tofsee | 14f1c5fe5252ff9a7e4822fa16e763f691c0c64bd5ab2b2b29496fdc4913c0c5

Analysis

max time kernel
144s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21/12/2022, 22:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 228KB
Sample221221-2tywjade86
SHA256 14f1c5fe5252ff9a7e4822fa16e763f691c0c64bd5ab2b2b29496fdc4913c0c5
MD5 130afbca34ff51b5656ebc40a6f3655d
SHA1 37d084f49a15ced7f7cf2c77a9c65edfcca7acd8
SHA512 c1569c24ce873343b33987f920cb1c0803669c33b039ca17a05e3b6285822db86d58151d4ebdd524cb2d550a7d9ddb463ae345137cc616f510678781bd21f521
SSDEEP 3072:Mz5DvxmLqGUm5msitOFE4gSqWzL887yvYLW4P84nPwW1NcNQK1+eJV5u43:4LwLqGsOeqJ7yvuW85PwW7eRu4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

svartalfheim.top
jotunheim.name

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

New Service
T1050

Executes dropped EXE 1 IoCs

pid	Process
4208	mttxyisd.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
1440	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\hnwubgq\ImagePath = "C:\\Windows\\SysWOW64\\hnwubgq\\mttxyisd.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	file.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile:.repos	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile:.repos	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4208 set thread context of 2780	4208	mttxyisd.exe	98

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5116	sc.exe
4248	sc.exe
1768	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3376	4260	WerFault.exe	79
4704	4208	WerFault.exe	90

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\Buses\Config0 = 008d393df6b1890124edb47d450dd49d084297dce82e72baa4c0018a480eea1df17decf387cd945d24edb47d470dd49d024195daf71261adc06d04fda6e22673bbc9154961cda56810d8804e723eeda4644490bdb57821ed945c04c4fdb854758df21d5904e0a56517d5874b7635d4f10b4c90d8f6127db9a4593494b48d792fd49a4c0936fda16815edc70f3252a0f40948f488b27925eb955800c4c4e13b7e85c12b496da0f15d15d88048703ee2a9541ff4	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\Buses\Config0 = 008d393d33b0890124edb47d450dd49d084297dce82e72baa4c0018a480eea1da638c32d80cd945d24edb47d470dd49d024195daf71261adc06d04fda6e22673bbc9154961cda56810d8804e723eeda4644490bdb57821ed945c04c4fdb854758df21d5904e0a56517d5874b7635d4f10b4c90d8f6127db9a4593494b48d792fd49a4c0936fda16815edc70f3252a0f40948f48cb77e24ed92590cc5f78d387287cc186270a4f93824dc81497139e7ab501ac5bd	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Buses	svchost.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 4884	4260	file.exe	80
PID 4260 wrote to memory of 4884	4260	file.exe	80
PID 4260 wrote to memory of 4884	4260	file.exe	80
PID 4260 wrote to memory of 1412	4260	file.exe	82
PID 4260 wrote to memory of 1412	4260	file.exe	82
PID 4260 wrote to memory of 1412	4260	file.exe	82
PID 4260 wrote to memory of 5116	4260	file.exe	84
PID 4260 wrote to memory of 5116	4260	file.exe	84
PID 4260 wrote to memory of 5116	4260	file.exe	84
PID 4260 wrote to memory of 4248	4260	file.exe	86
PID 4260 wrote to memory of 4248	4260	file.exe	86
PID 4260 wrote to memory of 4248	4260	file.exe	86
PID 4260 wrote to memory of 1768	4260	file.exe	88
PID 4260 wrote to memory of 1768	4260	file.exe	88
PID 4260 wrote to memory of 1768	4260	file.exe	88
PID 4260 wrote to memory of 1440	4260	file.exe	91
PID 4260 wrote to memory of 1440	4260	file.exe	91
PID 4260 wrote to memory of 1440	4260	file.exe	91
PID 4208 wrote to memory of 2780	4208	mttxyisd.exe	98
PID 4208 wrote to memory of 2780	4208	mttxyisd.exe	98
PID 4208 wrote to memory of 2780	4208	mttxyisd.exe	98
PID 4208 wrote to memory of 2780	4208	mttxyisd.exe	98
PID 4208 wrote to memory of 2780	4208	mttxyisd.exe	98

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\hnwubgq\
  2⤵
  PID:4884
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\mttxyisd.exe" C:\Windows\SysWOW64\hnwubgq\
  2⤵
  PID:1412
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create hnwubgq binPath= "C:\Windows\SysWOW64\hnwubgq\mttxyisd.exe /d\"C:\Users\Admin\AppData\Local\Temp\file.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:5116
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description hnwubgq "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:4248
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start hnwubgq
  2⤵
  - Launches sc.exe
  PID:1768
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:1440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 1044
  2⤵
  - Program crash
  PID:3376

C:\Windows\SysWOW64\hnwubgq\mttxyisd.exe
C:\Windows\SysWOW64\hnwubgq\mttxyisd.exe /d"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4208
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:2780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4208 -s 532
  2⤵
  - Program crash
  PID:4704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4260 -ip 4260
1⤵
PID:3764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4208 -ip 4208
1⤵
PID:5088

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

New Service

T1050

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

New Service

T1050

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mttxyisd.exe

Path C:\Users\Admin\AppData\Local\Temp\mttxyisd.exe
Size 12.2MB
SHA256 2b34607e607dc974e82821b7323ed4c5eb092656859026fb4a59ee6a2f05d455
MD5 2dd7fb2bb6684cc02aefde91ceee2168
SHA1 9dbdc90c5fb59bca0c16bec9a0c8f4a617e39e11
SHA512 e910bd036bfbf177d16adf9536513aaf15d03957c5084b1f7fcdc5c20604ac8b8fdf767d1a2db5790807c203dacc43cfa1257905344779f0bc425645c6c5c184
SSDEEP 196608:bEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEs:
MD5 SHA1 SHA512 SSDEEP

Submit Download

mttxyisd.exe

Path C:\Windows\SysWOW64\hnwubgq\mttxyisd.exe
Size 12.2MB
SHA256 2b34607e607dc974e82821b7323ed4c5eb092656859026fb4a59ee6a2f05d455
MD5 2dd7fb2bb6684cc02aefde91ceee2168
SHA1 9dbdc90c5fb59bca0c16bec9a0c8f4a617e39e11
SHA512 e910bd036bfbf177d16adf9536513aaf15d03957c5084b1f7fcdc5c20604ac8b8fdf767d1a2db5790807c203dacc43cfa1257905344779f0bc425645c6c5c184
SSDEEP 196608:bEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEs:
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2780-153-0x00000000004C0000-0x00000000004D5000-memory.dmp

Download

memory/2780-152-0x00000000004C0000-0x00000000004D5000-memory.dmp

Download

memory/2780-147-0x00000000004C0000-0x00000000004D5000-memory.dmp

Download

memory/4208-150-0x000000000061D000-0x000000000062E000-memory.dmp

Download

memory/4208-151-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4260-132-0x0000000000493000-0x00000000004A4000-memory.dmp

Download

memory/4260-143-0x0000000000493000-0x00000000004A4000-memory.dmp

Download

memory/4260-144-0x00000000007D0000-0x00000000007E3000-memory.dmp

Download

memory/4260-145-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4260-133-0x00000000007D0000-0x00000000007E3000-memory.dmp

Download

memory/4260-134-0x0000000000400000-0x0000000000462000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads