tofsee | 3d09b1338518359bce932c85f293e482c0f300173fff9a15c7f785d03d132a6a

General

Target

3d09b1338518359bce932c85f293e482c0f300173fff9a15c7f785d03d132a6a.exe
Size

98KB
MD5

64d99f54eb2c930bfe3aab70dd462137
SHA1

ec87ef99e4a6080b01e708e0746dae89f704d120
SHA256

3d09b1338518359bce932c85f293e482c0f300173fff9a15c7f785d03d132a6a
SHA512

3c3b1397643347189af74fd470577c840683aa955ce87d2b1ce80d3abafb68629e29b4caaa7318612071ebd2f036e1a835f99da78d9183191e5073b3dd5aeac3

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

New Service
T1050
Executes dropped EXE 1 IoCs

Processes:

yuouacul.exe

pid process

2924 yuouacul.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

2272 netsh.exe

pid	process
2924	yuouacul.exe

pid	process
2272	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3d09b1338518359bce932c85f293e482c0f300173fff9a15c7f785d03d132a6a.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	3d09b1338518359bce932c85f293e482c0f300173fff9a15c7f785d03d132a6a.exe

Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

3056 sc.exe
3484 sc.exe
4080 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
3056	sc.exe
3484	sc.exe
4080	sc.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

3d09b1338518359bce932c85f293e482c0f300173fff9a15c7f785d03d132a6a.exe

description	pid	process	target process
PID 2996 wrote to memory of 4576	2996	3d09b1338518359bce932c85f293e482c0f300173fff9a15c7f785d03d132a6a.exe	cmd.exe
PID 2996 wrote to memory of 4576	2996	3d09b1338518359bce932c85f293e482c0f300173fff9a15c7f785d03d132a6a.exe	cmd.exe
PID 2996 wrote to memory of 4576	2996	3d09b1338518359bce932c85f293e482c0f300173fff9a15c7f785d03d132a6a.exe	cmd.exe
PID 2996 wrote to memory of 4480	2996	3d09b1338518359bce932c85f293e482c0f300173fff9a15c7f785d03d132a6a.exe	cmd.exe
PID 2996 wrote to memory of 4480	2996	3d09b1338518359bce932c85f293e482c0f300173fff9a15c7f785d03d132a6a.exe	cmd.exe
PID 2996 wrote to memory of 4480	2996	3d09b1338518359bce932c85f293e482c0f300173fff9a15c7f785d03d132a6a.exe	cmd.exe
PID 2996 wrote to memory of 3056	2996	3d09b1338518359bce932c85f293e482c0f300173fff9a15c7f785d03d132a6a.exe	sc.exe
PID 2996 wrote to memory of 3056	2996	3d09b1338518359bce932c85f293e482c0f300173fff9a15c7f785d03d132a6a.exe	sc.exe
PID 2996 wrote to memory of 3056	2996	3d09b1338518359bce932c85f293e482c0f300173fff9a15c7f785d03d132a6a.exe	sc.exe
PID 2996 wrote to memory of 3484	2996	3d09b1338518359bce932c85f293e482c0f300173fff9a15c7f785d03d132a6a.exe	sc.exe
PID 2996 wrote to memory of 3484	2996	3d09b1338518359bce932c85f293e482c0f300173fff9a15c7f785d03d132a6a.exe	sc.exe
PID 2996 wrote to memory of 3484	2996	3d09b1338518359bce932c85f293e482c0f300173fff9a15c7f785d03d132a6a.exe	sc.exe
PID 2996 wrote to memory of 4080	2996	3d09b1338518359bce932c85f293e482c0f300173fff9a15c7f785d03d132a6a.exe	sc.exe
PID 2996 wrote to memory of 4080	2996	3d09b1338518359bce932c85f293e482c0f300173fff9a15c7f785d03d132a6a.exe	sc.exe
PID 2996 wrote to memory of 4080	2996	3d09b1338518359bce932c85f293e482c0f300173fff9a15c7f785d03d132a6a.exe	sc.exe
PID 2996 wrote to memory of 2272	2996	3d09b1338518359bce932c85f293e482c0f300173fff9a15c7f785d03d132a6a.exe	netsh.exe
PID 2996 wrote to memory of 2272	2996	3d09b1338518359bce932c85f293e482c0f300173fff9a15c7f785d03d132a6a.exe	netsh.exe
PID 2996 wrote to memory of 2272	2996	3d09b1338518359bce932c85f293e482c0f300173fff9a15c7f785d03d132a6a.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\3d09b1338518359bce932c85f293e482c0f300173fff9a15c7f785d03d132a6a.exe
"C:\Users\Admin\AppData\Local\Temp\3d09b1338518359bce932c85f293e482c0f300173fff9a15c7f785d03d132a6a.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2996

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\bkteckcw\
2⤵
PID:4576

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\yuouacul.exe" C:\Windows\SysWOW64\bkteckcw\
2⤵
PID:4480

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create bkteckcw binPath= "C:\Windows\SysWOW64\bkteckcw\yuouacul.exe /d\"C:\Users\Admin\AppData\Local\Temp\3d09b1338518359bce932c85f293e482c0f300173fff9a15c7f785d03d132a6a.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:3056

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description bkteckcw "wifi internet conection"
2⤵
- Launches sc.exe
PID:3484

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start bkteckcw
2⤵
- Launches sc.exe
PID:4080

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:2272

C:\Windows\SysWOW64\bkteckcw\yuouacul.exe
C:\Windows\SysWOW64\bkteckcw\yuouacul.exe /d"C:\Users\Admin\AppData\Local\Temp\3d09b1338518359bce932c85f293e482c0f300173fff9a15c7f785d03d132a6a.exe"
1⤵
- Executes dropped EXE
PID:2924

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

New Service

1

T1050

Modify Existing Service

1

T1031

Privilege Escalation

New Service

1

T1050

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\yuouacul.exe
Filesize
13.7MB

MD5
e23ef121a173e4d286aaa0db1669d336

SHA1
41bd15b439ad313c4b19067c8b3854de93eeb93e

SHA256
41db895c409012c94b48d1ab7113a9a33010a26e1c0333953a67060154cb422d

SHA512
b0a498689908320986a7208aa8c80ef0e25e85b3156218d12de02b6299ae9a294602c4f1f55f2dc01a235f3aa9c38f1a83088e897dc3e4dcbf9569f841204fb3

Download Submit
C:\Windows\SysWOW64\bkteckcw\yuouacul.exe
Filesize
13.7MB

MD5
e23ef121a173e4d286aaa0db1669d336

SHA1
41bd15b439ad313c4b19067c8b3854de93eeb93e

SHA256
41db895c409012c94b48d1ab7113a9a33010a26e1c0333953a67060154cb422d

SHA512
b0a498689908320986a7208aa8c80ef0e25e85b3156218d12de02b6299ae9a294602c4f1f55f2dc01a235f3aa9c38f1a83088e897dc3e4dcbf9569f841204fb3

Download Submit
memory/2272-139-0x0000000000000000-mapping.dmp

Download
memory/2996-131-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3056-135-0x0000000000000000-mapping.dmp

Download
memory/3484-136-0x0000000000000000-mapping.dmp

Download
memory/4080-137-0x0000000000000000-mapping.dmp

Download
memory/4480-133-0x0000000000000000-mapping.dmp

Download
memory/4576-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing