tofsee | 768e84be2f71c0f64a4f935f7233b47125fc4bc2c34fd53b15729dca3bb43761

General

Target
file.exe
Size 306KB
Sample220910-sbkrhsacc5
SHA256 768e84be2f71c0f64a4f935f7233b47125fc4bc2c34fd53b15729dca3bb43761
MD5 38e48a5ec49253ff60579c5504b006e5
SHA1 16ecc51cf59b79b29214a92d49cc8e1a8004e9a9
SHA512 40dd969dba27df03e5f5c42aaa1843ff5b29b51e5c431bcc6cd5a9951cace18480e85383903c4fe58ca8254c2aa60cccccd14e3288c560d9033b77bf5b762d7d
SSDEEP 6144:Pyttl/9z6vvJbgzTqNamKCBDv5QLKxfNaKCwF1KeDx:P8l/9zkbAGNBnBDveYfAKB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

svartalfheim.top
jotunheim.name

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

New Service
T1050

Executes dropped EXE 1 IoCs

pid	Process
2432	feifpvyv.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
4060	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	file.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3476	sc.exe
3048	sc.exe
1620	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4192	2680	WerFault.exe	83

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 3988	2680	file.exe	100
PID 2680 wrote to memory of 3988	2680	file.exe	100
PID 2680 wrote to memory of 3988	2680	file.exe	100
PID 2680 wrote to memory of 1884	2680	file.exe	102
PID 2680 wrote to memory of 1884	2680	file.exe	102
PID 2680 wrote to memory of 1884	2680	file.exe	102
PID 2680 wrote to memory of 3476	2680	file.exe	104
PID 2680 wrote to memory of 3476	2680	file.exe	104
PID 2680 wrote to memory of 3476	2680	file.exe	104
PID 2680 wrote to memory of 3048	2680	file.exe	106
PID 2680 wrote to memory of 3048	2680	file.exe	106
PID 2680 wrote to memory of 3048	2680	file.exe	106
PID 2680 wrote to memory of 1620	2680	file.exe	108
PID 2680 wrote to memory of 1620	2680	file.exe	108
PID 2680 wrote to memory of 1620	2680	file.exe	108
PID 2680 wrote to memory of 4060	2680	file.exe	111
PID 2680 wrote to memory of 4060	2680	file.exe	111
PID 2680 wrote to memory of 4060	2680	file.exe	111

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\qxxkycep\
  2⤵
  PID:3988
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\feifpvyv.exe" C:\Windows\SysWOW64\qxxkycep\
  2⤵
  PID:1884
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create qxxkycep binPath= "C:\Windows\SysWOW64\qxxkycep\feifpvyv.exe /d\"C:\Users\Admin\AppData\Local\Temp\file.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:3476
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description qxxkycep "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:3048
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start qxxkycep
  2⤵
  - Launches sc.exe
  PID:1620
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:4060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 1028
  2⤵
  - Program crash
  PID:4192

C:\Windows\SysWOW64\qxxkycep\feifpvyv.exe
C:\Windows\SysWOW64\qxxkycep\feifpvyv.exe /d"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Executes dropped EXE
PID:2432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2680 -ip 2680
1⤵
PID:3300

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

New Service

Privilege Escalation

New Service

1

T1050

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

feifpvyv.exe

Path C:\Users\Admin\AppData\Local\Temp\feifpvyv.exe
Size 11.4MB
SHA256 3661dac51933f6df0f6878c96d74284906b653605422806e0cfb99f8d4699df9
MD5 b182ac83597a64e9ca6e652d1e43e5a2
SHA1 b8e951f54badd439c8cca983c5ce441d8df7b0af
SHA512 9be179fa1ee74029d62c9775f95e5da0c61180a486e9ed509f9d8e29a1886e576fa2b0f5ddaf2778da80e3dc65036eb7b04abba014851e482ebcebdd9e65814f
SSDEEP 6144:6yttl/9z6vvJbgzTqNamKCBDv5QLKxfNaKCwF1KeDx:68l/9zkbAGNBnBDveYfAKB
MD5 SHA1 SHA512 SSDEEP

Submit Download

feifpvyv.exe

Path C:\Windows\SysWOW64\qxxkycep\feifpvyv.exe
Size 11.4MB
SHA256 3661dac51933f6df0f6878c96d74284906b653605422806e0cfb99f8d4699df9
MD5 b182ac83597a64e9ca6e652d1e43e5a2
SHA1 b8e951f54badd439c8cca983c5ce441d8df7b0af
SHA512 9be179fa1ee74029d62c9775f95e5da0c61180a486e9ed509f9d8e29a1886e576fa2b0f5ddaf2778da80e3dc65036eb7b04abba014851e482ebcebdd9e65814f
SSDEEP 6144:6yttl/9z6vvJbgzTqNamKCBDv5QLKxfNaKCwF1KeDx:68l/9zkbAGNBnBDveYfAKB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2680-143-0x000000000084D000-0x000000000085E000-memory.dmp

Download

memory/2680-133-0x00000000001C0000-0x00000000001D3000-memory.dmp

Download

memory/2680-134-0x0000000000400000-0x00000000007EE000-memory.dmp

Download

memory/2680-144-0x0000000000400000-0x00000000007EE000-memory.dmp

Download

memory/2680-132-0x000000000084D000-0x000000000085E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads