tofsee | b62bd16f3b2fb0e9d1549dd12114b99bdfd360a8a9719f9b801544113c69bb97

Analysis

max time kernel
151s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2022, 20:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b62bd16f3b2fb0e9d1549dd12114b99bdfd360a8a9719f9b801544113c69bb97.exe
Size

120KB
MD5

4dceae07630380b5ed1a94389e1fb9c0
SHA1

2d3bd982d62d7fc62b961f82625682231766856e
SHA256

b62bd16f3b2fb0e9d1549dd12114b99bdfd360a8a9719f9b801544113c69bb97
SHA512

4fb8b0a3cbeb394453c551e6daece1cf5c1685abf2d6b083d569c4096a3544c228df7bba7acfdec3aae9caa490f04dd78ca08a53cf6a6108f415a0d5a767e254
SSDEEP

1536:mZG0MaQ9u20DPpbuF30kpX9aIJeOX/hZZYF9WqoMurUE/ZZ1rSNJMiGXBe:Nr9u20Tpb+rpAyZZKF9WqJEz1+8dx

Score

10^/10

tofsee persistence trojan

Malware Config

Extracted

Family

tofsee

111.121.193.238

103.15.107.117

188.190.114.108

188.165.132.183

213.155.0.208

rgtryhbgddtyh.biz

wertdghbyrukl.ch

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Executes dropped EXE 2 IoCs

pid	Process
4272	ssbbogpn.exe
4676	ssbbogpn.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	b62bd16f3b2fb0e9d1549dd12114b99bdfd360a8a9719f9b801544113c69bb97.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSConfig = "\"C:\\Users\\Admin\\ssbbogpn.exe\""	b62bd16f3b2fb0e9d1549dd12114b99bdfd360a8a9719f9b801544113c69bb97.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1360 set thread context of 1948	1360	b62bd16f3b2fb0e9d1549dd12114b99bdfd360a8a9719f9b801544113c69bb97.exe	81
PID 4272 set thread context of 4676	4272	ssbbogpn.exe	93
PID 4676 set thread context of 3996	4676	ssbbogpn.exe	94

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3488	3996	WerFault.exe	94

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1360	b62bd16f3b2fb0e9d1549dd12114b99bdfd360a8a9719f9b801544113c69bb97.exe
4272	ssbbogpn.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 1948	1360	b62bd16f3b2fb0e9d1549dd12114b99bdfd360a8a9719f9b801544113c69bb97.exe	81
PID 1360 wrote to memory of 1948	1360	b62bd16f3b2fb0e9d1549dd12114b99bdfd360a8a9719f9b801544113c69bb97.exe	81
PID 1360 wrote to memory of 1948	1360	b62bd16f3b2fb0e9d1549dd12114b99bdfd360a8a9719f9b801544113c69bb97.exe	81
PID 1360 wrote to memory of 1948	1360	b62bd16f3b2fb0e9d1549dd12114b99bdfd360a8a9719f9b801544113c69bb97.exe	81
PID 1360 wrote to memory of 1948	1360	b62bd16f3b2fb0e9d1549dd12114b99bdfd360a8a9719f9b801544113c69bb97.exe	81
PID 1360 wrote to memory of 1948	1360	b62bd16f3b2fb0e9d1549dd12114b99bdfd360a8a9719f9b801544113c69bb97.exe	81
PID 1360 wrote to memory of 1948	1360	b62bd16f3b2fb0e9d1549dd12114b99bdfd360a8a9719f9b801544113c69bb97.exe	81
PID 1360 wrote to memory of 1948	1360	b62bd16f3b2fb0e9d1549dd12114b99bdfd360a8a9719f9b801544113c69bb97.exe	81
PID 1360 wrote to memory of 1948	1360	b62bd16f3b2fb0e9d1549dd12114b99bdfd360a8a9719f9b801544113c69bb97.exe	81
PID 1948 wrote to memory of 4272	1948	b62bd16f3b2fb0e9d1549dd12114b99bdfd360a8a9719f9b801544113c69bb97.exe	84
PID 1948 wrote to memory of 4272	1948	b62bd16f3b2fb0e9d1549dd12114b99bdfd360a8a9719f9b801544113c69bb97.exe	84
PID 1948 wrote to memory of 4272	1948	b62bd16f3b2fb0e9d1549dd12114b99bdfd360a8a9719f9b801544113c69bb97.exe	84
PID 1948 wrote to memory of 4864	1948	b62bd16f3b2fb0e9d1549dd12114b99bdfd360a8a9719f9b801544113c69bb97.exe	87
PID 1948 wrote to memory of 4864	1948	b62bd16f3b2fb0e9d1549dd12114b99bdfd360a8a9719f9b801544113c69bb97.exe	87
PID 1948 wrote to memory of 4864	1948	b62bd16f3b2fb0e9d1549dd12114b99bdfd360a8a9719f9b801544113c69bb97.exe	87
PID 4272 wrote to memory of 4676	4272	ssbbogpn.exe	93
PID 4272 wrote to memory of 4676	4272	ssbbogpn.exe	93
PID 4272 wrote to memory of 4676	4272	ssbbogpn.exe	93
PID 4272 wrote to memory of 4676	4272	ssbbogpn.exe	93
PID 4272 wrote to memory of 4676	4272	ssbbogpn.exe	93
PID 4272 wrote to memory of 4676	4272	ssbbogpn.exe	93
PID 4272 wrote to memory of 4676	4272	ssbbogpn.exe	93
PID 4272 wrote to memory of 4676	4272	ssbbogpn.exe	93
PID 4272 wrote to memory of 4676	4272	ssbbogpn.exe	93
PID 4676 wrote to memory of 3996	4676	ssbbogpn.exe	94
PID 4676 wrote to memory of 3996	4676	ssbbogpn.exe	94
PID 4676 wrote to memory of 3996	4676	ssbbogpn.exe	94
PID 4676 wrote to memory of 3996	4676	ssbbogpn.exe	94
PID 4676 wrote to memory of 3996	4676	ssbbogpn.exe	94

C:\Users\Admin\AppData\Local\Temp\b62bd16f3b2fb0e9d1549dd12114b99bdfd360a8a9719f9b801544113c69bb97.exe
"C:\Users\Admin\AppData\Local\Temp\b62bd16f3b2fb0e9d1549dd12114b99bdfd360a8a9719f9b801544113c69bb97.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Users\Admin\AppData\Local\Temp\b62bd16f3b2fb0e9d1549dd12114b99bdfd360a8a9719f9b801544113c69bb97.exe
  "C:\Users\Admin\AppData\Local\Temp\b62bd16f3b2fb0e9d1549dd12114b99bdfd360a8a9719f9b801544113c69bb97.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Users\Admin\ssbbogpn.exe
    "C:\Users\Admin\ssbbogpn.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4272
  - - C:\Users\Admin\ssbbogpn.exe
      "C:\Users\Admin\ssbbogpn.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:4676
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        
        PID:3996
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 468
        6⤵
        Program crash
        
        PID:3488
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2814.bat" "
    3⤵
    PID:4864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3996 -ip 3996
1⤵
PID:2416

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2814.bat

Filesize
302B

MD5
82f2f155771c7c4904c12c23cca7ea40

SHA1
822563caf201e35906c67abb8c319d3f1b9d3b59

SHA256
13e29eb85af8de8b174f5b8ab10165cfd73c24c5c8998c0c04edec2dd4af8531

SHA512
3ef45fe3747c6558140e2da0bef868bb65fe775ddb98dd6605b5f5bac5eb4acb6410b011eaac209404db76d38dc7142dcac1c89641c19a6f5a589e8f92576d0a

Download Submit
C:\Users\Admin\ssbbogpn.exe

Filesize
49.1MB

MD5
4fbb606ac107af70ab733a9ad8428bde

SHA1
3463dc48e28a5c2380ed112ad6abc690c835ab8b

SHA256
93601863372c91f6ab6a003322cd80fda6746958a057a12eeff1ec8ef6b53578

SHA512
5215a069c980b659fc783c439d4e644960f5fdeae78673563137046526e649a2aa089d91dd4c4e573840e75ea4c743a1bafd4604c99a40debc63bb42e70d9f17

Download Submit
C:\Users\Admin\ssbbogpn.exe

Filesize
49.1MB

MD5
4fbb606ac107af70ab733a9ad8428bde

SHA1
3463dc48e28a5c2380ed112ad6abc690c835ab8b

SHA256
93601863372c91f6ab6a003322cd80fda6746958a057a12eeff1ec8ef6b53578

SHA512
5215a069c980b659fc783c439d4e644960f5fdeae78673563137046526e649a2aa089d91dd4c4e573840e75ea4c743a1bafd4604c99a40debc63bb42e70d9f17

Download Submit
C:\Users\Admin\ssbbogpn.exe

Filesize
49.1MB

MD5
4fbb606ac107af70ab733a9ad8428bde

SHA1
3463dc48e28a5c2380ed112ad6abc690c835ab8b

SHA256
93601863372c91f6ab6a003322cd80fda6746958a057a12eeff1ec8ef6b53578

SHA512
5215a069c980b659fc783c439d4e644960f5fdeae78673563137046526e649a2aa089d91dd4c4e573840e75ea4c743a1bafd4604c99a40debc63bb42e70d9f17

Download Submit
memory/1948-139-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1948-138-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1948-146-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1948-137-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1948-135-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3996-154-0x0000000000630000-0x0000000000642000-memory.dmp

Filesize
72KB

Download
memory/3996-159-0x0000000000630000-0x0000000000642000-memory.dmp

Filesize
72KB

Download
memory/3996-158-0x0000000000630000-0x0000000000642000-memory.dmp

Filesize
72KB

Download
memory/4676-155-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download