tofsee | e16191d95969d7ae164c1dd4f5b0ac87a49a617e902743d204ffcc2ebc2fdf49

Analysis

max time kernel
148s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
09/02/2023, 22:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 194KB
Sample230209-2tykrsad4s
SHA256 e16191d95969d7ae164c1dd4f5b0ac87a49a617e902743d204ffcc2ebc2fdf49
MD5 e5d88e4a2497a5f8219482d64d3b501b
SHA1 579cbcb258b79563d3148358c8787c799fdc46c8
SHA512 0475aea3a05037d71eab825b2191938853ed95a9b9f8b964f82354847d5a8b233eb876dd3d455f7c797f19f6673b651da145d350d266840781906e0ceabeb669
SSDEEP 3072:D2bRtGOq9lrdRU/mgLfbWdBNDzFOybb/m/DXgctyKNMxkP8T:D2NUf1RsmgLfbWdvzMAb/yb7Mx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

svartalfheim.top
jotunheim.name

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

New Service
T1050

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
4524	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\rbuynefi\ImagePath = "C:\\Windows\\SysWOW64\\rbuynefi\\suxidxmn.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	file.exe

Executes dropped EXE 1 IoCs

pid	Process
2100	suxidxmn.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2100 set thread context of 3612	2100	suxidxmn.exe	96

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4304	sc.exe
4592	sc.exe
4904	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3748	2612	WerFault.exe	79
4240	2100	WerFault.exe	90

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 3972	2612	file.exe	80
PID 2612 wrote to memory of 3972	2612	file.exe	80
PID 2612 wrote to memory of 3972	2612	file.exe	80
PID 2612 wrote to memory of 3308	2612	file.exe	82
PID 2612 wrote to memory of 3308	2612	file.exe	82
PID 2612 wrote to memory of 3308	2612	file.exe	82
PID 2612 wrote to memory of 4304	2612	file.exe	84
PID 2612 wrote to memory of 4304	2612	file.exe	84
PID 2612 wrote to memory of 4304	2612	file.exe	84
PID 2612 wrote to memory of 4592	2612	file.exe	86
PID 2612 wrote to memory of 4592	2612	file.exe	86
PID 2612 wrote to memory of 4592	2612	file.exe	86
PID 2612 wrote to memory of 4904	2612	file.exe	88
PID 2612 wrote to memory of 4904	2612	file.exe	88
PID 2612 wrote to memory of 4904	2612	file.exe	88
PID 2612 wrote to memory of 4524	2612	file.exe	91
PID 2612 wrote to memory of 4524	2612	file.exe	91
PID 2612 wrote to memory of 4524	2612	file.exe	91
PID 2100 wrote to memory of 3612	2100	suxidxmn.exe	96
PID 2100 wrote to memory of 3612	2100	suxidxmn.exe	96
PID 2100 wrote to memory of 3612	2100	suxidxmn.exe	96
PID 2100 wrote to memory of 3612	2100	suxidxmn.exe	96
PID 2100 wrote to memory of 3612	2100	suxidxmn.exe	96

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\rbuynefi\
  2⤵
  PID:3972
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\suxidxmn.exe" C:\Windows\SysWOW64\rbuynefi\
  2⤵
  PID:3308
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create rbuynefi binPath= "C:\Windows\SysWOW64\rbuynefi\suxidxmn.exe /d\"C:\Users\Admin\AppData\Local\Temp\file.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:4304
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description rbuynefi "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:4592
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start rbuynefi
  2⤵
  - Launches sc.exe
  PID:4904
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:4524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 1036
  2⤵
  - Program crash
  PID:3748

C:\Windows\SysWOW64\rbuynefi\suxidxmn.exe
C:\Windows\SysWOW64\rbuynefi\suxidxmn.exe /d"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  PID:3612
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 216
  2⤵
  - Program crash
  PID:4240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2612 -ip 2612
1⤵
PID:808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2100 -ip 2100
1⤵
PID:4496

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

New Service

T1050

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

New Service

T1050

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

suxidxmn.exe

Path C:\Users\Admin\AppData\Local\Temp\suxidxmn.exe
Size 10.8MB
SHA256 7757e96a25adb2346e658c0af92a6e7213df9a65a5b90ab76fcf1336c3d67eb2
MD5 f6e2888c06a908876fed311693a86af1
SHA1 40febaf911642f0a08a511cd8bc8756e04860abd
SHA512 33db96e1abd1ed0ab2f3ac4c56f3a458dbc505a5e5cc2a87c071ec7a894b9f35810f998bf9db811ddb01e1801ffb14971c88f3f3039a7a1f9a99a9ddaee8750a
SSDEEP 6144:+2NUf1RsmgLfbWdvzMAb/yb7MxMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMME:+2Ng/sXfbWdvzMAa
MD5 SHA1 SHA512 SSDEEP

Submit Download

suxidxmn.exe

Path C:\Windows\SysWOW64\rbuynefi\suxidxmn.exe
Size 10.8MB
SHA256 7757e96a25adb2346e658c0af92a6e7213df9a65a5b90ab76fcf1336c3d67eb2
MD5 f6e2888c06a908876fed311693a86af1
SHA1 40febaf911642f0a08a511cd8bc8756e04860abd
SHA512 33db96e1abd1ed0ab2f3ac4c56f3a458dbc505a5e5cc2a87c071ec7a894b9f35810f998bf9db811ddb01e1801ffb14971c88f3f3039a7a1f9a99a9ddaee8750a
SSDEEP 6144:+2NUf1RsmgLfbWdvzMAb/yb7MxMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMME:+2Ng/sXfbWdvzMAa
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2100-151-0x0000000000400000-0x0000000000560000-memory.dmp

Download

memory/2100-146-0x0000000000400000-0x0000000000560000-memory.dmp

Download

memory/2100-145-0x0000000000704000-0x0000000000717000-memory.dmp

Download

memory/2612-143-0x0000000000709000-0x000000000071C000-memory.dmp

Download

memory/2612-133-0x0000000002290000-0x00000000022A3000-memory.dmp

Download

memory/2612-134-0x0000000000400000-0x0000000000560000-memory.dmp

Download

memory/2612-132-0x0000000000709000-0x000000000071C000-memory.dmp

Download

memory/2612-144-0x0000000000400000-0x0000000000560000-memory.dmp

Download

memory/3612-148-0x0000000000A40000-0x0000000000A55000-memory.dmp

Download

memory/3612-152-0x0000000000A40000-0x0000000000A55000-memory.dmp

Download

memory/3612-153-0x0000000000A40000-0x0000000000A55000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads