tofsee | 5cc29d4752c32a15d1c93abd02fe1cbcc525684f4fb9f10e3ad517f67b06fc80

General

Target
dab279cd4fb7c4ca8549c80d1fc0eaf2.exe
Size 327KB
Sample211227-jpan2aahdn
SHA256 5cc29d4752c32a15d1c93abd02fe1cbcc525684f4fb9f10e3ad517f67b06fc80
MD5 dab279cd4fb7c4ca8549c80d1fc0eaf2
SHA1 59c5f15531f0c2c1b956e26c29973c9eb2de0c20
SHA512 a6aa6a80f26a7bf4b04b9c9d35920dcc9562339cb9c54d9726c57d38702b07c090fa3f93597b69ecb8d680bcde1f62b8c87ca9ec680efacd8912df45007d6d08
MD5 SHA1 SHA512

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

parubey.info
patmushta.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Creates new service(s) 1 TTPs
persistence

New Service
T1050

Executes dropped EXE 1 IoCs

pid	Process
2912	mucmonfd.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Deletes itself 1 IoCs

pid	Process
1344	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2912 set thread context of 1344	2912	mucmonfd.exe	82

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 3252	2700	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	69
PID 2700 wrote to memory of 3252	2700	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	69
PID 2700 wrote to memory of 3252	2700	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	69
PID 2700 wrote to memory of 1288	2700	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	71
PID 2700 wrote to memory of 1288	2700	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	71
PID 2700 wrote to memory of 1288	2700	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	71
PID 2700 wrote to memory of 1620	2700	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	73
PID 2700 wrote to memory of 1620	2700	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	73
PID 2700 wrote to memory of 1620	2700	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	73
PID 2700 wrote to memory of 3284	2700	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	75
PID 2700 wrote to memory of 3284	2700	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	75
PID 2700 wrote to memory of 3284	2700	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	75
PID 2700 wrote to memory of 4088	2700	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	77
PID 2700 wrote to memory of 4088	2700	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	77
PID 2700 wrote to memory of 4088	2700	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	77
PID 2700 wrote to memory of 3612	2700	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	79
PID 2700 wrote to memory of 3612	2700	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	79
PID 2700 wrote to memory of 3612	2700	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	79
PID 2912 wrote to memory of 1344	2912	mucmonfd.exe	82
PID 2912 wrote to memory of 1344	2912	mucmonfd.exe	82
PID 2912 wrote to memory of 1344	2912	mucmonfd.exe	82
PID 2912 wrote to memory of 1344	2912	mucmonfd.exe	82
PID 2912 wrote to memory of 1344	2912	mucmonfd.exe	82

C:\Users\Admin\AppData\Local\Temp\dab279cd4fb7c4ca8549c80d1fc0eaf2.exe
"C:\Users\Admin\AppData\Local\Temp\dab279cd4fb7c4ca8549c80d1fc0eaf2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ftnlhtca\
  2⤵
  PID:3252
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\mucmonfd.exe" C:\Windows\SysWOW64\ftnlhtca\
  2⤵
  PID:1288
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create ftnlhtca binPath= "C:\Windows\SysWOW64\ftnlhtca\mucmonfd.exe /d\"C:\Users\Admin\AppData\Local\Temp\dab279cd4fb7c4ca8549c80d1fc0eaf2.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  PID:1620
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description ftnlhtca "wifi internet conection"
  2⤵
  PID:3284
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start ftnlhtca
  2⤵
  PID:4088
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  PID:3612

C:\Windows\SysWOW64\ftnlhtca\mucmonfd.exe
C:\Windows\SysWOW64\ftnlhtca\mucmonfd.exe /d"C:\Users\Admin\AppData\Local\Temp\dab279cd4fb7c4ca8549c80d1fc0eaf2.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Deletes itself
  PID:1344