tofsee | 547ef5bd9c5caa12e7e066844f1156d4fc8a6268bff272024a525689c7eabca1

General

Target

547ef5bd9c5caa12e7e066844f1156d4fc8a6268bff272024a525689c7eabca1.exe
Size

164KB
MD5

3ba8dc8d24da92095584ea015e34a30c
SHA1

5c846a3f3b861d566fef2d70afe59ed35c82fecf
SHA256

547ef5bd9c5caa12e7e066844f1156d4fc8a6268bff272024a525689c7eabca1
SHA512

5f2666e937a9eb6889c081460846544d45824f5c491858af804830d7d6b0baa468cf2262f585e80f3e5d6b7a4c38ec22153af983411b36d333605f197cf471e3

Score

10^/10

tofsee persistence trojan

Malware Config

Extracted

Family

tofsee

C2

103.232.222.57

111.121.193.242

123.249.0.22

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Executes dropped EXE 1 IoCs

Processes:

afehymqr.exe

pid process

4144 afehymqr.exe

pid	process
4144	afehymqr.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

547ef5bd9c5caa12e7e066844f1156d4fc8a6268bff272024a525689c7eabca1.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation	547ef5bd9c5caa12e7e066844f1156d4fc8a6268bff272024a525689c7eabca1.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

547ef5bd9c5caa12e7e066844f1156d4fc8a6268bff272024a525689c7eabca1.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSConfig = "\"C:\\Users\\Admin\\afehymqr.exe\""	547ef5bd9c5caa12e7e066844f1156d4fc8a6268bff272024a525689c7eabca1.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

afehymqr.exe

description pid process target process

PID 4144 set thread context of 4588 4144 afehymqr.exe svchost.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4176 4588 WerFault.exe svchost.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

547ef5bd9c5caa12e7e066844f1156d4fc8a6268bff272024a525689c7eabca1.exeafehymqr.exe

pid process

4680 547ef5bd9c5caa12e7e066844f1156d4fc8a6268bff272024a525689c7eabca1.exe
4144 afehymqr.exe

description	pid	process	target process
PID 4144 set thread context of 4588	4144	afehymqr.exe	svchost.exe

pid	pid_target	process	target process
4176	4588	WerFault.exe	svchost.exe

pid	process
4680	547ef5bd9c5caa12e7e066844f1156d4fc8a6268bff272024a525689c7eabca1.exe
4144	afehymqr.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

547ef5bd9c5caa12e7e066844f1156d4fc8a6268bff272024a525689c7eabca1.exeafehymqr.exe

description	pid	process	target process
PID 4680 wrote to memory of 4144	4680	547ef5bd9c5caa12e7e066844f1156d4fc8a6268bff272024a525689c7eabca1.exe	afehymqr.exe
PID 4680 wrote to memory of 4144	4680	547ef5bd9c5caa12e7e066844f1156d4fc8a6268bff272024a525689c7eabca1.exe	afehymqr.exe
PID 4680 wrote to memory of 4144	4680	547ef5bd9c5caa12e7e066844f1156d4fc8a6268bff272024a525689c7eabca1.exe	afehymqr.exe
PID 4680 wrote to memory of 1232	4680	547ef5bd9c5caa12e7e066844f1156d4fc8a6268bff272024a525689c7eabca1.exe	cmd.exe
PID 4680 wrote to memory of 1232	4680	547ef5bd9c5caa12e7e066844f1156d4fc8a6268bff272024a525689c7eabca1.exe	cmd.exe
PID 4680 wrote to memory of 1232	4680	547ef5bd9c5caa12e7e066844f1156d4fc8a6268bff272024a525689c7eabca1.exe	cmd.exe
PID 4144 wrote to memory of 4588	4144	afehymqr.exe	svchost.exe
PID 4144 wrote to memory of 4588	4144	afehymqr.exe	svchost.exe
PID 4144 wrote to memory of 4588	4144	afehymqr.exe	svchost.exe
PID 4144 wrote to memory of 4588	4144	afehymqr.exe	svchost.exe
PID 4144 wrote to memory of 4588	4144	afehymqr.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\547ef5bd9c5caa12e7e066844f1156d4fc8a6268bff272024a525689c7eabca1.exe
"C:\Users\Admin\AppData\Local\Temp\547ef5bd9c5caa12e7e066844f1156d4fc8a6268bff272024a525689c7eabca1.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4680

C:\Users\Admin\afehymqr.exe
"C:\Users\Admin\afehymqr.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4144

C:\Windows\SysWOW64\svchost.exe
svchost.exe
3⤵
PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 468
4⤵
- Program crash
PID:4176

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8820.bat" "
2⤵
PID:1232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4588 -ip 4588
1⤵
PID:2012

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8820.bat
Filesize
302B

MD5
ca60de7aebbebc7f02cd69a533f1691f

SHA1
4724ab19762136c125cf09e1f534cbf06f3ac76f

SHA256
942269070d671fbddfdc162f9dbe44bad11473c85b2a7df42995e9df5424fcc1

SHA512
907c2649adfa719fcba799a2454622032da896b873694284613f23287045a32b6b23139f3206cd86cd549b117e576fd44d8605e4e506279694bc69c51d6c2827

Download Submit
C:\Users\Admin\afehymqr.exe
Filesize
31.7MB

MD5
110eada855c58ec482d70ae8a4c7c30c

SHA1
1795e9b3e63d9b2cf6da2c41336d21b02bdbddab

SHA256
02182685b5265ea596048e152f118adfd579625c939a1cc98a3801542d3ea86d

SHA512
b90b5ab9b6555d91e65f85d1270a21d74622b83512abfbf91c8311ff9c1f5f31511c1841d2f9c32e7b6e643e758b85965a1d888d36bd60301a407c3e14f4b8be

Download Submit
C:\Users\Admin\afehymqr.exe
Filesize
31.7MB

MD5
110eada855c58ec482d70ae8a4c7c30c

SHA1
1795e9b3e63d9b2cf6da2c41336d21b02bdbddab

SHA256
02182685b5265ea596048e152f118adfd579625c939a1cc98a3801542d3ea86d

SHA512
b90b5ab9b6555d91e65f85d1270a21d74622b83512abfbf91c8311ff9c1f5f31511c1841d2f9c32e7b6e643e758b85965a1d888d36bd60301a407c3e14f4b8be

Download Submit
memory/1232-145-0x0000000000000000-mapping.dmp

Download
memory/4144-156-0x0000000074D10000-0x0000000074E6D000-memory.dmp

Filesize
1.4MB

Download
memory/4144-138-0x0000000000000000-mapping.dmp

Download
memory/4144-143-0x0000000002D41000-0x0000000002D46000-memory.dmp

Filesize
20KB

Download
memory/4588-155-0x0000000000420000-0x0000000000432000-memory.dmp

Filesize
72KB

Download
memory/4588-154-0x0000000000000000-mapping.dmp

Download
memory/4588-158-0x0000000000420000-0x0000000000432000-memory.dmp

Filesize
72KB

Download
memory/4588-159-0x0000000000420000-0x0000000000432000-memory.dmp

Filesize
72KB

Download
memory/4588-160-0x0000000000420000-0x0000000000432000-memory.dmp

Filesize
72KB

Download
memory/4680-146-0x0000000002D31000-0x0000000002D36000-memory.dmp

Filesize
20KB

Download
memory/4680-147-0x0000000074D10000-0x0000000074E6D000-memory.dmp

Filesize
1.4MB

Download
memory/4680-144-0x0000000074D10000-0x0000000074E6D000-memory.dmp

Filesize
1.4MB

Download
memory/4680-132-0x0000000002D31000-0x0000000002D36000-memory.dmp

Filesize
20KB

Download
memory/4680-134-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads