tofsee | b2d8b284abe5009c7d96880d70adae512804f2de7c625ed6b523ce5bcba17b1d

Analysis

max time kernel
210s
max time network
36s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 07:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 149KB
Sample221127-je84vadg21
SHA256 b2d8b284abe5009c7d96880d70adae512804f2de7c625ed6b523ce5bcba17b1d
MD5 ef051fdeb729b7f43fc0b035e5cdb481
SHA1 0ddb7405974f3376b07c58d27c332e16c0850ac1
SHA512 97dfe35f212f4c7050718c400c2858598b83aefad5a46d88a15bb514e16a3d1c69a102141c97c6ad835d00f707f147c729559cb34fa0be4ad9a79f801062149e
SSDEEP 3072:pmPvUpleluB5Nk8lfEyjJQQ9WYRQV1WC:qQelSk83JQAeV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

svartalfheim.top
jotunheim.name

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

New Service
T1050

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
868	netsh.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1328	sc.exe
1304	sc.exe
1108	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 512	1736	file.exe	28
PID 1736 wrote to memory of 512	1736	file.exe	28
PID 1736 wrote to memory of 512	1736	file.exe	28
PID 1736 wrote to memory of 512	1736	file.exe	28
PID 1736 wrote to memory of 1176	1736	file.exe	30
PID 1736 wrote to memory of 1176	1736	file.exe	30
PID 1736 wrote to memory of 1176	1736	file.exe	30
PID 1736 wrote to memory of 1176	1736	file.exe	30
PID 1736 wrote to memory of 1328	1736	file.exe	32
PID 1736 wrote to memory of 1328	1736	file.exe	32
PID 1736 wrote to memory of 1328	1736	file.exe	32
PID 1736 wrote to memory of 1328	1736	file.exe	32
PID 1736 wrote to memory of 1304	1736	file.exe	34
PID 1736 wrote to memory of 1304	1736	file.exe	34
PID 1736 wrote to memory of 1304	1736	file.exe	34
PID 1736 wrote to memory of 1304	1736	file.exe	34
PID 1736 wrote to memory of 1108	1736	file.exe	36
PID 1736 wrote to memory of 1108	1736	file.exe	36
PID 1736 wrote to memory of 1108	1736	file.exe	36
PID 1736 wrote to memory of 1108	1736	file.exe	36
PID 1736 wrote to memory of 868	1736	file.exe	38
PID 1736 wrote to memory of 868	1736	file.exe	38
PID 1736 wrote to memory of 868	1736	file.exe	38
PID 1736 wrote to memory of 868	1736	file.exe	38

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\jkrgcuuy\
  2⤵
  PID:512
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\oiksoioh.exe" C:\Windows\SysWOW64\jkrgcuuy\
  2⤵
  PID:1176
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create jkrgcuuy binPath= "C:\Windows\SysWOW64\jkrgcuuy\oiksoioh.exe /d\"C:\Users\Admin\AppData\Local\Temp\file.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:1328
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description jkrgcuuy "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:1304
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start jkrgcuuy
  2⤵
  - Launches sc.exe
  PID:1108
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:868

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

New Service

T1050

Privilege Escalation

New Service

T1050

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

oiksoioh.exe

Path C:\Users\Admin\AppData\Local\Temp\oiksoioh.exe
Size 12.9MB
SHA256 5711798cfdb53500c04d8c0e9e70cd34b6f9b2ad1d995d6f04fcd47099e18561
MD5 6a0301d2415cd9c94843e57c82804b67
SHA1 76005c1874ce9f7846f19544007bfc74b6a01ef5
SHA512 6573e555cb3ed66a8045da651b008cdef342f667f02850d8ba72cb2d7e31578388b331d3015cb4b61dc1893ed41e0d735e8570078035b6481e1d48357f746dfb
SSDEEP 6144:+QelSk83JQAeVccccccccccccccccccccccccccccccccccccccccccccccccccc:+HimR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1736-57-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/1736-56-0x0000000075D51000-0x0000000075D53000-memory.dmp

Download

memory/1736-54-0x00000000005AD000-0x00000000005BE000-memory.dmp

Download

memory/1736-64-0x00000000005AD000-0x00000000005BE000-memory.dmp

Download

memory/1736-65-0x0000000000220000-0x0000000000233000-memory.dmp

Download

memory/1736-67-0x00000000005AD000-0x00000000005BE000-memory.dmp

Download

memory/1736-55-0x0000000000220000-0x0000000000233000-memory.dmp

Download

memory/1736-68-0x0000000000400000-0x000000000045B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads