tofsee | 90a08c3936d65ab17994def04f55e8f1eb401dddf3f5c2d15a64766473187e51

Analysis

max time kernel
88s
max time network
63s
platform
windows10-1703_x64
resource
win10-20220901-en
resource tags

arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
submitted
08/09/2022, 14:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

90a08c3936d65ab17994def04f55e8f1eb401dddf3f5c2d15a64766473187e51.exe
Size

305KB
MD5

e8e5d33d96f00e6766acc0850d660157
SHA1

dead70c9f5f983005e6e6b4034d70c51fdb47397
SHA256

90a08c3936d65ab17994def04f55e8f1eb401dddf3f5c2d15a64766473187e51
SHA512

d038d7154b88354a87f2b31cea5b4babe0756ab18fcca0d22edeae7fee8cb21640c3686d1a3c4a7a1b380f12d0d01223c20cbbe827e057bf872fe57e65aaf9b6
SSDEEP

6144:H0hbeCebmXvrWKW73/EDKqdwT8oLF+H9qaq1qWe1Juxs:H4eCvXv6rz/EGTZLF+dXqs1JuK

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

svartalfheim.top

jotunheim.name

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

New Service
T1050

Executes dropped EXE 1 IoCs

pid	Process
4508	feifpvyv.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
4344	netsh.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1328	sc.exe
4468	sc.exe
5108	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 2956	2744	90a08c3936d65ab17994def04f55e8f1eb401dddf3f5c2d15a64766473187e51.exe	66
PID 2744 wrote to memory of 2956	2744	90a08c3936d65ab17994def04f55e8f1eb401dddf3f5c2d15a64766473187e51.exe	66
PID 2744 wrote to memory of 2956	2744	90a08c3936d65ab17994def04f55e8f1eb401dddf3f5c2d15a64766473187e51.exe	66
PID 2744 wrote to memory of 3336	2744	90a08c3936d65ab17994def04f55e8f1eb401dddf3f5c2d15a64766473187e51.exe	68
PID 2744 wrote to memory of 3336	2744	90a08c3936d65ab17994def04f55e8f1eb401dddf3f5c2d15a64766473187e51.exe	68
PID 2744 wrote to memory of 3336	2744	90a08c3936d65ab17994def04f55e8f1eb401dddf3f5c2d15a64766473187e51.exe	68
PID 2744 wrote to memory of 1328	2744	90a08c3936d65ab17994def04f55e8f1eb401dddf3f5c2d15a64766473187e51.exe	70
PID 2744 wrote to memory of 1328	2744	90a08c3936d65ab17994def04f55e8f1eb401dddf3f5c2d15a64766473187e51.exe	70
PID 2744 wrote to memory of 1328	2744	90a08c3936d65ab17994def04f55e8f1eb401dddf3f5c2d15a64766473187e51.exe	70
PID 2744 wrote to memory of 4468	2744	90a08c3936d65ab17994def04f55e8f1eb401dddf3f5c2d15a64766473187e51.exe	72
PID 2744 wrote to memory of 4468	2744	90a08c3936d65ab17994def04f55e8f1eb401dddf3f5c2d15a64766473187e51.exe	72
PID 2744 wrote to memory of 4468	2744	90a08c3936d65ab17994def04f55e8f1eb401dddf3f5c2d15a64766473187e51.exe	72
PID 2744 wrote to memory of 5108	2744	90a08c3936d65ab17994def04f55e8f1eb401dddf3f5c2d15a64766473187e51.exe	74
PID 2744 wrote to memory of 5108	2744	90a08c3936d65ab17994def04f55e8f1eb401dddf3f5c2d15a64766473187e51.exe	74
PID 2744 wrote to memory of 5108	2744	90a08c3936d65ab17994def04f55e8f1eb401dddf3f5c2d15a64766473187e51.exe	74
PID 2744 wrote to memory of 4344	2744	90a08c3936d65ab17994def04f55e8f1eb401dddf3f5c2d15a64766473187e51.exe	76
PID 2744 wrote to memory of 4344	2744	90a08c3936d65ab17994def04f55e8f1eb401dddf3f5c2d15a64766473187e51.exe	76
PID 2744 wrote to memory of 4344	2744	90a08c3936d65ab17994def04f55e8f1eb401dddf3f5c2d15a64766473187e51.exe	76

C:\Users\Admin\AppData\Local\Temp\90a08c3936d65ab17994def04f55e8f1eb401dddf3f5c2d15a64766473187e51.exe
"C:\Users\Admin\AppData\Local\Temp\90a08c3936d65ab17994def04f55e8f1eb401dddf3f5c2d15a64766473187e51.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\rgyswwnf\
  2⤵
  PID:2956
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\feifpvyv.exe" C:\Windows\SysWOW64\rgyswwnf\
  2⤵
  PID:3336
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create rgyswwnf binPath= "C:\Windows\SysWOW64\rgyswwnf\feifpvyv.exe /d\"C:\Users\Admin\AppData\Local\Temp\90a08c3936d65ab17994def04f55e8f1eb401dddf3f5c2d15a64766473187e51.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:1328
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description rgyswwnf "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:4468
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start rgyswwnf
  2⤵
  - Launches sc.exe
  PID:5108
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:4344

C:\Windows\SysWOW64\rgyswwnf\feifpvyv.exe
C:\Windows\SysWOW64\rgyswwnf\feifpvyv.exe /d"C:\Users\Admin\AppData\Local\Temp\90a08c3936d65ab17994def04f55e8f1eb401dddf3f5c2d15a64766473187e51.exe"
1⤵
- Executes dropped EXE
PID:4508

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

New Service

T1050

Privilege Escalation

New Service

T1050

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\feifpvyv.exe

Filesize
14.6MB

MD5
10953e9f29a3e85e0043427854dfbc6d

SHA1
e754a69358816753d676da5c8b064aca4842758e

SHA256
dc6c7e849683dabb67158ff9025233408f7ba16b77ac364529649ab054ba867e

SHA512
4262126f7d93a7ca8523b1a4a84065133a89774602cfe22d574a6d7bfadbebc020f4585501698fe291a470ee64f0e45c990192b533f6451de593aba2cd8f4511

Download Submit
C:\Windows\SysWOW64\rgyswwnf\feifpvyv.exe

Filesize
14.6MB

MD5
10953e9f29a3e85e0043427854dfbc6d

SHA1
e754a69358816753d676da5c8b064aca4842758e

SHA256
dc6c7e849683dabb67158ff9025233408f7ba16b77ac364529649ab054ba867e

SHA512
4262126f7d93a7ca8523b1a4a84065133a89774602cfe22d574a6d7bfadbebc020f4585501698fe291a470ee64f0e45c990192b533f6451de593aba2cd8f4511

Download Submit
memory/1328-183-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/1328-184-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/1328-185-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/1328-186-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-154-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-155-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-124-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-126-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-127-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-128-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-129-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-130-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-131-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-132-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-133-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-134-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-135-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-136-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-137-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-138-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-139-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-140-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-141-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-142-0x0000000000BE6000-0x0000000000BF7000-memory.dmp

Filesize
68KB

Download
memory/2744-143-0x0000000002570000-0x0000000002583000-memory.dmp

Filesize
76KB

Download
memory/2744-144-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-145-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-146-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-147-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-148-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-149-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-150-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-151-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-152-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-153-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-123-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-158-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-156-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-125-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-157-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-120-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-160-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-161-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-162-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-163-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-164-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-165-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-166-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-167-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-168-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-169-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-218-0x0000000000400000-0x000000000084F000-memory.dmp

Filesize
4.3MB

Download
memory/2744-215-0x0000000002570000-0x0000000002583000-memory.dmp

Filesize
76KB

Download
memory/2744-159-0x0000000000400000-0x000000000084F000-memory.dmp

Filesize
4.3MB

Download
memory/2744-212-0x0000000000BE6000-0x0000000000BF7000-memory.dmp

Filesize
68KB

Download
memory/2744-121-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-122-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2956-173-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2956-174-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2956-172-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2956-171-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/2956-176-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/3336-179-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/3336-182-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/3336-178-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/3336-180-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/3336-177-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4468-189-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4468-191-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4468-190-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download