tofsee | 33a4613abccd233fbfd2657b47227b18f073b318aef50363eebbcad4ee876a13

General

Target

33a4613abccd233fbfd2657b47227b18f073b318aef50363eebbcad4ee876a13.exe
Size

150KB
MD5

6ab83c7b097ab214b88c82fe574b54aa
SHA1

1ecb7a96d52c0d1508bff3aedba472bf46a89d37
SHA256

33a4613abccd233fbfd2657b47227b18f073b318aef50363eebbcad4ee876a13
SHA512

10affd6dd0d0dacfb6fb6c911e7247da62b9a3cf174ab82cd79e0ebf5fa09400df728d616023b5ac774ba6b02d5b934e0ea06d3449e0fe346fff5cd07beb752e

Score

10^/10

tofsee persistence trojan upx

Malware Config

Extracted

Family

tofsee

C2

91.218.38.245

188.165.132.183

rgtryhbgddtyh.biz

wertdghbyrukl.ch

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Executes dropped EXE 1 IoCs

Processes:

vdfx.exe

pid process

1912 vdfx.exe

pid	process
1912	vdfx.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\vdfx.exe	upx
C:\Users\Admin\vdfx.exe	upx
\Users\Admin\vdfx.exe	upx
behavioral1/memory/1912-63-0x0000000000400000-0x0000000000453000-memory.dmp	upx
C:\Users\Admin\vdfx.exe	upx

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1052 cmd.exe

pid	process
1052	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

33a4613abccd233fbfd2657b47227b18f073b318aef50363eebbcad4ee876a13.exe

pid	process
1156	33a4613abccd233fbfd2657b47227b18f073b318aef50363eebbcad4ee876a13.exe
1156	33a4613abccd233fbfd2657b47227b18f073b318aef50363eebbcad4ee876a13.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

33a4613abccd233fbfd2657b47227b18f073b318aef50363eebbcad4ee876a13.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSConfig = "\"C:\\Users\\Admin\\vdfx.exe\""	33a4613abccd233fbfd2657b47227b18f073b318aef50363eebbcad4ee876a13.exe

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

33a4613abccd233fbfd2657b47227b18f073b318aef50363eebbcad4ee876a13.exevdfx.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	33a4613abccd233fbfd2657b47227b18f073b318aef50363eebbcad4ee876a13.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	33a4613abccd233fbfd2657b47227b18f073b318aef50363eebbcad4ee876a13.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	vdfx.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	vdfx.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

vdfx.exe

description pid process target process

PID 1912 set thread context of 1740 1912 vdfx.exe svchost.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 1912 set thread context of 1740	1912	vdfx.exe	svchost.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

33a4613abccd233fbfd2657b47227b18f073b318aef50363eebbcad4ee876a13.exevdfx.exe

description	pid	process	target process
PID 1156 wrote to memory of 1912	1156	33a4613abccd233fbfd2657b47227b18f073b318aef50363eebbcad4ee876a13.exe	vdfx.exe
PID 1156 wrote to memory of 1912	1156	33a4613abccd233fbfd2657b47227b18f073b318aef50363eebbcad4ee876a13.exe	vdfx.exe
PID 1156 wrote to memory of 1912	1156	33a4613abccd233fbfd2657b47227b18f073b318aef50363eebbcad4ee876a13.exe	vdfx.exe
PID 1156 wrote to memory of 1912	1156	33a4613abccd233fbfd2657b47227b18f073b318aef50363eebbcad4ee876a13.exe	vdfx.exe
PID 1156 wrote to memory of 1052	1156	33a4613abccd233fbfd2657b47227b18f073b318aef50363eebbcad4ee876a13.exe	cmd.exe
PID 1156 wrote to memory of 1052	1156	33a4613abccd233fbfd2657b47227b18f073b318aef50363eebbcad4ee876a13.exe	cmd.exe
PID 1156 wrote to memory of 1052	1156	33a4613abccd233fbfd2657b47227b18f073b318aef50363eebbcad4ee876a13.exe	cmd.exe
PID 1156 wrote to memory of 1052	1156	33a4613abccd233fbfd2657b47227b18f073b318aef50363eebbcad4ee876a13.exe	cmd.exe
PID 1912 wrote to memory of 1740	1912	vdfx.exe	svchost.exe
PID 1912 wrote to memory of 1740	1912	vdfx.exe	svchost.exe
PID 1912 wrote to memory of 1740	1912	vdfx.exe	svchost.exe
PID 1912 wrote to memory of 1740	1912	vdfx.exe	svchost.exe
PID 1912 wrote to memory of 1740	1912	vdfx.exe	svchost.exe
PID 1912 wrote to memory of 1740	1912	vdfx.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\33a4613abccd233fbfd2657b47227b18f073b318aef50363eebbcad4ee876a13.exe
"C:\Users\Admin\AppData\Local\Temp\33a4613abccd233fbfd2657b47227b18f073b318aef50363eebbcad4ee876a13.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious use of WriteProcessMemory
PID:1156

C:\Users\Admin\vdfx.exe
"C:\Users\Admin\vdfx.exe"
2⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1912

C:\Windows\SysWOW64\svchost.exe
svchost.exe
3⤵
PID:1740

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\3867.bat" "
2⤵
- Deletes itself
PID:1052

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3867.bat
Filesize
302B

MD5
f52a343e498228ef1f576285aa49b42c

SHA1
4e9b2ff530ba8843e96c67676b5f99344fa0d694

SHA256
b15fde8426c89de854317c012c66e28e0a1a3dbf484a8de53e00dc9e016a2885

SHA512
8198ff01da1c07c6e17be5532ef46da163d6c14f8d550f26db85c16cf255020bcc6f5649b68ba19788cc4754335dc22b5b01cd533423a6d786ab297929be1e70

Download Submit
C:\Users\Admin\vdfx.exe
Filesize
150KB

MD5
6ab83c7b097ab214b88c82fe574b54aa

SHA1
1ecb7a96d52c0d1508bff3aedba472bf46a89d37

SHA256
33a4613abccd233fbfd2657b47227b18f073b318aef50363eebbcad4ee876a13

SHA512
10affd6dd0d0dacfb6fb6c911e7247da62b9a3cf174ab82cd79e0ebf5fa09400df728d616023b5ac774ba6b02d5b934e0ea06d3449e0fe346fff5cd07beb752e

Download Submit
C:\Users\Admin\vdfx.exe
Filesize
150KB

MD5
6ab83c7b097ab214b88c82fe574b54aa

SHA1
1ecb7a96d52c0d1508bff3aedba472bf46a89d37

SHA256
33a4613abccd233fbfd2657b47227b18f073b318aef50363eebbcad4ee876a13

SHA512
10affd6dd0d0dacfb6fb6c911e7247da62b9a3cf174ab82cd79e0ebf5fa09400df728d616023b5ac774ba6b02d5b934e0ea06d3449e0fe346fff5cd07beb752e

Download Submit
\Users\Admin\vdfx.exe
Filesize
150KB

MD5
6ab83c7b097ab214b88c82fe574b54aa

SHA1
1ecb7a96d52c0d1508bff3aedba472bf46a89d37

SHA256
33a4613abccd233fbfd2657b47227b18f073b318aef50363eebbcad4ee876a13

SHA512
10affd6dd0d0dacfb6fb6c911e7247da62b9a3cf174ab82cd79e0ebf5fa09400df728d616023b5ac774ba6b02d5b934e0ea06d3449e0fe346fff5cd07beb752e

Download Submit
\Users\Admin\vdfx.exe
Filesize
150KB

MD5
6ab83c7b097ab214b88c82fe574b54aa

SHA1
1ecb7a96d52c0d1508bff3aedba472bf46a89d37

SHA256
33a4613abccd233fbfd2657b47227b18f073b318aef50363eebbcad4ee876a13

SHA512
10affd6dd0d0dacfb6fb6c911e7247da62b9a3cf174ab82cd79e0ebf5fa09400df728d616023b5ac774ba6b02d5b934e0ea06d3449e0fe346fff5cd07beb752e

Download Submit
memory/1052-64-0x0000000000000000-mapping.dmp

Download
memory/1156-65-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1156-60-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1156-62-0x0000000002BB0000-0x0000000002C03000-memory.dmp

Filesize
332KB

Download
memory/1156-61-0x0000000002BB0000-0x0000000002C03000-memory.dmp

Filesize
332KB

Download
memory/1156-54-0x0000000075271000-0x0000000075273000-memory.dmp

Filesize
8KB

Download
memory/1740-69-0x0000000000080000-0x0000000000091000-memory.dmp

Filesize
68KB

Download
memory/1740-67-0x0000000000080000-0x0000000000091000-memory.dmp

Filesize
68KB

Download
memory/1740-70-0x0000000000087322-mapping.dmp

Download
memory/1740-74-0x0000000000080000-0x0000000000091000-memory.dmp

Filesize
68KB

Download
memory/1740-76-0x0000000000080000-0x0000000000091000-memory.dmp

Filesize
68KB

Download
memory/1740-77-0x0000000000080000-0x0000000000091000-memory.dmp

Filesize
68KB

Download
memory/1912-63-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1912-72-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1912-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads