Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    05-09-2024 16:05

General

  • Target

    2ceb7d489e52c22b3400be1033d415d48f46548940e9519bf23ce3053d8a0a07.exe

  • Size

    399KB

  • MD5

    0739f44be0a711a02242bd37e1794796

  • SHA1

    7bc1505e740bc2f926cd72ab55615b9dc070ac5b

  • SHA256

    2ceb7d489e52c22b3400be1033d415d48f46548940e9519bf23ce3053d8a0a07

  • SHA512

    f23776894833937c752c161033295450f5a0b7a01f4454e4e96bac05a09193b2a2facb0287f5f7ff8dd1bd49e7f8172311b8401cb9b1986aafb73c9730f337b0

  • SSDEEP

    6144:f89I3KfShUDe2hAI+WBO5sIBdwWBCA+HO3njSRw:f89I3KfShUDMIRBSCLHO+

Malware Config

Extracted

Family

tofsee

C2

vanaheim.cn

jotunheim.name

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Creates new service(s) 2 TTPs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 7 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2ceb7d489e52c22b3400be1033d415d48f46548940e9519bf23ce3053d8a0a07.exe
    "C:\Users\Admin\AppData\Local\Temp\2ceb7d489e52c22b3400be1033d415d48f46548940e9519bf23ce3053d8a0a07.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4844
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\drvirona\
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4908
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\rlqojmjl.exe" C:\Windows\SysWOW64\drvirona\
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4020
    • C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" create drvirona binPath= "C:\Windows\SysWOW64\drvirona\rlqojmjl.exe /d\"C:\Users\Admin\AppData\Local\Temp\2ceb7d489e52c22b3400be1033d415d48f46548940e9519bf23ce3053d8a0a07.exe\"" type= own start= auto DisplayName= "wifi support"
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:2576
    • C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" description drvirona "wifi internet conection"
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:540
    • C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" start drvirona
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:4112
    • C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:1892
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 1092
      2⤵
      • Program crash
      PID:1416
  • C:\Windows\SysWOW64\drvirona\rlqojmjl.exe
    C:\Windows\SysWOW64\drvirona\rlqojmjl.exe /d"C:\Users\Admin\AppData\Local\Temp\2ceb7d489e52c22b3400be1033d415d48f46548940e9519bf23ce3053d8a0a07.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1572
    • C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      2⤵
      • Sets service image path in registry
      • Deletes itself
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      PID:4152
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4844 -ip 4844
    1⤵
      PID:4600

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\rlqojmjl.exe

      Filesize

      14.4MB

      MD5

      f092f3e4154d2a783dd67213c4026a22

      SHA1

      349b129674dbd777f569c405b300ac31fac92b0c

      SHA256

      9eea2b1769a7b20644a86c2fa6bacd725a683cc49d9db073c5b56fa5dc172b67

      SHA512

      6cd44013f2208f9003c6f72adf2bc1e48b4d616ff8ef97dba58989b5169203d37c7071c9a78fa6c81a68203427f4298cc54f9e7ec3a6dc31935bde74f9ff52f4

    • memory/1572-10-0x0000000000400000-0x00000000005F8000-memory.dmp

      Filesize

      2.0MB

    • memory/1572-15-0x0000000000400000-0x00000000005F8000-memory.dmp

      Filesize

      2.0MB

    • memory/1572-9-0x0000000000400000-0x00000000005F8000-memory.dmp

      Filesize

      2.0MB

    • memory/1572-8-0x0000000000400000-0x00000000005F8000-memory.dmp

      Filesize

      2.0MB

    • memory/4152-41-0x0000000003110000-0x0000000003120000-memory.dmp

      Filesize

      64KB

    • memory/4152-46-0x0000000003110000-0x0000000003120000-memory.dmp

      Filesize

      64KB

    • memory/4152-58-0x00000000033F0000-0x00000000033F7000-memory.dmp

      Filesize

      28KB

    • memory/4152-14-0x0000000000F80000-0x0000000000F95000-memory.dmp

      Filesize

      84KB

    • memory/4152-11-0x0000000000F80000-0x0000000000F95000-memory.dmp

      Filesize

      84KB

    • memory/4152-26-0x0000000002E00000-0x000000000300F000-memory.dmp

      Filesize

      2.1MB

    • memory/4152-27-0x00000000013F0000-0x00000000013F6000-memory.dmp

      Filesize

      24KB

    • memory/4152-30-0x0000000003110000-0x0000000003120000-memory.dmp

      Filesize

      64KB

    • memory/4152-19-0x0000000000F80000-0x0000000000F95000-memory.dmp

      Filesize

      84KB

    • memory/4152-20-0x0000000000F80000-0x0000000000F95000-memory.dmp

      Filesize

      84KB

    • memory/4152-22-0x0000000000F80000-0x0000000000F95000-memory.dmp

      Filesize

      84KB

    • memory/4152-47-0x0000000003110000-0x0000000003120000-memory.dmp

      Filesize

      64KB

    • memory/4152-24-0x0000000002E00000-0x000000000300F000-memory.dmp

      Filesize

      2.1MB

    • memory/4152-54-0x0000000007E00000-0x000000000820B000-memory.dmp

      Filesize

      4.0MB

    • memory/4152-57-0x0000000007E00000-0x000000000820B000-memory.dmp

      Filesize

      4.0MB

    • memory/4152-53-0x00000000033E0000-0x00000000033E5000-memory.dmp

      Filesize

      20KB

    • memory/4152-50-0x00000000033E0000-0x00000000033E5000-memory.dmp

      Filesize

      20KB

    • memory/4152-49-0x0000000003110000-0x0000000003120000-memory.dmp

      Filesize

      64KB

    • memory/4152-48-0x0000000003110000-0x0000000003120000-memory.dmp

      Filesize

      64KB

    • memory/4152-33-0x0000000003110000-0x0000000003120000-memory.dmp

      Filesize

      64KB

    • memory/4152-44-0x0000000003110000-0x0000000003120000-memory.dmp

      Filesize

      64KB

    • memory/4152-45-0x0000000003110000-0x0000000003120000-memory.dmp

      Filesize

      64KB

    • memory/4152-43-0x0000000003110000-0x0000000003120000-memory.dmp

      Filesize

      64KB

    • memory/4152-42-0x0000000003110000-0x0000000003120000-memory.dmp

      Filesize

      64KB

    • memory/4152-40-0x0000000003110000-0x0000000003120000-memory.dmp

      Filesize

      64KB

    • memory/4152-34-0x0000000003110000-0x0000000003120000-memory.dmp

      Filesize

      64KB

    • memory/4152-39-0x0000000003110000-0x0000000003120000-memory.dmp

      Filesize

      64KB

    • memory/4152-38-0x0000000003110000-0x0000000003120000-memory.dmp

      Filesize

      64KB

    • memory/4152-37-0x0000000003110000-0x0000000003120000-memory.dmp

      Filesize

      64KB

    • memory/4152-36-0x0000000003110000-0x0000000003120000-memory.dmp

      Filesize

      64KB

    • memory/4152-35-0x0000000003110000-0x0000000003120000-memory.dmp

      Filesize

      64KB

    • memory/4844-1-0x0000000000840000-0x0000000000940000-memory.dmp

      Filesize

      1024KB

    • memory/4844-3-0x0000000000400000-0x0000000000415000-memory.dmp

      Filesize

      84KB

    • memory/4844-16-0x0000000000400000-0x00000000005F8000-memory.dmp

      Filesize

      2.0MB

    • memory/4844-17-0x0000000000820000-0x0000000000833000-memory.dmp

      Filesize

      76KB

    • memory/4844-18-0x0000000000400000-0x0000000000415000-memory.dmp

      Filesize

      84KB

    • memory/4844-2-0x0000000000820000-0x0000000000833000-memory.dmp

      Filesize

      76KB