tofsee | e8f4cb9f3b3b8620b41095c080a9479a12a9005957e7ff68f52acd93a41b0e1e

Analysis

max time kernel
163s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 06:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 147KB
Sample221126-halx3sce9v
SHA256 e8f4cb9f3b3b8620b41095c080a9479a12a9005957e7ff68f52acd93a41b0e1e
MD5 f72e1518b65fdbcba415c794f6f60aed
SHA1 37db369d67b682b37f8d9bd12bb7b5d1b5f0e251
SHA512 d0654c81f24f6467f5391c73f63b7f9c52a9cbfb096b3170f520f4185ce75852232763c62f31c6013c91e06fac441f5085f4619a11cad63ff1d4c7112034047f
SSDEEP 3072:qRZJOX4ha/M8l65oYkV01DJKRL0ikLaGEd:aY4w/5YTlKRLc2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

svartalfheim.top
jotunheim.name

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

New Service
T1050

Executes dropped EXE 1 IoCs

pid	Process
3036	szzdeoyj.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
2868	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ccesdnvv\ImagePath = "C:\\Windows\\SysWOW64\\ccesdnvv\\szzdeoyj.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	file.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3036 set thread context of 4176	3036	szzdeoyj.exe	103

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3180	sc.exe
2076	sc.exe
4704	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2492	1496	WerFault.exe	78
4312	3036	WerFault.exe	100

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 224	1496	file.exe	84
PID 1496 wrote to memory of 224	1496	file.exe	84
PID 1496 wrote to memory of 224	1496	file.exe	84
PID 1496 wrote to memory of 4596	1496	file.exe	86
PID 1496 wrote to memory of 4596	1496	file.exe	86
PID 1496 wrote to memory of 4596	1496	file.exe	86
PID 1496 wrote to memory of 2076	1496	file.exe	89
PID 1496 wrote to memory of 2076	1496	file.exe	89
PID 1496 wrote to memory of 2076	1496	file.exe	89
PID 1496 wrote to memory of 4704	1496	file.exe	90
PID 1496 wrote to memory of 4704	1496	file.exe	90
PID 1496 wrote to memory of 4704	1496	file.exe	90
PID 1496 wrote to memory of 3180	1496	file.exe	93
PID 1496 wrote to memory of 3180	1496	file.exe	93
PID 1496 wrote to memory of 3180	1496	file.exe	93
PID 1496 wrote to memory of 2868	1496	file.exe	95
PID 1496 wrote to memory of 2868	1496	file.exe	95
PID 1496 wrote to memory of 2868	1496	file.exe	95
PID 3036 wrote to memory of 4176	3036	szzdeoyj.exe	103
PID 3036 wrote to memory of 4176	3036	szzdeoyj.exe	103
PID 3036 wrote to memory of 4176	3036	szzdeoyj.exe	103
PID 3036 wrote to memory of 4176	3036	szzdeoyj.exe	103
PID 3036 wrote to memory of 4176	3036	szzdeoyj.exe	103

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ccesdnvv\
  2⤵
  PID:224
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\szzdeoyj.exe" C:\Windows\SysWOW64\ccesdnvv\
  2⤵
  PID:4596
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create ccesdnvv binPath= "C:\Windows\SysWOW64\ccesdnvv\szzdeoyj.exe /d\"C:\Users\Admin\AppData\Local\Temp\file.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:2076
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description ccesdnvv "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:4704
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start ccesdnvv
  2⤵
  - Launches sc.exe
  PID:3180
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:2868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1496 -s 1036
  2⤵
  - Program crash
  PID:2492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1496 -ip 1496
1⤵
PID:4264

C:\Windows\SysWOW64\ccesdnvv\szzdeoyj.exe
C:\Windows\SysWOW64\ccesdnvv\szzdeoyj.exe /d"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  PID:4176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 536
  2⤵
  - Program crash
  PID:4312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3036 -ip 3036
1⤵
PID:3820

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

New Service

T1050

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

New Service

T1050

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

szzdeoyj.exe

Path C:\Users\Admin\AppData\Local\Temp\szzdeoyj.exe
Size 12.7MB
SHA256 c2951301915baa9f5aba8931464d93c92ec059fa14f1c6bc64f16d48f2b0d2df
MD5 baa93cd6497985cd02b459fb6147203f
SHA1 342e88e4315d24eb1caa9edbb391644ef9c1fb1e
SHA512 1bd61f3d75d69879700493e3422e98d6e9970d51dd1f3407c31fcc1bebe2613194401a764216ed6b7906b4db988b90e33e6179af3d53c0c771810fc9fdfa0d1e
SSDEEP 98304:LRtggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggn:LR
MD5 SHA1 SHA512 SSDEEP

Submit Download

szzdeoyj.exe

Path C:\Windows\SysWOW64\ccesdnvv\szzdeoyj.exe
Size 12.7MB
SHA256 c2951301915baa9f5aba8931464d93c92ec059fa14f1c6bc64f16d48f2b0d2df
MD5 baa93cd6497985cd02b459fb6147203f
SHA1 342e88e4315d24eb1caa9edbb391644ef9c1fb1e
SHA512 1bd61f3d75d69879700493e3422e98d6e9970d51dd1f3407c31fcc1bebe2613194401a764216ed6b7906b4db988b90e33e6179af3d53c0c771810fc9fdfa0d1e
SSDEEP 98304:LRtggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggn:LR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1496-140-0x0000000002810000-0x0000000002823000-memory.dmp

Download

memory/1496-134-0x0000000000400000-0x0000000000AD7000-memory.dmp

Download

memory/1496-145-0x0000000000400000-0x0000000000AD7000-memory.dmp

Download

memory/1496-139-0x0000000000BBD000-0x0000000000BCE000-memory.dmp

Download

memory/1496-132-0x0000000000BBD000-0x0000000000BCE000-memory.dmp

Download

memory/1496-133-0x0000000002810000-0x0000000002823000-memory.dmp

Download

memory/3036-152-0x0000000000400000-0x0000000000AD7000-memory.dmp

Download

memory/3036-150-0x0000000000B38000-0x0000000000B49000-memory.dmp

Download

memory/4176-147-0x0000000000F70000-0x0000000000F85000-memory.dmp

Download

memory/4176-151-0x0000000000F70000-0x0000000000F85000-memory.dmp

Download

memory/4176-153-0x0000000000F70000-0x0000000000F85000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads