tofsee | ddeaca50e21813ebb8ee743cca315e0f1d7a05900d4369b652f68f5baeaa6f38

General

Target

file.exe
Size

167KB
MD5

068af12a4fde5998014522a0e8eaeb06
SHA1

e51abb1d6ef5a889b398a670c60f20cec46f7f95
SHA256

ddeaca50e21813ebb8ee743cca315e0f1d7a05900d4369b652f68f5baeaa6f38
SHA512

9b931733b2b6a478d639aa5cca89e36fe37d3a225277e985ae845a8362bd14186e59f879435ecd3a975010df752c9e8e9c8cedf62a760c87246383e22bdad71c
SSDEEP

3072:zBl9IavvucboHS5J1VQErTHNXrDDJkbV5vw:h/HLboi/QEPVDlkB

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

svartalfheim.top

jotunheim.name

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

New Service
T1050
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1364 netsh.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

1368 sc.exe
1792 sc.exe
316 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1364	netsh.exe

pid	process
1368	sc.exe
1792	sc.exe
316	sc.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

file.exe

description	pid	process	target process
PID 1192 wrote to memory of 1252	1192	file.exe	cmd.exe
PID 1192 wrote to memory of 1252	1192	file.exe	cmd.exe
PID 1192 wrote to memory of 1252	1192	file.exe	cmd.exe
PID 1192 wrote to memory of 1252	1192	file.exe	cmd.exe
PID 1192 wrote to memory of 1780	1192	file.exe	cmd.exe
PID 1192 wrote to memory of 1780	1192	file.exe	cmd.exe
PID 1192 wrote to memory of 1780	1192	file.exe	cmd.exe
PID 1192 wrote to memory of 1780	1192	file.exe	cmd.exe
PID 1192 wrote to memory of 1368	1192	file.exe	sc.exe
PID 1192 wrote to memory of 1368	1192	file.exe	sc.exe
PID 1192 wrote to memory of 1368	1192	file.exe	sc.exe
PID 1192 wrote to memory of 1368	1192	file.exe	sc.exe
PID 1192 wrote to memory of 1792	1192	file.exe	sc.exe
PID 1192 wrote to memory of 1792	1192	file.exe	sc.exe
PID 1192 wrote to memory of 1792	1192	file.exe	sc.exe
PID 1192 wrote to memory of 1792	1192	file.exe	sc.exe
PID 1192 wrote to memory of 316	1192	file.exe	sc.exe
PID 1192 wrote to memory of 316	1192	file.exe	sc.exe
PID 1192 wrote to memory of 316	1192	file.exe	sc.exe
PID 1192 wrote to memory of 316	1192	file.exe	sc.exe
PID 1192 wrote to memory of 1364	1192	file.exe	netsh.exe
PID 1192 wrote to memory of 1364	1192	file.exe	netsh.exe
PID 1192 wrote to memory of 1364	1192	file.exe	netsh.exe
PID 1192 wrote to memory of 1364	1192	file.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1192

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\kgowbggz\
2⤵
PID:1252

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\orallhhe.exe" C:\Windows\SysWOW64\kgowbggz\
2⤵
PID:1780

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create kgowbggz binPath= "C:\Windows\SysWOW64\kgowbggz\orallhhe.exe /d\"C:\Users\Admin\AppData\Local\Temp\file.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:1368

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description kgowbggz "wifi internet conection"
2⤵
- Launches sc.exe
PID:1792

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start kgowbggz
2⤵
- Launches sc.exe
PID:316

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:1364

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

New Service

1

T1050

Modify Existing Service

1

T1031

Privilege Escalation

New Service

1

T1050

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\orallhhe.exe
Filesize
13.5MB

MD5
7d92da05fbcb58f09e0e393e6d22a81c

SHA1
16b6b71e39d1c7d1f4a5b75d088f4422a506e8b0

SHA256
43de6d2b9d7610f4a9ad2db6e989f3f272b4a582b7814537bd14f4351b13dcac

SHA512
6161ed000f7187b4007503e67684702dbc6449859caeb328f1eabb938b914325a7950dbf7e08d3577650d0202921b034cea5041c8fa02f8df1a9512d255d71f2

Download Submit
memory/316-63-0x0000000000000000-mapping.dmp

Download
memory/1192-54-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/1192-55-0x00000000007DB000-0x00000000007EB000-memory.dmp

Filesize
64KB

Download
memory/1192-56-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download
memory/1192-57-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/1192-65-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/1252-58-0x0000000000000000-mapping.dmp

Download
memory/1364-64-0x0000000000000000-mapping.dmp

Download
memory/1368-61-0x0000000000000000-mapping.dmp

Download
memory/1780-59-0x0000000000000000-mapping.dmp

Download
memory/1792-62-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing