tofsee | a584c2d622d8b34069c74843da9cd64d9c0ed95a629ec590ba30a799563defcf

Analysis

max time kernel
381s
max time network
420s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 02:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 186KB
Sample221201-cma4fsaa6x
SHA256 a584c2d622d8b34069c74843da9cd64d9c0ed95a629ec590ba30a799563defcf
MD5 4ca6ed27d44d5fabbfb27f3496615d32
SHA1 c54e3fa112487822dd35caa8d91b24bc5245f11d
SHA512 8a4f88462ec0692e7a782add379a9b9b03ad6232427fe88b7a51f25e851cf01ac01bae1a1275e7ee61041a0c60a1bcf72b7e5667889a9e18a8796663a26e532f
SSDEEP 3072:KyFMS2mF3eZcpL47r654iw5pZSedVUiD19ujH3Xv4RbKRw+6pPdb6TY:jMtmccpL4ywDZjV5banv4t+Mhdi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee trojan

Malware Config

Extracted

Family

tofsee

svartalfheim.top
jotunheim.name

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	file.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 3856	4568	file.exe	80
PID 4568 wrote to memory of 3856	4568	file.exe	80
PID 4568 wrote to memory of 3856	4568	file.exe	80
PID 4568 wrote to memory of 4700	4568	file.exe	82
PID 4568 wrote to memory of 4700	4568	file.exe	82
PID 4568 wrote to memory of 4700	4568	file.exe	82

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ygppqsan\
  2⤵
  PID:3856
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\fmmqrblw.exe" C:\Windows\SysWOW64\ygppqsan\
  2⤵
  PID:4700

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fmmqrblw.exe

Path C:\Users\Admin\AppData\Local\Temp\fmmqrblw.exe
Size 13.7MB
SHA256 882af2c7833729056a24513b3204ee29ad0d2a628320e24587cfc61455d93546
MD5 3f2b74e04da23b20153e415080577ea3
SHA1 724c7fdb6d9c9d9e5323411ec33d43b7b21a1d20
SHA512 cc1e41dd943a401e833ad40be3256029642173fe24575e9fd819e9578a46102c4b8e20a6db011edbbe6ee2902c82d131dbb51cfb874d2f6798f59e82ef28ba67
SSDEEP 98304:nOWAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3:
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4568-132-0x000000000073D000-0x000000000074E000-memory.dmp

Download

memory/4568-133-0x00000000005B0000-0x00000000005C3000-memory.dmp

Download

memory/4568-134-0x000000000073D000-0x000000000074E000-memory.dmp

Download

memory/4568-135-0x0000000000400000-0x0000000000464000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads