tofsee | 4ffd8a5153b680b86b258bde87319885182c5e078cc0c0b16ab64009f7c69979

Analysis

max time kernel
150s
max time network
149s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
02-12-2022 06:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ffd8a5153b680b86b258bde87319885182c5e078cc0c0b16ab64009f7c69979.exe
Size

276KB
MD5

8861c3fedd83a41ca2637215c3bea553
SHA1

9394b1527afa8de77c962e0895c681819cb2a529
SHA256

4ffd8a5153b680b86b258bde87319885182c5e078cc0c0b16ab64009f7c69979
SHA512

f1e21803aee16d146737284e491685e084b3d0a65e42986d4a4c5233f4860d309e7aa12cd8516baca7ad9384dd8ac43f67fdd2866e7e4b453b184e458eb87653
SSDEEP

3072:exZL86CsL1KL6+tq5qt0OETP2F4HaNMX027CP1JTJbLCrhIh3eGjMgG1ao5Lk:NVsLML6+nt07J8OrOHNPSuRjMgU

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

svartalfheim.top

jotunheim.name

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\gxmqnesf = "0"	svchost.exe

Creates new service(s) 1 TTPs
persistence

New Service
T1050
Executes dropped EXE 1 IoCs

Processes:

gdxyvdta.exe

pid process

4388 gdxyvdta.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1608 netsh.exe

pid	process
4388	gdxyvdta.exe

pid	process
1608	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\gxmqnesf\ImagePath = "C:\\Windows\\SysWOW64\\gxmqnesf\\gdxyvdta.exe"	svchost.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

4512 svchost.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

gdxyvdta.exe

description pid process target process

PID 4388 set thread context of 4512 4388 gdxyvdta.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

3528 sc.exe
928 sc.exe
3040 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
4512	svchost.exe

description	pid	process	target process
PID 4388 set thread context of 4512	4388	gdxyvdta.exe	svchost.exe

pid	process
3528	sc.exe
928	sc.exe
3040	sc.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

4ffd8a5153b680b86b258bde87319885182c5e078cc0c0b16ab64009f7c69979.exegdxyvdta.exe

description	pid	process	target process
PID 2700 wrote to memory of 4744	2700	4ffd8a5153b680b86b258bde87319885182c5e078cc0c0b16ab64009f7c69979.exe	cmd.exe
PID 2700 wrote to memory of 4744	2700	4ffd8a5153b680b86b258bde87319885182c5e078cc0c0b16ab64009f7c69979.exe	cmd.exe
PID 2700 wrote to memory of 4744	2700	4ffd8a5153b680b86b258bde87319885182c5e078cc0c0b16ab64009f7c69979.exe	cmd.exe
PID 2700 wrote to memory of 4888	2700	4ffd8a5153b680b86b258bde87319885182c5e078cc0c0b16ab64009f7c69979.exe	cmd.exe
PID 2700 wrote to memory of 4888	2700	4ffd8a5153b680b86b258bde87319885182c5e078cc0c0b16ab64009f7c69979.exe	cmd.exe
PID 2700 wrote to memory of 4888	2700	4ffd8a5153b680b86b258bde87319885182c5e078cc0c0b16ab64009f7c69979.exe	cmd.exe
PID 2700 wrote to memory of 3528	2700	4ffd8a5153b680b86b258bde87319885182c5e078cc0c0b16ab64009f7c69979.exe	sc.exe
PID 2700 wrote to memory of 3528	2700	4ffd8a5153b680b86b258bde87319885182c5e078cc0c0b16ab64009f7c69979.exe	sc.exe
PID 2700 wrote to memory of 3528	2700	4ffd8a5153b680b86b258bde87319885182c5e078cc0c0b16ab64009f7c69979.exe	sc.exe
PID 2700 wrote to memory of 928	2700	4ffd8a5153b680b86b258bde87319885182c5e078cc0c0b16ab64009f7c69979.exe	sc.exe
PID 2700 wrote to memory of 928	2700	4ffd8a5153b680b86b258bde87319885182c5e078cc0c0b16ab64009f7c69979.exe	sc.exe
PID 2700 wrote to memory of 928	2700	4ffd8a5153b680b86b258bde87319885182c5e078cc0c0b16ab64009f7c69979.exe	sc.exe
PID 2700 wrote to memory of 3040	2700	4ffd8a5153b680b86b258bde87319885182c5e078cc0c0b16ab64009f7c69979.exe	sc.exe
PID 2700 wrote to memory of 3040	2700	4ffd8a5153b680b86b258bde87319885182c5e078cc0c0b16ab64009f7c69979.exe	sc.exe
PID 2700 wrote to memory of 3040	2700	4ffd8a5153b680b86b258bde87319885182c5e078cc0c0b16ab64009f7c69979.exe	sc.exe
PID 2700 wrote to memory of 1608	2700	4ffd8a5153b680b86b258bde87319885182c5e078cc0c0b16ab64009f7c69979.exe	netsh.exe
PID 2700 wrote to memory of 1608	2700	4ffd8a5153b680b86b258bde87319885182c5e078cc0c0b16ab64009f7c69979.exe	netsh.exe
PID 2700 wrote to memory of 1608	2700	4ffd8a5153b680b86b258bde87319885182c5e078cc0c0b16ab64009f7c69979.exe	netsh.exe
PID 4388 wrote to memory of 4512	4388	gdxyvdta.exe	svchost.exe
PID 4388 wrote to memory of 4512	4388	gdxyvdta.exe	svchost.exe
PID 4388 wrote to memory of 4512	4388	gdxyvdta.exe	svchost.exe
PID 4388 wrote to memory of 4512	4388	gdxyvdta.exe	svchost.exe
PID 4388 wrote to memory of 4512	4388	gdxyvdta.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\4ffd8a5153b680b86b258bde87319885182c5e078cc0c0b16ab64009f7c69979.exe
"C:\Users\Admin\AppData\Local\Temp\4ffd8a5153b680b86b258bde87319885182c5e078cc0c0b16ab64009f7c69979.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2700

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\gxmqnesf\
2⤵
PID:4744

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\gdxyvdta.exe" C:\Windows\SysWOW64\gxmqnesf\
2⤵
PID:4888

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create gxmqnesf binPath= "C:\Windows\SysWOW64\gxmqnesf\gdxyvdta.exe /d\"C:\Users\Admin\AppData\Local\Temp\4ffd8a5153b680b86b258bde87319885182c5e078cc0c0b16ab64009f7c69979.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:3528

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description gxmqnesf "wifi internet conection"
2⤵
- Launches sc.exe
PID:928

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start gxmqnesf
2⤵
- Launches sc.exe
PID:3040

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:1608

C:\Windows\SysWOW64\gxmqnesf\gdxyvdta.exe
C:\Windows\SysWOW64\gxmqnesf\gdxyvdta.exe /d"C:\Users\Admin\AppData\Local\Temp\4ffd8a5153b680b86b258bde87319885182c5e078cc0c0b16ab64009f7c69979.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4388

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
PID:4512

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

New Service

T1050

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

New Service

T1050

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gdxyvdta.exe
Filesize
10.1MB

MD5
99c693b9de5430d043fecb641036976e

SHA1
c9cf07995b9ee30cf0ceab6b035d887cba4095ae

SHA256
ee5f0c89b4b218292c072dcfe1320e5cd8dfdb30557a128ead287dc7bcbb27ec

SHA512
2629db7adcb3e1b9923133c1963ebf42259dfdb90dca282f9e38c7bd1493141c679c9fc7538b675d13ff784cf290d8cb735dcbbdff29a83212ab0c023aece995

Download Submit
C:\Windows\SysWOW64\gxmqnesf\gdxyvdta.exe
Filesize
10.1MB

MD5
99c693b9de5430d043fecb641036976e

SHA1
c9cf07995b9ee30cf0ceab6b035d887cba4095ae

SHA256
ee5f0c89b4b218292c072dcfe1320e5cd8dfdb30557a128ead287dc7bcbb27ec

SHA512
2629db7adcb3e1b9923133c1963ebf42259dfdb90dca282f9e38c7bd1493141c679c9fc7538b675d13ff784cf290d8cb735dcbbdff29a83212ab0c023aece995

Download Submit
memory/928-185-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/928-187-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/928-184-0x0000000000000000-mapping.dmp

Download
memory/1608-212-0x0000000000000000-mapping.dmp

Download
memory/2700-157-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-148-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-124-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-125-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-126-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-127-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-128-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-129-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-131-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-132-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-133-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-134-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-135-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-136-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-137-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-138-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-139-0x0000000000560000-0x00000000006AA000-memory.dmp

Filesize
1.3MB

Download
memory/2700-140-0x0000000000520000-0x0000000000533000-memory.dmp

Filesize
76KB

Download
memory/2700-141-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-142-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-143-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-144-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-145-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-146-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-147-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-163-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-149-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-150-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-151-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-152-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-153-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-154-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-155-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-156-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2700-116-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-158-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-159-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-160-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-161-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-119-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-123-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-164-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-165-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-117-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-216-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2700-215-0x0000000000520000-0x0000000000533000-memory.dmp

Filesize
76KB

Download
memory/2700-118-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-162-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-120-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-121-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-122-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/3040-198-0x0000000000000000-mapping.dmp

Download
memory/3528-186-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-188-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-179-0x0000000000000000-mapping.dmp

Download
memory/3528-180-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-182-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-183-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-181-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/4388-338-0x0000000000450000-0x00000000004FE000-memory.dmp

Filesize
696KB

Download
memory/4388-357-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/4388-340-0x0000000000450000-0x00000000004FE000-memory.dmp

Filesize
696KB

Download
memory/4512-483-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/4512-353-0x0000000000C89A6B-mapping.dmp

Download
memory/4512-443-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/4744-170-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/4744-176-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/4744-169-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/4744-168-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/4744-167-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/4744-166-0x0000000000000000-mapping.dmp

Download
memory/4888-172-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/4888-177-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/4888-173-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/4888-175-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/4888-174-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/4888-171-0x0000000000000000-mapping.dmp

Download