tofsee | 66dceebb43ee22e5deb6e342ffb6c5010148d3e0bbff159d0df811fcac097034

Analysis

max time kernel
168s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
09/02/2023, 23:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 193KB
Sample230209-3st2madb75
SHA256 66dceebb43ee22e5deb6e342ffb6c5010148d3e0bbff159d0df811fcac097034
MD5 c05f4e44e927c3d2365420273c74b7e7
SHA1 55fc4da3e0121fbc070a5c6f9f04dc76a0f30cc4
SHA512 5f9dc8f27187007ed92b44275468e7dec98c6799aac1b1fd75e02d90e85509b9f63aefc5aeb4d66d481f5102e7d1b3ee49e2c05e4d03ac3e5e333e21111358fe
SSDEEP 6144:VF3XdBRC2ZBjvWDhHDG8zxgeotaSTUdWVKg9oz:VF3NbCsTWDhBzx1rKt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

svartalfheim.top
jotunheim.name

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

New Service
T1050

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
1536	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mvelibsd\ImagePath = "C:\\Windows\\SysWOW64\\mvelibsd\\qjgofysp.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	file.exe

Executes dropped EXE 1 IoCs

pid	Process
3824	qjgofysp.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3824 set thread context of 3880	3824	qjgofysp.exe	98

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3144	sc.exe
2412	sc.exe
3380	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1992	4128	WerFault.exe	79
3404	3824	WerFault.exe	92

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 2112	4128	file.exe	81
PID 4128 wrote to memory of 2112	4128	file.exe	81
PID 4128 wrote to memory of 2112	4128	file.exe	81
PID 4128 wrote to memory of 4396	4128	file.exe	83
PID 4128 wrote to memory of 4396	4128	file.exe	83
PID 4128 wrote to memory of 4396	4128	file.exe	83
PID 4128 wrote to memory of 3144	4128	file.exe	86
PID 4128 wrote to memory of 3144	4128	file.exe	86
PID 4128 wrote to memory of 3144	4128	file.exe	86
PID 4128 wrote to memory of 2412	4128	file.exe	88
PID 4128 wrote to memory of 2412	4128	file.exe	88
PID 4128 wrote to memory of 2412	4128	file.exe	88
PID 4128 wrote to memory of 3380	4128	file.exe	90
PID 4128 wrote to memory of 3380	4128	file.exe	90
PID 4128 wrote to memory of 3380	4128	file.exe	90
PID 4128 wrote to memory of 1536	4128	file.exe	93
PID 4128 wrote to memory of 1536	4128	file.exe	93
PID 4128 wrote to memory of 1536	4128	file.exe	93
PID 3824 wrote to memory of 3880	3824	qjgofysp.exe	98
PID 3824 wrote to memory of 3880	3824	qjgofysp.exe	98
PID 3824 wrote to memory of 3880	3824	qjgofysp.exe	98
PID 3824 wrote to memory of 3880	3824	qjgofysp.exe	98
PID 3824 wrote to memory of 3880	3824	qjgofysp.exe	98

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\mvelibsd\
  2⤵
  PID:2112
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\qjgofysp.exe" C:\Windows\SysWOW64\mvelibsd\
  2⤵
  PID:4396
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create mvelibsd binPath= "C:\Windows\SysWOW64\mvelibsd\qjgofysp.exe /d\"C:\Users\Admin\AppData\Local\Temp\file.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:3144
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description mvelibsd "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2412
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start mvelibsd
  2⤵
  - Launches sc.exe
  PID:3380
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:1536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4128 -s 1044
  2⤵
  - Program crash
  PID:1992

C:\Windows\SysWOW64\mvelibsd\qjgofysp.exe
C:\Windows\SysWOW64\mvelibsd\qjgofysp.exe /d"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3824
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  PID:3880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3824 -s 248
  2⤵
  - Program crash
  PID:3404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4128 -ip 4128
1⤵
PID:1864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3824 -ip 3824
1⤵
PID:3672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

New Service

T1050

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

New Service

T1050

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qjgofysp.exe

Path C:\Users\Admin\AppData\Local\Temp\qjgofysp.exe
Size 12.9MB
SHA256 72b4d7fecd2a70be3942aec904fa588df542dc3f0f3fa7139ab9186e786ecfb5
MD5 160625c7a6db1ae3aaefbfacab2aed61
SHA1 2a291e47219bbe2baaf5e3fc1253447cd0b9cc38
SHA512 71a58d0b3c300bf840e2d269435a67b78ec8b0073b028c0ba4caa64e07f58d93955df0d016888860d4c702ed1f236f73149ad423a386c4d6d695fa4863ff7b3a
SSDEEP 6144:yF3XdBRC2ZBjvWDhHDG8zxgeotaSTUdWVKg9ozVVVVVVVVVVVVVVVVVVVVVVVVVV:yF3NbCsTWDhBzx1rKt
MD5 SHA1 SHA512 SSDEEP

Submit Download

qjgofysp.exe

Path C:\Windows\SysWOW64\mvelibsd\qjgofysp.exe
Size 12.9MB
SHA256 72b4d7fecd2a70be3942aec904fa588df542dc3f0f3fa7139ab9186e786ecfb5
MD5 160625c7a6db1ae3aaefbfacab2aed61
SHA1 2a291e47219bbe2baaf5e3fc1253447cd0b9cc38
SHA512 71a58d0b3c300bf840e2d269435a67b78ec8b0073b028c0ba4caa64e07f58d93955df0d016888860d4c702ed1f236f73149ad423a386c4d6d695fa4863ff7b3a
SSDEEP 6144:yF3XdBRC2ZBjvWDhHDG8zxgeotaSTUdWVKg9ozVVVVVVVVVVVVVVVVVVVVVVVVVV:yF3NbCsTWDhBzx1rKt
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3824-151-0x0000000000400000-0x0000000000560000-memory.dmp

Download

memory/3824-150-0x0000000000843000-0x0000000000856000-memory.dmp

Download

memory/3880-153-0x00000000007A0000-0x00000000007B5000-memory.dmp

Download

memory/3880-152-0x00000000007A0000-0x00000000007B5000-memory.dmp

Download

memory/3880-147-0x00000000007A0000-0x00000000007B5000-memory.dmp

Download

memory/4128-132-0x00000000007B9000-0x00000000007CC000-memory.dmp

Download

memory/4128-145-0x0000000000400000-0x0000000000560000-memory.dmp

Download

memory/4128-133-0x0000000000710000-0x0000000000723000-memory.dmp

Download

memory/4128-134-0x0000000000400000-0x0000000000560000-memory.dmp

Download

memory/4128-135-0x00000000007B9000-0x00000000007CC000-memory.dmp

Download

memory/4128-136-0x0000000000710000-0x0000000000723000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads