tofsee | 29958e28ed0f0649797e2d6450d934c6022ab672105e32283d3f8090f2f48fe5

General

Target

file.exe
Size

192KB
MD5

99c46fe2f6560e5f52c912fe41ebf031
SHA1

09cfc9287b737405326a14ed100b0d109386b188
SHA256

29958e28ed0f0649797e2d6450d934c6022ab672105e32283d3f8090f2f48fe5
SHA512

8aa7c5fdf6fb15ebe857f1046daea8c47bb400110702f1ab02f96c0f75721753821d55e64ff0977903b526b3ca8cc0330e88944582e1a925e21f39614da9acec
SSDEEP

3072:ag7i0AlCXTi2I5VPJmVtmIq9lj/iZqXQ/8nzkNaRs9E3AZxpR/wQnzhx:3iUTi9BY8I///8n45vp+a

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

svartalfheim.top

jotunheim.name

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

New Service
T1050
Executes dropped EXE 1 IoCs

Processes:

wmszequj.exe

pid process

2292 wmszequj.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

728 netsh.exe

pid	process
2292	wmszequj.exe

pid	process
728	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\gecwmcky\ImagePath = "C:\\Windows\\SysWOW64\\gecwmcky\\wmszequj.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

file.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation file.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

wmszequj.exe

description pid process target process

PID 2292 set thread context of 2340 2292 wmszequj.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

4776 sc.exe
4704 sc.exe
1748 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

3764 3556 WerFault.exe file.exe
3960 2292 WerFault.exe wmszequj.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	file.exe

description	pid	process	target process
PID 2292 set thread context of 2340	2292	wmszequj.exe	svchost.exe

pid	process
4776	sc.exe
4704	sc.exe
1748	sc.exe

pid	pid_target	process	target process
3764	3556	WerFault.exe	file.exe
3960	2292	WerFault.exe	wmszequj.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

file.exewmszequj.exe

description	pid	process	target process
PID 3556 wrote to memory of 3712	3556	file.exe	cmd.exe
PID 3556 wrote to memory of 3712	3556	file.exe	cmd.exe
PID 3556 wrote to memory of 3712	3556	file.exe	cmd.exe
PID 3556 wrote to memory of 3676	3556	file.exe	cmd.exe
PID 3556 wrote to memory of 3676	3556	file.exe	cmd.exe
PID 3556 wrote to memory of 3676	3556	file.exe	cmd.exe
PID 3556 wrote to memory of 4704	3556	file.exe	sc.exe
PID 3556 wrote to memory of 4704	3556	file.exe	sc.exe
PID 3556 wrote to memory of 4704	3556	file.exe	sc.exe
PID 3556 wrote to memory of 1748	3556	file.exe	sc.exe
PID 3556 wrote to memory of 1748	3556	file.exe	sc.exe
PID 3556 wrote to memory of 1748	3556	file.exe	sc.exe
PID 3556 wrote to memory of 4776	3556	file.exe	sc.exe
PID 3556 wrote to memory of 4776	3556	file.exe	sc.exe
PID 3556 wrote to memory of 4776	3556	file.exe	sc.exe
PID 3556 wrote to memory of 728	3556	file.exe	netsh.exe
PID 3556 wrote to memory of 728	3556	file.exe	netsh.exe
PID 3556 wrote to memory of 728	3556	file.exe	netsh.exe
PID 2292 wrote to memory of 2340	2292	wmszequj.exe	svchost.exe
PID 2292 wrote to memory of 2340	2292	wmszequj.exe	svchost.exe
PID 2292 wrote to memory of 2340	2292	wmszequj.exe	svchost.exe
PID 2292 wrote to memory of 2340	2292	wmszequj.exe	svchost.exe
PID 2292 wrote to memory of 2340	2292	wmszequj.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3556

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\gecwmcky\
2⤵
PID:3712

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\wmszequj.exe" C:\Windows\SysWOW64\gecwmcky\
2⤵
PID:3676

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create gecwmcky binPath= "C:\Windows\SysWOW64\gecwmcky\wmszequj.exe /d\"C:\Users\Admin\AppData\Local\Temp\file.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:4704

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description gecwmcky "wifi internet conection"
2⤵
- Launches sc.exe
PID:1748

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start gecwmcky
2⤵
- Launches sc.exe
PID:4776

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3556 -s 1332
2⤵
- Program crash
PID:3764

C:\Windows\SysWOW64\gecwmcky\wmszequj.exe
C:\Windows\SysWOW64\gecwmcky\wmszequj.exe /d"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2292

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Sets service image path in registry
PID:2340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 512
2⤵
- Program crash
PID:3960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3556 -ip 3556
1⤵
PID:1000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2292 -ip 2292
1⤵
PID:1096

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

New Service

1

T1050

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

New Service

1

T1050

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\wmszequj.exe
Filesize
10.0MB

MD5
6bac34ece446acd262755b2befcbc297

SHA1
bef25c82d9399fe27040d3148262d2f226c52236

SHA256
5c40563c3783c5c3bca2fdf4a2536702bc9c44c3423d7a86e7152995d3a6ff23

SHA512
5a9a049dc92a5be1e961cc87d9f04357d990b2eae10c60584d4baf3c5c203eedb98ef457cd1aac12a865620e97241360d9f0eb31ce822eb89fc84d5f8bfa5ca9

Download Submit
C:\Windows\SysWOW64\gecwmcky\wmszequj.exe
Filesize
10.0MB

MD5
6bac34ece446acd262755b2befcbc297

SHA1
bef25c82d9399fe27040d3148262d2f226c52236

SHA256
5c40563c3783c5c3bca2fdf4a2536702bc9c44c3423d7a86e7152995d3a6ff23

SHA512
5a9a049dc92a5be1e961cc87d9f04357d990b2eae10c60584d4baf3c5c203eedb98ef457cd1aac12a865620e97241360d9f0eb31ce822eb89fc84d5f8bfa5ca9

Download Submit
memory/728-142-0x0000000000000000-mapping.dmp

Download
memory/1748-139-0x0000000000000000-mapping.dmp

Download
memory/2292-147-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2292-146-0x0000000000493000-0x00000000004A4000-memory.dmp

Filesize
68KB

Download
memory/2292-153-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2292-152-0x0000000000493000-0x00000000004A4000-memory.dmp

Filesize
68KB

Download
memory/2340-155-0x0000000000630000-0x0000000000645000-memory.dmp

Filesize
84KB

Download
memory/2340-154-0x0000000000630000-0x0000000000645000-memory.dmp

Filesize
84KB

Download
memory/2340-149-0x0000000000630000-0x0000000000645000-memory.dmp

Filesize
84KB

Download
memory/2340-148-0x0000000000000000-mapping.dmp

Download
memory/3556-133-0x0000000002070000-0x0000000002083000-memory.dmp

Filesize
76KB

Download
memory/3556-144-0x0000000002070000-0x0000000002083000-memory.dmp

Filesize
76KB

Download
memory/3556-132-0x00000000006E9000-0x00000000006FA000-memory.dmp

Filesize
68KB

Download
memory/3556-134-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3556-143-0x00000000006E9000-0x00000000006FA000-memory.dmp

Filesize
68KB

Download
memory/3556-145-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3676-136-0x0000000000000000-mapping.dmp

Download
memory/3712-135-0x0000000000000000-mapping.dmp

Download
memory/4704-138-0x0000000000000000-mapping.dmp

Download
memory/4776-140-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing