tofsee | 4e0f0ea902f9f9abc12a07faff5f5f84e54f8ed2adf8d25e40936e8c521fd3c2

Analysis

max time kernel
90s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/01/2023, 00:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 332KB
Sample230121-ag6xtsca5x
SHA256 4e0f0ea902f9f9abc12a07faff5f5f84e54f8ed2adf8d25e40936e8c521fd3c2
MD5 b530ef56f2930f7c937aa15668ff9179
SHA1 441923675709a27e64143768949efc9f96a4dc9c
SHA512 1ced22b0631db8d435fd9b81eba769f8c7bdf23393188b9a1287e7997bc7d5debd7acb5f6093f06e5a65f927f0093e1a774bad2a002207b7e8ecba6fc40c105d
SSDEEP 6144:P6LrxX8xBoCXDrURRGFS/fmwgCoZsBW473Ox:ifxX8z1D45g6ny
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

svartalfheim.top
jotunheim.name

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

New Service
T1050

Executes dropped EXE 2 IoCs

pid	Process
2364	lrezszmh.exe
2176	lrezszmh.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
528	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	file.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4708 set thread context of 1340	4708	file.exe	82
PID 2364 set thread context of 2176	2364	lrezszmh.exe	96

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3240	sc.exe
4600	sc.exe
1184	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 1340	4708	file.exe	82
PID 4708 wrote to memory of 1340	4708	file.exe	82
PID 4708 wrote to memory of 1340	4708	file.exe	82
PID 4708 wrote to memory of 1340	4708	file.exe	82
PID 4708 wrote to memory of 1340	4708	file.exe	82
PID 4708 wrote to memory of 1340	4708	file.exe	82
PID 4708 wrote to memory of 1340	4708	file.exe	82
PID 4708 wrote to memory of 1340	4708	file.exe	82
PID 4708 wrote to memory of 1340	4708	file.exe	82
PID 1340 wrote to memory of 1468	1340	file.exe	83
PID 1340 wrote to memory of 1468	1340	file.exe	83
PID 1340 wrote to memory of 1468	1340	file.exe	83
PID 1340 wrote to memory of 1260	1340	file.exe	85
PID 1340 wrote to memory of 1260	1340	file.exe	85
PID 1340 wrote to memory of 1260	1340	file.exe	85
PID 1340 wrote to memory of 3240	1340	file.exe	87
PID 1340 wrote to memory of 3240	1340	file.exe	87
PID 1340 wrote to memory of 3240	1340	file.exe	87
PID 1340 wrote to memory of 4600	1340	file.exe	89
PID 1340 wrote to memory of 4600	1340	file.exe	89
PID 1340 wrote to memory of 4600	1340	file.exe	89
PID 1340 wrote to memory of 1184	1340	file.exe	91
PID 1340 wrote to memory of 1184	1340	file.exe	91
PID 1340 wrote to memory of 1184	1340	file.exe	91
PID 1340 wrote to memory of 528	1340	file.exe	93
PID 1340 wrote to memory of 528	1340	file.exe	93
PID 1340 wrote to memory of 528	1340	file.exe	93
PID 2364 wrote to memory of 2176	2364	lrezszmh.exe	96
PID 2364 wrote to memory of 2176	2364	lrezszmh.exe	96
PID 2364 wrote to memory of 2176	2364	lrezszmh.exe	96
PID 2364 wrote to memory of 2176	2364	lrezszmh.exe	96
PID 2364 wrote to memory of 2176	2364	lrezszmh.exe	96
PID 2364 wrote to memory of 2176	2364	lrezszmh.exe	96
PID 2364 wrote to memory of 2176	2364	lrezszmh.exe	96
PID 2364 wrote to memory of 2176	2364	lrezszmh.exe	96
PID 2364 wrote to memory of 2176	2364	lrezszmh.exe	96

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1340
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\mkjzzwrl\
    3⤵
    PID:1468
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\lrezszmh.exe" C:\Windows\SysWOW64\mkjzzwrl\
    3⤵
    PID:1260
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" create mkjzzwrl binPath= "C:\Windows\SysWOW64\mkjzzwrl\lrezszmh.exe /d\"C:\Users\Admin\AppData\Local\Temp\file.exe\"" type= own start= auto DisplayName= "wifi support"
    3⤵
    - Launches sc.exe
    PID:3240
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" description mkjzzwrl "wifi internet conection"
    3⤵
    - Launches sc.exe
    PID:4600
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" start mkjzzwrl
    3⤵
    - Launches sc.exe
    PID:1184
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
    3⤵
    - Modifies Windows Firewall
    PID:528

C:\Windows\SysWOW64\mkjzzwrl\lrezszmh.exe
C:\Windows\SysWOW64\mkjzzwrl\lrezszmh.exe /d"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\SysWOW64\mkjzzwrl\lrezszmh.exe
  C:\Windows\SysWOW64\mkjzzwrl\lrezszmh.exe /d"C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Executes dropped EXE
  PID:2176

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

New Service

T1050

Privilege Escalation

New Service

T1050

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lrezszmh.exe

Path C:\Users\Admin\AppData\Local\Temp\lrezszmh.exe
Size 10.9MB
SHA256 cec0a69b41ae25bdf63b6e183e50b40d471234924f6a4551e7fab655538b50fc
MD5 adc560e057e1f677dceadc0d5ae32fc8
SHA1 9fc7b36cd9a601cf1b3fceb67df975fcb82a17d7
SHA512 67a4ce4c582320089899ffb5699fd99cb14a61cde186bc45fe61652e334f82382f0d27a182d251f999352b3628eb23dd526c47f115adc9467d44d341bb40af02
SSDEEP 6144:A6LrxX8xBoCXDrURRGFS/fmwgCoZsBW473Ox:zfxX8z1D45g6ny
MD5 SHA1 SHA512 SSDEEP

Submit Download

lrezszmh.exe

Path C:\Windows\SysWOW64\mkjzzwrl\lrezszmh.exe
Size 10.9MB
SHA256 cec0a69b41ae25bdf63b6e183e50b40d471234924f6a4551e7fab655538b50fc
MD5 adc560e057e1f677dceadc0d5ae32fc8
SHA1 9fc7b36cd9a601cf1b3fceb67df975fcb82a17d7
SHA512 67a4ce4c582320089899ffb5699fd99cb14a61cde186bc45fe61652e334f82382f0d27a182d251f999352b3628eb23dd526c47f115adc9467d44d341bb40af02
SSDEEP 6144:A6LrxX8xBoCXDrURRGFS/fmwgCoZsBW473Ox:zfxX8z1D45g6ny
MD5 SHA1 SHA512 SSDEEP

Submit Download

lrezszmh.exe

Path C:\Windows\SysWOW64\mkjzzwrl\lrezszmh.exe
Size 10.9MB
SHA256 cec0a69b41ae25bdf63b6e183e50b40d471234924f6a4551e7fab655538b50fc
MD5 adc560e057e1f677dceadc0d5ae32fc8
SHA1 9fc7b36cd9a601cf1b3fceb67df975fcb82a17d7
SHA512 67a4ce4c582320089899ffb5699fd99cb14a61cde186bc45fe61652e334f82382f0d27a182d251f999352b3628eb23dd526c47f115adc9467d44d341bb40af02
SSDEEP 6144:A6LrxX8xBoCXDrURRGFS/fmwgCoZsBW473Ox:zfxX8z1D45g6ny
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1340-133-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/1340-137-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/1340-138-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/1340-146-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/2176-154-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/2176-152-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/2364-153-0x0000000000589000-0x000000000059E000-memory.dmp

Download

memory/4708-136-0x00000000006F0000-0x0000000000704000-memory.dmp

Download

memory/4708-135-0x00000000007AD000-0x00000000007C2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads