tofsee | 13cd681d7e45bc2d09e19b295c64b4385fe309f71bb6032a7c9121c1e231ceaf

Analysis

max time kernel
152s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
09/02/2023, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 185KB
Sample230209-stl3ashf52
SHA256 13cd681d7e45bc2d09e19b295c64b4385fe309f71bb6032a7c9121c1e231ceaf
MD5 b7b237cd994f3dd0b83b901450728340
SHA1 1b439bbcca8b4aa3d69304a39e358f59a49b1859
SHA512 5ce367fd8385947514b50d31f99cedf8862bdc8fb3a4188a67fb91d4f6859b3f21a8896a8ae06782e8768aa299a9a7a98f87b641c2f1ecb32c68e5b00ebd280c
SSDEEP 3072:xfQRIdfbJ/wS7Oi93+h6dhSjqYSs9XQ1RAU:xfj9OSii9lPSGYSxRP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

svartalfheim.top
jotunheim.name

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

New Service
T1050

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
3392	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\glhczefa\ImagePath = "C:\\Windows\\SysWOW64\\glhczefa\\hxqoluba.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	file.exe

Executes dropped EXE 1 IoCs

pid	Process
4240	hxqoluba.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4240 set thread context of 4104	4240	hxqoluba.exe	95

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4588	sc.exe
3644	sc.exe
2304	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 976 wrote to memory of 5100	976	file.exe	82
PID 976 wrote to memory of 5100	976	file.exe	82
PID 976 wrote to memory of 5100	976	file.exe	82
PID 976 wrote to memory of 4972	976	file.exe	84
PID 976 wrote to memory of 4972	976	file.exe	84
PID 976 wrote to memory of 4972	976	file.exe	84
PID 976 wrote to memory of 4588	976	file.exe	86
PID 976 wrote to memory of 4588	976	file.exe	86
PID 976 wrote to memory of 4588	976	file.exe	86
PID 976 wrote to memory of 3644	976	file.exe	88
PID 976 wrote to memory of 3644	976	file.exe	88
PID 976 wrote to memory of 3644	976	file.exe	88
PID 976 wrote to memory of 2304	976	file.exe	90
PID 976 wrote to memory of 2304	976	file.exe	90
PID 976 wrote to memory of 2304	976	file.exe	90
PID 976 wrote to memory of 3392	976	file.exe	93
PID 976 wrote to memory of 3392	976	file.exe	93
PID 976 wrote to memory of 3392	976	file.exe	93
PID 4240 wrote to memory of 4104	4240	hxqoluba.exe	95
PID 4240 wrote to memory of 4104	4240	hxqoluba.exe	95
PID 4240 wrote to memory of 4104	4240	hxqoluba.exe	95
PID 4240 wrote to memory of 4104	4240	hxqoluba.exe	95
PID 4240 wrote to memory of 4104	4240	hxqoluba.exe	95

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:976
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\glhczefa\
  2⤵
  PID:5100
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\hxqoluba.exe" C:\Windows\SysWOW64\glhczefa\
  2⤵
  PID:4972
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create glhczefa binPath= "C:\Windows\SysWOW64\glhczefa\hxqoluba.exe /d\"C:\Users\Admin\AppData\Local\Temp\file.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:4588
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description glhczefa "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:3644
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start glhczefa
  2⤵
  - Launches sc.exe
  PID:2304
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:3392

C:\Windows\SysWOW64\glhczefa\hxqoluba.exe
C:\Windows\SysWOW64\glhczefa\hxqoluba.exe /d"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  PID:4104

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

New Service

T1050

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

New Service

T1050

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hxqoluba.exe

Path C:\Users\Admin\AppData\Local\Temp\hxqoluba.exe
Size 13.1MB
SHA256 751f42b9e5b8cf93a723b77b5ede8df40c17fad4a90c62513530d879f5a30725
MD5 86e6e5a0ab52765d8d5c4eab7010f22b
SHA1 8ef168b5e4e07c2866cc01187362e631993a04e0
SHA512 601d6e1b8bd5359abe7bc383cdfc48e3d15e42c4e26700187ed750ca9d08c24a88b565dc0a79ad0d559796ae5960ee5a0f5507c1158b05be00fb2c7a77ae3f1c
SSDEEP 6144:4fj9OSii9lPSGYSxRPUPUPUPUPUPUPUPUPUPUPUPUPUPUPUPUPUPUPUPUPUPUPUX:4fHii9l7YS
MD5 SHA1 SHA512 SSDEEP

Submit Download

hxqoluba.exe

Path C:\Windows\SysWOW64\glhczefa\hxqoluba.exe
Size 13.1MB
SHA256 751f42b9e5b8cf93a723b77b5ede8df40c17fad4a90c62513530d879f5a30725
MD5 86e6e5a0ab52765d8d5c4eab7010f22b
SHA1 8ef168b5e4e07c2866cc01187362e631993a04e0
SHA512 601d6e1b8bd5359abe7bc383cdfc48e3d15e42c4e26700187ed750ca9d08c24a88b565dc0a79ad0d559796ae5960ee5a0f5507c1158b05be00fb2c7a77ae3f1c
SSDEEP 6144:4fj9OSii9lPSGYSxRPUPUPUPUPUPUPUPUPUPUPUPUPUPUPUPUPUPUPUPUPUPUPUX:4fHii9l7YS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/976-133-0x0000000002290000-0x00000000022A3000-memory.dmp

Download

memory/976-134-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/976-132-0x000000000080D000-0x0000000000820000-memory.dmp

Download

memory/976-143-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/4104-152-0x0000000000470000-0x0000000000485000-memory.dmp

Download

memory/4104-147-0x0000000000470000-0x0000000000485000-memory.dmp

Download

memory/4104-151-0x0000000000470000-0x0000000000485000-memory.dmp

Download

memory/4240-144-0x00000000005F9000-0x000000000060B000-memory.dmp

Download

memory/4240-145-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/4240-149-0x0000000000400000-0x000000000055E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads