tofsee | ddeaca50e21813ebb8ee743cca315e0f1d7a05900d4369b652f68f5baeaa6f38

General

Target

ddeaca50e21813ebb8ee743cca315e0f1d7a05900d4369b652f68f5baeaa6f38.exe
Size

167KB
MD5

068af12a4fde5998014522a0e8eaeb06
SHA1

e51abb1d6ef5a889b398a670c60f20cec46f7f95
SHA256

ddeaca50e21813ebb8ee743cca315e0f1d7a05900d4369b652f68f5baeaa6f38
SHA512

9b931733b2b6a478d639aa5cca89e36fe37d3a225277e985ae845a8362bd14186e59f879435ecd3a975010df752c9e8e9c8cedf62a760c87246383e22bdad71c
SSDEEP

3072:zBl9IavvucboHS5J1VQErTHNXrDDJkbV5vw:h/HLboi/QEPVDlkB

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

svartalfheim.top

jotunheim.name

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

New Service
T1050
Executes dropped EXE 1 IoCs

Processes:

ugpdcyhm.exe

pid process

544 ugpdcyhm.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

4332 netsh.exe

pid	process
544	ugpdcyhm.exe

pid	process
4332	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\capyhreq\ImagePath = "C:\\Windows\\SysWOW64\\capyhreq\\ugpdcyhm.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ddeaca50e21813ebb8ee743cca315e0f1d7a05900d4369b652f68f5baeaa6f38.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	ddeaca50e21813ebb8ee743cca315e0f1d7a05900d4369b652f68f5baeaa6f38.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

ugpdcyhm.exe

description pid process target process

PID 544 set thread context of 448 544 ugpdcyhm.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

1200 sc.exe
1660 sc.exe
4792 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 544 set thread context of 448	544	ugpdcyhm.exe	svchost.exe

pid	process
1200	sc.exe
1660	sc.exe
4792	sc.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
3160	212	WerFault.exe	ddeaca50e21813ebb8ee743cca315e0f1d7a05900d4369b652f68f5baeaa6f38.exe
1840	544	WerFault.exe	ugpdcyhm.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

ddeaca50e21813ebb8ee743cca315e0f1d7a05900d4369b652f68f5baeaa6f38.exeugpdcyhm.exe

description	pid	process	target process
PID 212 wrote to memory of 3060	212	ddeaca50e21813ebb8ee743cca315e0f1d7a05900d4369b652f68f5baeaa6f38.exe	cmd.exe
PID 212 wrote to memory of 3060	212	ddeaca50e21813ebb8ee743cca315e0f1d7a05900d4369b652f68f5baeaa6f38.exe	cmd.exe
PID 212 wrote to memory of 3060	212	ddeaca50e21813ebb8ee743cca315e0f1d7a05900d4369b652f68f5baeaa6f38.exe	cmd.exe
PID 212 wrote to memory of 924	212	ddeaca50e21813ebb8ee743cca315e0f1d7a05900d4369b652f68f5baeaa6f38.exe	cmd.exe
PID 212 wrote to memory of 924	212	ddeaca50e21813ebb8ee743cca315e0f1d7a05900d4369b652f68f5baeaa6f38.exe	cmd.exe
PID 212 wrote to memory of 924	212	ddeaca50e21813ebb8ee743cca315e0f1d7a05900d4369b652f68f5baeaa6f38.exe	cmd.exe
PID 212 wrote to memory of 1200	212	ddeaca50e21813ebb8ee743cca315e0f1d7a05900d4369b652f68f5baeaa6f38.exe	sc.exe
PID 212 wrote to memory of 1200	212	ddeaca50e21813ebb8ee743cca315e0f1d7a05900d4369b652f68f5baeaa6f38.exe	sc.exe
PID 212 wrote to memory of 1200	212	ddeaca50e21813ebb8ee743cca315e0f1d7a05900d4369b652f68f5baeaa6f38.exe	sc.exe
PID 212 wrote to memory of 1660	212	ddeaca50e21813ebb8ee743cca315e0f1d7a05900d4369b652f68f5baeaa6f38.exe	sc.exe
PID 212 wrote to memory of 1660	212	ddeaca50e21813ebb8ee743cca315e0f1d7a05900d4369b652f68f5baeaa6f38.exe	sc.exe
PID 212 wrote to memory of 1660	212	ddeaca50e21813ebb8ee743cca315e0f1d7a05900d4369b652f68f5baeaa6f38.exe	sc.exe
PID 212 wrote to memory of 4792	212	ddeaca50e21813ebb8ee743cca315e0f1d7a05900d4369b652f68f5baeaa6f38.exe	sc.exe
PID 212 wrote to memory of 4792	212	ddeaca50e21813ebb8ee743cca315e0f1d7a05900d4369b652f68f5baeaa6f38.exe	sc.exe
PID 212 wrote to memory of 4792	212	ddeaca50e21813ebb8ee743cca315e0f1d7a05900d4369b652f68f5baeaa6f38.exe	sc.exe
PID 212 wrote to memory of 4332	212	ddeaca50e21813ebb8ee743cca315e0f1d7a05900d4369b652f68f5baeaa6f38.exe	netsh.exe
PID 212 wrote to memory of 4332	212	ddeaca50e21813ebb8ee743cca315e0f1d7a05900d4369b652f68f5baeaa6f38.exe	netsh.exe
PID 212 wrote to memory of 4332	212	ddeaca50e21813ebb8ee743cca315e0f1d7a05900d4369b652f68f5baeaa6f38.exe	netsh.exe
PID 544 wrote to memory of 448	544	ugpdcyhm.exe	svchost.exe
PID 544 wrote to memory of 448	544	ugpdcyhm.exe	svchost.exe
PID 544 wrote to memory of 448	544	ugpdcyhm.exe	svchost.exe
PID 544 wrote to memory of 448	544	ugpdcyhm.exe	svchost.exe
PID 544 wrote to memory of 448	544	ugpdcyhm.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\ddeaca50e21813ebb8ee743cca315e0f1d7a05900d4369b652f68f5baeaa6f38.exe
"C:\Users\Admin\AppData\Local\Temp\ddeaca50e21813ebb8ee743cca315e0f1d7a05900d4369b652f68f5baeaa6f38.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:212

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\capyhreq\
2⤵
PID:3060

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ugpdcyhm.exe" C:\Windows\SysWOW64\capyhreq\
2⤵
PID:924

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create capyhreq binPath= "C:\Windows\SysWOW64\capyhreq\ugpdcyhm.exe /d\"C:\Users\Admin\AppData\Local\Temp\ddeaca50e21813ebb8ee743cca315e0f1d7a05900d4369b652f68f5baeaa6f38.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:1200

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description capyhreq "wifi internet conection"
2⤵
- Launches sc.exe
PID:1660

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start capyhreq
2⤵
- Launches sc.exe
PID:4792

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 212 -s 1224
2⤵
- Program crash
PID:3160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 212 -ip 212
1⤵
PID:4908

C:\Windows\SysWOW64\capyhreq\ugpdcyhm.exe
C:\Windows\SysWOW64\capyhreq\ugpdcyhm.exe /d"C:\Users\Admin\AppData\Local\Temp\ddeaca50e21813ebb8ee743cca315e0f1d7a05900d4369b652f68f5baeaa6f38.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:544

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Sets service image path in registry
PID:448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 544 -s 508
2⤵
- Program crash
PID:1840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 544 -ip 544
1⤵
PID:4308

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

New Service

1

T1050

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

New Service

1

T1050

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ugpdcyhm.exe
Filesize
14.9MB

MD5
b14e5fdba95ddeda8286935d65ee521d

SHA1
c7acb398fcf29e8d86b9c2987de3eb2b68275166

SHA256
4cd4dcceadf6149546f18cd1bddee77345d2330e5f5b4d9c5245833c7d7078f4

SHA512
b724b12f68cbbebb9ae5deb9e8be019876d7aca261a42012b6f6b460f0c3724734a8ad1dde2e19b62efb7d6a00a882f9fa27b11f338c1f1170714b948cf24a06

Download Submit
C:\Windows\SysWOW64\capyhreq\ugpdcyhm.exe
Filesize
14.9MB

MD5
b14e5fdba95ddeda8286935d65ee521d

SHA1
c7acb398fcf29e8d86b9c2987de3eb2b68275166

SHA256
4cd4dcceadf6149546f18cd1bddee77345d2330e5f5b4d9c5245833c7d7078f4

SHA512
b724b12f68cbbebb9ae5deb9e8be019876d7aca261a42012b6f6b460f0c3724734a8ad1dde2e19b62efb7d6a00a882f9fa27b11f338c1f1170714b948cf24a06

Download Submit
memory/212-133-0x00000000007A0000-0x00000000007B3000-memory.dmp

Filesize
76KB

Download
memory/212-134-0x000000000084D000-0x000000000085E000-memory.dmp

Filesize
68KB

Download
memory/212-135-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/212-136-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/212-132-0x000000000084D000-0x000000000085E000-memory.dmp

Filesize
68KB

Download
memory/212-147-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/212-145-0x000000000084D000-0x000000000085E000-memory.dmp

Filesize
68KB

Download
memory/212-146-0x00000000007A0000-0x00000000007B3000-memory.dmp

Filesize
76KB

Download
memory/448-150-0x0000000000000000-mapping.dmp

Download
memory/448-151-0x0000000000120000-0x0000000000135000-memory.dmp

Filesize
84KB

Download
memory/448-157-0x0000000000120000-0x0000000000135000-memory.dmp

Filesize
84KB

Download
memory/448-156-0x0000000000120000-0x0000000000135000-memory.dmp

Filesize
84KB

Download
memory/544-154-0x0000000000748000-0x0000000000759000-memory.dmp

Filesize
68KB

Download
memory/544-148-0x0000000000748000-0x0000000000759000-memory.dmp

Filesize
68KB

Download
memory/544-149-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/544-155-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/924-138-0x0000000000000000-mapping.dmp

Download
memory/1200-140-0x0000000000000000-mapping.dmp

Download
memory/1660-141-0x0000000000000000-mapping.dmp

Download
memory/3060-137-0x0000000000000000-mapping.dmp

Download
memory/4332-143-0x0000000000000000-mapping.dmp

Download
memory/4792-142-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads