tofsee | 92afdac37111654925657288e25740c7291896b233c012e41ecd23e81b53dee4

General

Target

file.exe
Size

357KB
MD5

88d3588e92f5c5f99a2e036252a9d281
SHA1

1ed1ce7b4cb75db17e90efd41349754113648fe0
SHA256

92afdac37111654925657288e25740c7291896b233c012e41ecd23e81b53dee4
SHA512

0b3e93cd59bb5fc8fe6fffe11c35e34fb0bb77bf1af10ce199c53715c09385b5f5b046b625bb6c1f4a0f7109030d5968fc128346de682d22827893e03d1c6131
SSDEEP

3072:0wHqb7eKdaMaTK8CyR6sb9SuqXZW8Va5tWGYkK/FBRA9nf6Nh382UUf/:pH6tauXsb96p/a5LVK/XR2nfWhsA/

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

svartalfheim.top

jotunheim.name

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

New Service
T1050

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
4216	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mzsydsib\ImagePath = "C:\\Windows\\SysWOW64\\mzsydsib\\pflsxjnc.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	file.exe

Executes dropped EXE 1 IoCs

pid	Process
2356	pflsxjnc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2356 set thread context of 3940	2356	pflsxjnc.exe	97

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3976	sc.exe
2504	sc.exe
2060	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3988	4832	WerFault.exe	80
3716	2356	WerFault.exe	94

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 3048	4832	file.exe	81
PID 4832 wrote to memory of 3048	4832	file.exe	81
PID 4832 wrote to memory of 3048	4832	file.exe	81
PID 4832 wrote to memory of 3404	4832	file.exe	83
PID 4832 wrote to memory of 3404	4832	file.exe	83
PID 4832 wrote to memory of 3404	4832	file.exe	83
PID 4832 wrote to memory of 3976	4832	file.exe	85
PID 4832 wrote to memory of 3976	4832	file.exe	85
PID 4832 wrote to memory of 3976	4832	file.exe	85
PID 4832 wrote to memory of 2504	4832	file.exe	87
PID 4832 wrote to memory of 2504	4832	file.exe	87
PID 4832 wrote to memory of 2504	4832	file.exe	87
PID 4832 wrote to memory of 2060	4832	file.exe	89
PID 4832 wrote to memory of 2060	4832	file.exe	89
PID 4832 wrote to memory of 2060	4832	file.exe	89
PID 4832 wrote to memory of 4216	4832	file.exe	91
PID 4832 wrote to memory of 4216	4832	file.exe	91
PID 4832 wrote to memory of 4216	4832	file.exe	91
PID 2356 wrote to memory of 3940	2356	pflsxjnc.exe	97
PID 2356 wrote to memory of 3940	2356	pflsxjnc.exe	97
PID 2356 wrote to memory of 3940	2356	pflsxjnc.exe	97
PID 2356 wrote to memory of 3940	2356	pflsxjnc.exe	97
PID 2356 wrote to memory of 3940	2356	pflsxjnc.exe	97

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\mzsydsib\
  2⤵
  PID:3048
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\pflsxjnc.exe" C:\Windows\SysWOW64\mzsydsib\
  2⤵
  PID:3404
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create mzsydsib binPath= "C:\Windows\SysWOW64\mzsydsib\pflsxjnc.exe /d\"C:\Users\Admin\AppData\Local\Temp\file.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:3976
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description mzsydsib "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2504
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start mzsydsib
  2⤵
  - Launches sc.exe
  PID:2060
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:4216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 668
  2⤵
  - Program crash
  PID:3988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4832 -ip 4832
1⤵
PID:208

C:\Windows\SysWOW64\mzsydsib\pflsxjnc.exe
C:\Windows\SysWOW64\mzsydsib\pflsxjnc.exe /d"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  PID:3940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 524
  2⤵
  - Program crash
  PID:3716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2356 -ip 2356
1⤵
PID:660

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

New Service

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

New Service

1

T1050

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\pflsxjnc.exe

Filesize
10.7MB

MD5
4ac43135bdd5feef19ac5c895c91da3e

SHA1
4d6a3f5937a12f3592ee4a7d3a54d09374c2ff56

SHA256
66e73c0647dc54a4f95187d4167400c0e4af47046fd98f6acb0a5c07a16b50dc

SHA512
b69c2a76426572031fa7e2c7586636963e8fb6ebe56410ece39e6363242629821503fe41b07cd03c556bafd812ab57973c54de052f9f8d4fe43f00ae6a59b51f

Download Submit
C:\Windows\SysWOW64\mzsydsib\pflsxjnc.exe

Filesize
10.7MB

MD5
4ac43135bdd5feef19ac5c895c91da3e

SHA1
4d6a3f5937a12f3592ee4a7d3a54d09374c2ff56

SHA256
66e73c0647dc54a4f95187d4167400c0e4af47046fd98f6acb0a5c07a16b50dc

SHA512
b69c2a76426572031fa7e2c7586636963e8fb6ebe56410ece39e6363242629821503fe41b07cd03c556bafd812ab57973c54de052f9f8d4fe43f00ae6a59b51f

Download Submit
memory/2356-147-0x0000000000849000-0x000000000085E000-memory.dmp

Filesize
84KB

Download
memory/2356-148-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2356-153-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/3940-155-0x0000000000440000-0x0000000000455000-memory.dmp

Filesize
84KB

Download
memory/3940-154-0x0000000000440000-0x0000000000455000-memory.dmp

Filesize
84KB

Download
memory/3940-150-0x0000000000440000-0x0000000000455000-memory.dmp

Filesize
84KB

Download
memory/4832-132-0x000000000069D000-0x00000000006B3000-memory.dmp

Filesize
88KB

Download
memory/4832-146-0x000000000069D000-0x00000000006B3000-memory.dmp

Filesize
88KB

Download
memory/4832-145-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4832-133-0x0000000000620000-0x0000000000633000-memory.dmp

Filesize
76KB

Download
memory/4832-143-0x0000000000620000-0x0000000000633000-memory.dmp

Filesize
76KB

Download
memory/4832-139-0x000000000069D000-0x00000000006B3000-memory.dmp

Filesize
88KB

Download
memory/4832-134-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download

Analysis

Sharing