        3.8MB