tofsee | 798a82f6a6b2a269f87718b2a90e97f53a9d894ea70be0f0e5b12fbd38f1e76e

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
09/02/2023, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 322KB
Sample230209-c8qq2agc2y
SHA256 798a82f6a6b2a269f87718b2a90e97f53a9d894ea70be0f0e5b12fbd38f1e76e
MD5 09d889701b3be4a73a1a7a67703b14be
SHA1 51933d8e48b254808631ff5d137bf37b2e8c634a
SHA512 54b361fb8ddfba5c348defc1764bea1d32c03216895ad33c822c67e130c5d9463186acca613225cbe6dbd0dab04556e7c533891455a227f783e3db4f4a9bfc95
SSDEEP 3072:fPEPvCQSPRdN3mKaAWiooQhOLq8Jld+Ryg8ZSgCQENe+pGS2efz3:fMP5EN3mKgioGHJldmyQQkeQGSvL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

svartalfheim.top
jotunheim.name

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

New Service
T1050

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
568	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
1916	hjmxsmbc.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1384	sc.exe
1932	sc.exe
1768	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 2036	1128	file.exe	27
PID 1128 wrote to memory of 2036	1128	file.exe	27
PID 1128 wrote to memory of 2036	1128	file.exe	27
PID 1128 wrote to memory of 2036	1128	file.exe	27
PID 1128 wrote to memory of 884	1128	file.exe	29
PID 1128 wrote to memory of 884	1128	file.exe	29
PID 1128 wrote to memory of 884	1128	file.exe	29
PID 1128 wrote to memory of 884	1128	file.exe	29
PID 1128 wrote to memory of 1932	1128	file.exe	31
PID 1128 wrote to memory of 1932	1128	file.exe	31
PID 1128 wrote to memory of 1932	1128	file.exe	31
PID 1128 wrote to memory of 1932	1128	file.exe	31
PID 1128 wrote to memory of 1768	1128	file.exe	33
PID 1128 wrote to memory of 1768	1128	file.exe	33
PID 1128 wrote to memory of 1768	1128	file.exe	33
PID 1128 wrote to memory of 1768	1128	file.exe	33
PID 1128 wrote to memory of 1384	1128	file.exe	35
PID 1128 wrote to memory of 1384	1128	file.exe	35
PID 1128 wrote to memory of 1384	1128	file.exe	35
PID 1128 wrote to memory of 1384	1128	file.exe	35
PID 1128 wrote to memory of 568	1128	file.exe	37
PID 1128 wrote to memory of 568	1128	file.exe	37
PID 1128 wrote to memory of 568	1128	file.exe	37
PID 1128 wrote to memory of 568	1128	file.exe	37

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\wgtbiufq\
  2⤵
  PID:2036
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\hjmxsmbc.exe" C:\Windows\SysWOW64\wgtbiufq\
  2⤵
  PID:884
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create wgtbiufq binPath= "C:\Windows\SysWOW64\wgtbiufq\hjmxsmbc.exe /d\"C:\Users\Admin\AppData\Local\Temp\file.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:1932
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description wgtbiufq "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:1768
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start wgtbiufq
  2⤵
  - Launches sc.exe
  PID:1384
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:568

C:\Windows\SysWOW64\wgtbiufq\hjmxsmbc.exe
C:\Windows\SysWOW64\wgtbiufq\hjmxsmbc.exe /d"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Executes dropped EXE
PID:1916

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

New Service

T1050

Privilege Escalation

New Service

T1050

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hjmxsmbc.exe

Path C:\Users\Admin\AppData\Local\Temp\hjmxsmbc.exe
Size 11.0MB
SHA256 8f8ff995836487a5f464a18a2e09fc67a0f54940b2399f1a589c1115546e0282
MD5 fbd47fc0baf709e85b8f6b9e13d2a303
SHA1 db7aab9b099addaa9a2230dec75098d110997b95
SHA512 a8936b63752572fd3f97e6aa91ae4c8117564de016a219cdb81a2ddc3e16656aeedfbe2641a694410a28c37c0040f1604ae2997c5a2ecf241218812f5af05e03
SSDEEP 3072:PPEPvCQSPRdN3mKaAWiooQhOLq8Jld+Ryg8ZSgCQENe+pGS2efz3:PMP5EN3mKgioGHJldmyQQkeQGSvL
MD5 SHA1 SHA512 SSDEEP

Submit Download

hjmxsmbc.exe

Path C:\Windows\SysWOW64\wgtbiufq\hjmxsmbc.exe
Size 11.0MB
SHA256 8f8ff995836487a5f464a18a2e09fc67a0f54940b2399f1a589c1115546e0282
MD5 fbd47fc0baf709e85b8f6b9e13d2a303
SHA1 db7aab9b099addaa9a2230dec75098d110997b95
SHA512 a8936b63752572fd3f97e6aa91ae4c8117564de016a219cdb81a2ddc3e16656aeedfbe2641a694410a28c37c0040f1604ae2997c5a2ecf241218812f5af05e03
SSDEEP 3072:PPEPvCQSPRdN3mKaAWiooQhOLq8Jld+Ryg8ZSgCQENe+pGS2efz3:PMP5EN3mKgioGHJldmyQQkeQGSvL
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1128-66-0x0000000000220000-0x0000000000233000-memory.dmp

Download

memory/1128-55-0x00000000006FB000-0x0000000000711000-memory.dmp

Download

memory/1128-56-0x0000000000220000-0x0000000000233000-memory.dmp

Download

memory/1128-58-0x0000000000400000-0x000000000058F000-memory.dmp

Download

memory/1128-67-0x0000000000400000-0x000000000058F000-memory.dmp

Download

memory/1128-65-0x00000000006FB000-0x0000000000711000-memory.dmp

Download

memory/1128-54-0x00000000762E1000-0x00000000762E3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads