tofsee | d05cd710559cb6a23a84f44bfe88b91582862c7d70134cf71807ae0c49964993

General

Target

supvobl.exe
Size

12.5MB
MD5

be286c784044379ca9a6ca6e7211a29f
SHA1

bf8010a0e4b7ae88095bd9ee303707f4c0da549e
SHA256

d05cd710559cb6a23a84f44bfe88b91582862c7d70134cf71807ae0c49964993
SHA512

862e1beffa2cd58cd606a9edf2be79a03ca4a93f2edd6528e91eed2f68ad889e2e76dd43f164cd8f7eb02567504cbcf9581f730177f841a3e5a0298b48674b13
SSDEEP

24576:P7hE7hE7hE7hE7hE7hE7hE7hE7hE7hE7hE7hE7hE7hE7hE7hE7hE7hE7hE7hE7hg:

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

New Service
T1050
Executes dropped EXE 1 IoCs

Processes:

qlphxiki.exe

pid process

2344 qlphxiki.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

612 netsh.exe

pid	process
2344	qlphxiki.exe

pid	process
612	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\svjybstq\ImagePath = "C:\\Windows\\SysWOW64\\svjybstq\\qlphxiki.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

supvobl.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation supvobl.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

qlphxiki.exe

description pid process target process

PID 2344 set thread context of 4416 2344 qlphxiki.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

2680 sc.exe
4472 sc.exe
4552 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4792 988 WerFault.exe supvobl.exe
4788 2344 WerFault.exe qlphxiki.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	supvobl.exe

description	pid	process	target process
PID 2344 set thread context of 4416	2344	qlphxiki.exe	svchost.exe

pid	process
2680	sc.exe
4472	sc.exe
4552	sc.exe

pid	pid_target	process	target process
4792	988	WerFault.exe	supvobl.exe
4788	2344	WerFault.exe	qlphxiki.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

supvobl.exeqlphxiki.exe

description	pid	process	target process
PID 988 wrote to memory of 3888	988	supvobl.exe	cmd.exe
PID 988 wrote to memory of 3888	988	supvobl.exe	cmd.exe
PID 988 wrote to memory of 3888	988	supvobl.exe	cmd.exe
PID 988 wrote to memory of 4280	988	supvobl.exe	cmd.exe
PID 988 wrote to memory of 4280	988	supvobl.exe	cmd.exe
PID 988 wrote to memory of 4280	988	supvobl.exe	cmd.exe
PID 988 wrote to memory of 2680	988	supvobl.exe	sc.exe
PID 988 wrote to memory of 2680	988	supvobl.exe	sc.exe
PID 988 wrote to memory of 2680	988	supvobl.exe	sc.exe
PID 988 wrote to memory of 4472	988	supvobl.exe	sc.exe
PID 988 wrote to memory of 4472	988	supvobl.exe	sc.exe
PID 988 wrote to memory of 4472	988	supvobl.exe	sc.exe
PID 988 wrote to memory of 4552	988	supvobl.exe	sc.exe
PID 988 wrote to memory of 4552	988	supvobl.exe	sc.exe
PID 988 wrote to memory of 4552	988	supvobl.exe	sc.exe
PID 988 wrote to memory of 612	988	supvobl.exe	netsh.exe
PID 988 wrote to memory of 612	988	supvobl.exe	netsh.exe
PID 988 wrote to memory of 612	988	supvobl.exe	netsh.exe
PID 2344 wrote to memory of 4416	2344	qlphxiki.exe	svchost.exe
PID 2344 wrote to memory of 4416	2344	qlphxiki.exe	svchost.exe
PID 2344 wrote to memory of 4416	2344	qlphxiki.exe	svchost.exe
PID 2344 wrote to memory of 4416	2344	qlphxiki.exe	svchost.exe
PID 2344 wrote to memory of 4416	2344	qlphxiki.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\supvobl.exe
"C:\Users\Admin\AppData\Local\Temp\supvobl.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:988
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\svjybstq\
  2⤵
  PID:3888
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\qlphxiki.exe" C:\Windows\SysWOW64\svjybstq\
  2⤵
  PID:4280
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create svjybstq binPath= "C:\Windows\SysWOW64\svjybstq\qlphxiki.exe /d\"C:\Users\Admin\AppData\Local\Temp\supvobl.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:2680
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description svjybstq "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:4472
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start svjybstq
  2⤵
  - Launches sc.exe
  PID:4552
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:612
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 988 -s 1292
  2⤵
  - Program crash
  PID:4792

C:\Windows\SysWOW64\svjybstq\qlphxiki.exe
C:\Windows\SysWOW64\svjybstq\qlphxiki.exe /d"C:\Users\Admin\AppData\Local\Temp\supvobl.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  PID:4416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 568
  2⤵
  - Program crash
  PID:4788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 988 -ip 988
1⤵
PID:3780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2344 -ip 2344
1⤵
PID:2872

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

New Service

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

New Service

1

T1050

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\qlphxiki.exe

Filesize
14.4MB

MD5
59aac508c4b585d79d7003b5bb55a399

SHA1
331d9428c8a2769b38a12a05f8d6603a1b929149

SHA256
7deb5ccf7b635b0880af31771798e847f3959d92053b5dab31321bf3a425063d

SHA512
69c106fd16b7dd4694905abcb6928badc40d8b70a717c9123fe1d2281ca33f71bc92bdcaaaec3cf5451fce5a85d4c777b019f231853ecce828e8435951f6143d

Download Submit
C:\Windows\SysWOW64\svjybstq\qlphxiki.exe

Filesize
14.4MB

MD5
59aac508c4b585d79d7003b5bb55a399

SHA1
331d9428c8a2769b38a12a05f8d6603a1b929149

SHA256
7deb5ccf7b635b0880af31771798e847f3959d92053b5dab31321bf3a425063d

SHA512
69c106fd16b7dd4694905abcb6928badc40d8b70a717c9123fe1d2281ca33f71bc92bdcaaaec3cf5451fce5a85d4c777b019f231853ecce828e8435951f6143d

Download Submit
memory/612-141-0x0000000000000000-mapping.dmp

Download
memory/988-133-0x0000000003240000-0x0000000003253000-memory.dmp

Filesize
76KB

Download
memory/988-134-0x0000000000400000-0x0000000002DEE000-memory.dmp

Filesize
41.9MB

Download
memory/988-132-0x0000000002F17000-0x0000000002F25000-memory.dmp

Filesize
56KB

Download
memory/988-150-0x0000000000400000-0x0000000002DEE000-memory.dmp

Filesize
41.9MB

Download
memory/2344-148-0x0000000002EC0000-0x0000000002ED3000-memory.dmp

Filesize
76KB

Download
memory/2344-147-0x0000000002F62000-0x0000000002F70000-memory.dmp

Filesize
56KB

Download
memory/2344-151-0x0000000000400000-0x0000000002DEE000-memory.dmp

Filesize
41.9MB

Download
memory/2680-138-0x0000000000000000-mapping.dmp

Download
memory/3888-135-0x0000000000000000-mapping.dmp

Download
memory/4280-136-0x0000000000000000-mapping.dmp

Download
memory/4416-144-0x0000000000840000-0x0000000000855000-memory.dmp

Filesize
84KB

Download
memory/4416-143-0x0000000000000000-mapping.dmp

Download
memory/4416-149-0x0000000000840000-0x0000000000855000-memory.dmp

Filesize
84KB

Download
memory/4416-152-0x0000000000840000-0x0000000000855000-memory.dmp

Filesize
84KB

Download
memory/4472-139-0x0000000000000000-mapping.dmp

Download
memory/4552-140-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing