tofsee | d2363a2f08c7a16ad6feef15bd342060822ed7908ddc6923ff84a9d5c5fa5fed

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2023, 00:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 267KB
Sample230111-avmfcaaa99
SHA256 d2363a2f08c7a16ad6feef15bd342060822ed7908ddc6923ff84a9d5c5fa5fed
MD5 a5e9b6c198fcbb112c7465c22fc0c749
SHA1 ca3a73c2ef47ae6d128a0711a79184e81b62114c
SHA512 efba842c0ac06db14bbeaeb2b408e7b06c11f5d7104ff887db146282308643bfa9364574ca8bf2e7b41dab5d2cd844750861d9493d08dd62d430c6cf48336922
SSDEEP 3072:rXEQfL/7MHFLaEmrMT25JFlm0k3ZU5MUzPS7gsupupKa3BNCanng0Pb:D90HFLFTiTkm5MUzPS7maRNng6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

svartalfheim.top
jotunheim.name

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

New Service
T1050

Executes dropped EXE 1 IoCs

pid	Process
3316	fmmqrblw.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
4168	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nbcwsgek\ImagePath = "C:\\Windows\\SysWOW64\\nbcwsgek\\fmmqrblw.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	file.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3316 set thread context of 3884	3316	fmmqrblw.exe	99

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1568	sc.exe
1340	sc.exe
428	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4612	3316	WerFault.exe	94
2676	3316	WerFault.exe	94
2816	3316	WerFault.exe	94

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 4656	3048	file.exe	82
PID 3048 wrote to memory of 4656	3048	file.exe	82
PID 3048 wrote to memory of 4656	3048	file.exe	82
PID 3048 wrote to memory of 4304	3048	file.exe	85
PID 3048 wrote to memory of 4304	3048	file.exe	85
PID 3048 wrote to memory of 4304	3048	file.exe	85
PID 3048 wrote to memory of 428	3048	file.exe	87
PID 3048 wrote to memory of 428	3048	file.exe	87
PID 3048 wrote to memory of 428	3048	file.exe	87
PID 3048 wrote to memory of 1568	3048	file.exe	89
PID 3048 wrote to memory of 1568	3048	file.exe	89
PID 3048 wrote to memory of 1568	3048	file.exe	89
PID 3048 wrote to memory of 1340	3048	file.exe	92
PID 3048 wrote to memory of 1340	3048	file.exe	92
PID 3048 wrote to memory of 1340	3048	file.exe	92
PID 3048 wrote to memory of 4168	3048	file.exe	95
PID 3048 wrote to memory of 4168	3048	file.exe	95
PID 3048 wrote to memory of 4168	3048	file.exe	95
PID 3316 wrote to memory of 3884	3316	fmmqrblw.exe	99
PID 3316 wrote to memory of 3884	3316	fmmqrblw.exe	99
PID 3316 wrote to memory of 3884	3316	fmmqrblw.exe	99
PID 3316 wrote to memory of 3884	3316	fmmqrblw.exe	99
PID 3316 wrote to memory of 3884	3316	fmmqrblw.exe	99

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\nbcwsgek\
  2⤵
  PID:4656
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\fmmqrblw.exe" C:\Windows\SysWOW64\nbcwsgek\
  2⤵
  PID:4304
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create nbcwsgek binPath= "C:\Windows\SysWOW64\nbcwsgek\fmmqrblw.exe /d\"C:\Users\Admin\AppData\Local\Temp\file.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:428
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description nbcwsgek "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:1568
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start nbcwsgek
  2⤵
  - Launches sc.exe
  PID:1340
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:4168

C:\Windows\SysWOW64\nbcwsgek\fmmqrblw.exe
C:\Windows\SysWOW64\nbcwsgek\fmmqrblw.exe /d"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  PID:3884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 680
  2⤵
  - Program crash
  PID:4612
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 944
  2⤵
  - Program crash
  PID:2676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 952
  2⤵
  - Program crash
  PID:2816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3316 -ip 3316
1⤵
PID:4792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 3316 -ip 3316
1⤵
PID:2568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3316 -ip 3316
1⤵
PID:2824

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

New Service

T1050

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

New Service

T1050

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fmmqrblw.exe

Path C:\Users\Admin\AppData\Local\Temp\fmmqrblw.exe
Size 12.3MB
SHA256 b3d83d2626f84bbf3ea0e90cb0c28094f0291d1127e8afb19694ce92086b6228
MD5 f3b24e093ac309227b4770f94c7399b8
SHA1 fa12c6d606bfeae26eeb89b942ab52048c8494dc
SHA512 2e369a5859355e5e91858ea80c410ddfc7496722c3d1af7414abe04175e0f2b968174c7ed7023ac21db36089e35b07a421d76387be76e947c85e7bde1b36768e
SSDEEP 393216:M777777777777777777777777777777777777777777777777777777777777777:
MD5 SHA1 SHA512 SSDEEP

Submit Download

fmmqrblw.exe

Path C:\Windows\SysWOW64\nbcwsgek\fmmqrblw.exe
Size 12.3MB
SHA256 b3d83d2626f84bbf3ea0e90cb0c28094f0291d1127e8afb19694ce92086b6228
MD5 f3b24e093ac309227b4770f94c7399b8
SHA1 fa12c6d606bfeae26eeb89b942ab52048c8494dc
SHA512 2e369a5859355e5e91858ea80c410ddfc7496722c3d1af7414abe04175e0f2b968174c7ed7023ac21db36089e35b07a421d76387be76e947c85e7bde1b36768e
SSDEEP 393216:M777777777777777777777777777777777777777777777777777777777777777:
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3048-132-0x0000000002ECD000-0x0000000002EDD000-memory.dmp

Download

memory/3048-133-0x0000000002E00000-0x0000000002E13000-memory.dmp

Download

memory/3048-152-0x0000000000400000-0x0000000002BAB000-memory.dmp

Download

memory/3048-151-0x0000000002ECD000-0x0000000002EDD000-memory.dmp

Download

memory/3048-136-0x0000000000400000-0x0000000002BAB000-memory.dmp

Download

memory/3316-149-0x0000000000400000-0x0000000002BAB000-memory.dmp

Download

memory/3316-147-0x0000000002DF9000-0x0000000002E09000-memory.dmp

Download

memory/3316-148-0x0000000002CF0000-0x0000000002D03000-memory.dmp

Download

memory/3316-153-0x0000000000400000-0x0000000002BAB000-memory.dmp

Download

memory/3884-144-0x0000000000DD0000-0x0000000000DE5000-memory.dmp

Download

memory/3884-150-0x0000000000DD0000-0x0000000000DE5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads