tofsee | 49bb64bffbc1988c54e47833eeec3897d985f48c4a7689090fd3f1a7c2f1b4f1

Analysis

max time kernel
76s
max time network
3s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 260KB
Sample221029-e3nqlabbh6
SHA256 49bb64bffbc1988c54e47833eeec3897d985f48c4a7689090fd3f1a7c2f1b4f1
MD5 9ef4dcf72c95ea77cf0c1255f8e18e4a
SHA1 c9b325333d4f7a8c2aa18a93b27887c17e05cdfc
SHA512 f30ac7a89f1c1bca99f2f4d2443f0625cd59c83661192d51aa31b789893f1ee5565a10eb643b48dcb1280d4e6dd9e607182a81cf95e74500283bee47ec28dda7
SSDEEP 3072:rZRyZB2mqZLqoVf2z59VKhvH7yR6kETZllrIDKbN7xP4KEM/h3:/yZB1qZLTVcVKheG1N17E
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

svartalfheim.top
jotunheim.name

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

New Service
T1050

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
3492	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	file.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2684	sc.exe
5084	sc.exe
224	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3268	4612	WerFault.exe	16
2884	4772	WerFault.exe	92

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 1924	4612	file.exe	82
PID 4612 wrote to memory of 1924	4612	file.exe	82
PID 4612 wrote to memory of 1924	4612	file.exe	82
PID 4612 wrote to memory of 812	4612	file.exe	84
PID 4612 wrote to memory of 812	4612	file.exe	84
PID 4612 wrote to memory of 812	4612	file.exe	84
PID 4612 wrote to memory of 2684	4612	file.exe	85
PID 4612 wrote to memory of 2684	4612	file.exe	85
PID 4612 wrote to memory of 2684	4612	file.exe	85

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\wysbrhvo\
  2⤵
  PID:1924
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\sliqhaur.exe" C:\Windows\SysWOW64\wysbrhvo\
  2⤵
  PID:812
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create wysbrhvo binPath= "C:\Windows\SysWOW64\wysbrhvo\sliqhaur.exe /d\"C:\Users\Admin\AppData\Local\Temp\file.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:2684
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description wysbrhvo "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:5084
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start wysbrhvo
  2⤵
  - Launches sc.exe
  PID:224
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:3492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 1036
  2⤵
  - Program crash
  PID:3268

C:\Windows\SysWOW64\wysbrhvo\sliqhaur.exe
C:\Windows\SysWOW64\wysbrhvo\sliqhaur.exe /d"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
PID:4772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 176
  2⤵
  - Program crash
  PID:2884
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:3376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 4612 -ip 4612
1⤵
PID:2680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4772 -ip 4772
1⤵
PID:2428

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

New Service

T1050

Privilege Escalation

New Service

T1050

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sliqhaur.exe

Path C:\Users\Admin\AppData\Local\Temp\sliqhaur.exe
Size 113KB
SHA256 5da0c513cc0b58e087be4ccdd520e01e00ef05e9ac484d0d01ee2e992d1943dd
MD5 93a413f2ae742a2df9cece225c59938c
SHA1 452e410eef10c7052bb737077ce8d9eb56d6fa26
SHA512 4c5ece074fc5ac31f020f7de6ca490f9ebcb91ea6606faea6386fd79c4ac0badf196e15f4e399cc2c3ced4c090bf30fa0fdf8b66d53fbe4ceace8cc4e76bb1d2
SSDEEP 1536:RZRKKuILUpRR2L0hqZLoyomSRy/n9BMFX8f/uz5HIzS1rb5JNs:RZRyZB2mqZLqoVf2z59V8
MD5 SHA1 SHA512 SSDEEP

Submit Download

sliqhaur.exe

Path C:\Windows\SysWOW64\wysbrhvo\sliqhaur.exe
Size 27KB
SHA256 a3eb3eb249a3bbd3d76d0bc59b727eb0c88de7f6aeb4d4836db9c4f45b0b2ce6
MD5 24ae2dcf4ef0247e11cfaa8ebfb09a0f
SHA1 bc0f68010a4bc08c3b729d17b0ab6c4f137b9480
SHA512 11ed923ef3bb70325ebbfdcca7480cf1932a822d187db2cdd8c69532ce8905fe67394de318368a82a9a0d3d5ddf20747679313c030d011393391898a9a88446d
SSDEEP 384:CsldF3uYDqflcYcdGzyn2+E8krEeprYShAZGPfjgbTGWIo1gML5uJxGXkpReo0qE:bnF3iQRkAexYShQwixLuAUpRLd2lZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3376-153-0x0000000000560000-0x0000000000575000-memory.dmp

Download

memory/3376-148-0x0000000000560000-0x0000000000575000-memory.dmp

Download

memory/4612-132-0x0000000002D17000-0x0000000002D2C000-memory.dmp

Download

memory/4612-133-0x0000000002CB0000-0x0000000002CC3000-memory.dmp

Download

memory/4612-134-0x0000000000400000-0x0000000002C2F000-memory.dmp

Download

memory/4612-145-0x0000000002D17000-0x0000000002D2C000-memory.dmp

Download

memory/4612-146-0x0000000000400000-0x0000000002C2F000-memory.dmp

Download

memory/4612-135-0x0000000002D17000-0x0000000002D2C000-memory.dmp

Download

memory/4612-136-0x0000000002CB0000-0x0000000002CC3000-memory.dmp

Download

memory/4772-151-0x0000000002DE2000-0x0000000002DF8000-memory.dmp

Download

memory/4772-152-0x0000000000400000-0x0000000002C2F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads