tofsee | b1a851f826af5c5668645413fb6d9310476c40d9fe5000f9ff3f26ce31997c4f

General

Target

f0341ec61c2cd41911abdbf9c0470592.exe
Size

13.4MB
MD5

f0341ec61c2cd41911abdbf9c0470592
SHA1

4f71295793b5dec415afa6b516a16fb65cd0ad9a
SHA256

b1a851f826af5c5668645413fb6d9310476c40d9fe5000f9ff3f26ce31997c4f
SHA512

c6ab6ffed2ff286cc3f043c3df2eb3c8778d96896b8a7484ec677d528998f24c023da01f8ad791bc26807eae4fecbf5cc4b0bcf5b12adf86dafde9e58ebc486f

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Creates new service(s) 1 TTPs
persistence

New Service
T1050
Executes dropped EXE 1 IoCs

Processes:

sftwyywj.exe

pid process

1948 sftwyywj.exe
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112
Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

1856 svchost.exe
Drops file in System32 directory 1 IoCs

Processes:

svchost.exe

description ioc process

File created C:\Windows\SysWOW64\config\systemprofile:.repos svchost.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

sftwyywj.exe

description pid process target process

PID 1948 set thread context of 1856 1948 sftwyywj.exe svchost.exe
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.

pid	process
1948	sftwyywj.exe

pid	process
1856	svchost.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile:.repos	svchost.exe

description	pid	process	target process
PID 1948 set thread context of 1856	1948	sftwyywj.exe	svchost.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Buses	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\Buses\Config0 = c4eca73d91b6c50524edb47d450dd49d084297dce82e72baa46d34fdc48d541d9af0e1ab87cd945d24edb47d470dd49d024195daf71261adc06d04fda6e22673bbc9154961cda5691cdc834e713de1aa644490bdbc7427ec965f02cffc8d3c74bbc4103d29fca26912d8844a743be39d084295d9e13f4bb4c06d06fdadfd5425d29d470d32f5a06f249ec60b1b79bdf0012dc58dbd7d26e5905c05c9c4e13b7e85c12b496da0f15d15d98c4c733ee1ad521cf459a4cf144bdf3c6cfdc48d541ce4ad744a6bbfff02579fc27d440dd49d642df45b9c4e6998a46d34fdc741461ee4ad743c3cf8ba6c15d99a4c7739faa55c2df4bd844d14dda46d34fdc48d541de4ad743d04cd945d24edb47d440dd49d642df4bd844d14dda46d34fdc48d541de4ad743de0cc945d	svchost.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

f0341ec61c2cd41911abdbf9c0470592.exesftwyywj.exe

description	pid	process	target process
PID 4760 wrote to memory of 3392	4760	f0341ec61c2cd41911abdbf9c0470592.exe	cmd.exe
PID 4760 wrote to memory of 3392	4760	f0341ec61c2cd41911abdbf9c0470592.exe	cmd.exe
PID 4760 wrote to memory of 3392	4760	f0341ec61c2cd41911abdbf9c0470592.exe	cmd.exe
PID 4760 wrote to memory of 4276	4760	f0341ec61c2cd41911abdbf9c0470592.exe	cmd.exe
PID 4760 wrote to memory of 4276	4760	f0341ec61c2cd41911abdbf9c0470592.exe	cmd.exe
PID 4760 wrote to memory of 4276	4760	f0341ec61c2cd41911abdbf9c0470592.exe	cmd.exe
PID 4760 wrote to memory of 768	4760	f0341ec61c2cd41911abdbf9c0470592.exe	sc.exe
PID 4760 wrote to memory of 768	4760	f0341ec61c2cd41911abdbf9c0470592.exe	sc.exe
PID 4760 wrote to memory of 768	4760	f0341ec61c2cd41911abdbf9c0470592.exe	sc.exe
PID 4760 wrote to memory of 3820	4760	f0341ec61c2cd41911abdbf9c0470592.exe	sc.exe
PID 4760 wrote to memory of 3820	4760	f0341ec61c2cd41911abdbf9c0470592.exe	sc.exe
PID 4760 wrote to memory of 3820	4760	f0341ec61c2cd41911abdbf9c0470592.exe	sc.exe
PID 4760 wrote to memory of 4072	4760	f0341ec61c2cd41911abdbf9c0470592.exe	sc.exe
PID 4760 wrote to memory of 4072	4760	f0341ec61c2cd41911abdbf9c0470592.exe	sc.exe
PID 4760 wrote to memory of 4072	4760	f0341ec61c2cd41911abdbf9c0470592.exe	sc.exe
PID 1948 wrote to memory of 1856	1948	sftwyywj.exe	svchost.exe
PID 1948 wrote to memory of 1856	1948	sftwyywj.exe	svchost.exe
PID 1948 wrote to memory of 1856	1948	sftwyywj.exe	svchost.exe
PID 1948 wrote to memory of 1856	1948	sftwyywj.exe	svchost.exe
PID 1948 wrote to memory of 1856	1948	sftwyywj.exe	svchost.exe
PID 4760 wrote to memory of 4484	4760	f0341ec61c2cd41911abdbf9c0470592.exe	netsh.exe
PID 4760 wrote to memory of 4484	4760	f0341ec61c2cd41911abdbf9c0470592.exe	netsh.exe
PID 4760 wrote to memory of 4484	4760	f0341ec61c2cd41911abdbf9c0470592.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\f0341ec61c2cd41911abdbf9c0470592.exe
"C:\Users\Admin\AppData\Local\Temp\f0341ec61c2cd41911abdbf9c0470592.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4760

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ubnstdar\
2⤵
PID:3392

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\sftwyywj.exe" C:\Windows\SysWOW64\ubnstdar\
2⤵
PID:4276

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create ubnstdar binPath= "C:\Windows\SysWOW64\ubnstdar\sftwyywj.exe /d\"C:\Users\Admin\AppData\Local\Temp\f0341ec61c2cd41911abdbf9c0470592.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
PID:768

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description ubnstdar "wifi internet conection"
2⤵
PID:3820

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start ubnstdar
2⤵
PID:4072

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
PID:4484

C:\Windows\SysWOW64\ubnstdar\sftwyywj.exe
C:\Windows\SysWOW64\ubnstdar\sftwyywj.exe /d"C:\Users\Admin\AppData\Local\Temp\f0341ec61c2cd41911abdbf9c0470592.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1948

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Deletes itself
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1856

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

New Service

1

T1050

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

New Service

1

T1050

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\sftwyywj.exe
MD5
b403d4bfd66466980c2d5b18d46c2d4e

SHA1
c917f53b653f0951d81ed927871a146ad49c1299

SHA256
dff884f873d161bff04535442a9a0780cbd0d8f10be785b9660954ab28a963bf

SHA512
523b240dd0f6fa34dec382e242eb80b9ac1d889ed111afc6eeae2c54994231bd7156dcf326f01eaf4742e1e78f51f8810bdd12c25efa2438f34120a3fc6077f4

Download Submit
C:\Windows\SysWOW64\ubnstdar\sftwyywj.exe
MD5
b403d4bfd66466980c2d5b18d46c2d4e

SHA1
c917f53b653f0951d81ed927871a146ad49c1299

SHA256
dff884f873d161bff04535442a9a0780cbd0d8f10be785b9660954ab28a963bf

SHA512
523b240dd0f6fa34dec382e242eb80b9ac1d889ed111afc6eeae2c54994231bd7156dcf326f01eaf4742e1e78f51f8810bdd12c25efa2438f34120a3fc6077f4

Download Submit
memory/768-5-0x0000000000000000-mapping.dmp

Download
memory/1856-9-0x0000000000810000-0x0000000000825000-memory.dmp

Filesize
84KB

Download
memory/1856-10-0x0000000000819A6B-mapping.dmp

Download
memory/3392-2-0x0000000000000000-mapping.dmp

Download
memory/3820-6-0x0000000000000000-mapping.dmp

Download
memory/4072-7-0x0000000000000000-mapping.dmp

Download
memory/4276-3-0x0000000000000000-mapping.dmp

Download
memory/4484-12-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing