Analysis
-
max time kernel
149s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
25-04-2023 17:26
Static task
static1
Behavioral task
behavioral1
Sample
Backdoor.Win32.Tofsee.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Backdoor.Win32.Tofsee.exe
Resource
win10v2004-20230220-en
General
-
Target
Backdoor.Win32.Tofsee.exe
-
Size
156KB
-
MD5
5a1b9badb9af104e121379fe3c7f7e4c
-
SHA1
0d4e9cc2af85424606ddb981c3060f19f7aa834b
-
SHA256
b30d031ba00884201f134275fba470347847c79c202730a99aba28ba0af5164d
-
SHA512
049b178dd0a9697e94cba8895dc7ab28f4a754140f777781fdc2213348874f47234e8d5addf332c52396a20ead98ad1e147855a9b0abc4c2d18e6cc239d0454a
-
SSDEEP
3072:jcyXKgAPWYnaqlhdlEMOMk3M1HhyOGxx:jcQKgAvaudyMOv2yO
Malware Config
Extracted
tofsee
43.225.38.217
111.121.193.242
188.190.120.101
188.165.132.183
213.155.0.208
rgtryhbgddtyh.biz
wertdghbyrukl.ch
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 908 cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
jonqhmea.exejonqhmea.exepid process 320 jonqhmea.exe 436 jonqhmea.exe -
Loads dropped DLL 2 IoCs
Processes:
Backdoor.Win32.Tofsee.exepid process 1728 Backdoor.Win32.Tofsee.exe 1728 Backdoor.Win32.Tofsee.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Backdoor.Win32.Tofsee.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSConfig = "\"C:\\Users\\Admin\\jonqhmea.exe\"" Backdoor.Win32.Tofsee.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Backdoor.Win32.Tofsee.exejonqhmea.exejonqhmea.exedescription pid process target process PID 2008 set thread context of 1728 2008 Backdoor.Win32.Tofsee.exe Backdoor.Win32.Tofsee.exe PID 320 set thread context of 436 320 jonqhmea.exe jonqhmea.exe PID 320 set thread context of 436 320 jonqhmea.exe jonqhmea.exe PID 436 set thread context of 1112 436 jonqhmea.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 3 IoCs
Processes:
PING.EXEPING.EXEPING.EXEpid process 1336 PING.EXE 940 PING.EXE 1064 PING.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
Backdoor.Win32.Tofsee.exejonqhmea.exepid process 2008 Backdoor.Win32.Tofsee.exe 320 jonqhmea.exe -
Suspicious use of WriteProcessMemory 48 IoCs
Processes:
Backdoor.Win32.Tofsee.exeBackdoor.Win32.Tofsee.exejonqhmea.exejonqhmea.execmd.exedescription pid process target process PID 2008 wrote to memory of 1728 2008 Backdoor.Win32.Tofsee.exe Backdoor.Win32.Tofsee.exe PID 2008 wrote to memory of 1728 2008 Backdoor.Win32.Tofsee.exe Backdoor.Win32.Tofsee.exe PID 2008 wrote to memory of 1728 2008 Backdoor.Win32.Tofsee.exe Backdoor.Win32.Tofsee.exe PID 2008 wrote to memory of 1728 2008 Backdoor.Win32.Tofsee.exe Backdoor.Win32.Tofsee.exe PID 2008 wrote to memory of 1728 2008 Backdoor.Win32.Tofsee.exe Backdoor.Win32.Tofsee.exe PID 2008 wrote to memory of 1728 2008 Backdoor.Win32.Tofsee.exe Backdoor.Win32.Tofsee.exe PID 2008 wrote to memory of 1728 2008 Backdoor.Win32.Tofsee.exe Backdoor.Win32.Tofsee.exe PID 2008 wrote to memory of 1728 2008 Backdoor.Win32.Tofsee.exe Backdoor.Win32.Tofsee.exe PID 2008 wrote to memory of 1728 2008 Backdoor.Win32.Tofsee.exe Backdoor.Win32.Tofsee.exe PID 2008 wrote to memory of 1728 2008 Backdoor.Win32.Tofsee.exe Backdoor.Win32.Tofsee.exe PID 2008 wrote to memory of 1728 2008 Backdoor.Win32.Tofsee.exe Backdoor.Win32.Tofsee.exe PID 1728 wrote to memory of 320 1728 Backdoor.Win32.Tofsee.exe jonqhmea.exe PID 1728 wrote to memory of 320 1728 Backdoor.Win32.Tofsee.exe jonqhmea.exe PID 1728 wrote to memory of 320 1728 Backdoor.Win32.Tofsee.exe jonqhmea.exe PID 1728 wrote to memory of 320 1728 Backdoor.Win32.Tofsee.exe jonqhmea.exe PID 320 wrote to memory of 436 320 jonqhmea.exe jonqhmea.exe PID 320 wrote to memory of 436 320 jonqhmea.exe jonqhmea.exe PID 320 wrote to memory of 436 320 jonqhmea.exe jonqhmea.exe PID 320 wrote to memory of 436 320 jonqhmea.exe jonqhmea.exe PID 320 wrote to memory of 436 320 jonqhmea.exe jonqhmea.exe PID 320 wrote to memory of 436 320 jonqhmea.exe jonqhmea.exe PID 320 wrote to memory of 436 320 jonqhmea.exe jonqhmea.exe PID 320 wrote to memory of 436 320 jonqhmea.exe jonqhmea.exe PID 320 wrote to memory of 436 320 jonqhmea.exe jonqhmea.exe PID 320 wrote to memory of 436 320 jonqhmea.exe jonqhmea.exe PID 320 wrote to memory of 436 320 jonqhmea.exe jonqhmea.exe PID 436 wrote to memory of 1112 436 jonqhmea.exe svchost.exe PID 436 wrote to memory of 1112 436 jonqhmea.exe svchost.exe PID 436 wrote to memory of 1112 436 jonqhmea.exe svchost.exe PID 436 wrote to memory of 1112 436 jonqhmea.exe svchost.exe PID 436 wrote to memory of 1112 436 jonqhmea.exe svchost.exe PID 436 wrote to memory of 1112 436 jonqhmea.exe svchost.exe PID 1728 wrote to memory of 908 1728 Backdoor.Win32.Tofsee.exe cmd.exe PID 1728 wrote to memory of 908 1728 Backdoor.Win32.Tofsee.exe cmd.exe PID 1728 wrote to memory of 908 1728 Backdoor.Win32.Tofsee.exe cmd.exe PID 1728 wrote to memory of 908 1728 Backdoor.Win32.Tofsee.exe cmd.exe PID 908 wrote to memory of 1336 908 cmd.exe PING.EXE PID 908 wrote to memory of 1336 908 cmd.exe PING.EXE PID 908 wrote to memory of 1336 908 cmd.exe PING.EXE PID 908 wrote to memory of 1336 908 cmd.exe PING.EXE PID 908 wrote to memory of 940 908 cmd.exe PING.EXE PID 908 wrote to memory of 940 908 cmd.exe PING.EXE PID 908 wrote to memory of 940 908 cmd.exe PING.EXE PID 908 wrote to memory of 940 908 cmd.exe PING.EXE PID 908 wrote to memory of 1064 908 cmd.exe PING.EXE PID 908 wrote to memory of 1064 908 cmd.exe PING.EXE PID 908 wrote to memory of 1064 908 cmd.exe PING.EXE PID 908 wrote to memory of 1064 908 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\Backdoor.Win32.Tofsee.exe"C:\Users\Admin\AppData\Local\Temp\Backdoor.Win32.Tofsee.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Backdoor.Win32.Tofsee.exe"C:\Users\Admin\AppData\Local\Temp\Backdoor.Win32.Tofsee.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\jonqhmea.exe"C:\Users\Admin\jonqhmea.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\jonqhmea.exe"C:\Users\Admin\jonqhmea.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\3852.bat" "3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.14⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\3852.batFilesize
216B
MD509df633913a0e95a0b74bcb990a9598a
SHA14feb02b98298b7ed9eabb55cc00b76dd5bd9ad85
SHA256df2b4923e7429d4681082218e29f0b5af94ac6fa247dec5f9cb8f3bb708b967f
SHA51214a57df6f0e95bee58c3b4c56cfea00c2e0c8e27365eff99d5feae28e02c1d49f0c11f7cc45d3ad744d163868bd76e2ef882a336b43ce68ddfdbecfb96b9fe71
-
C:\Users\Admin\AppData\Local\Temp\3852.batFilesize
216B
MD509df633913a0e95a0b74bcb990a9598a
SHA14feb02b98298b7ed9eabb55cc00b76dd5bd9ad85
SHA256df2b4923e7429d4681082218e29f0b5af94ac6fa247dec5f9cb8f3bb708b967f
SHA51214a57df6f0e95bee58c3b4c56cfea00c2e0c8e27365eff99d5feae28e02c1d49f0c11f7cc45d3ad744d163868bd76e2ef882a336b43ce68ddfdbecfb96b9fe71
-
C:\Users\Admin\jonqhmea.exeFilesize
42.4MB
MD5359e433cd99475cc732cdac36c29e112
SHA1b3f903413b0fdd37b9b9067a09e2979ba53024a4
SHA2561f24846e55ac095876a03fa612a690ca8c7b9849694abb708a84627816e97c58
SHA5124463dd78201b7b7329792503307403daa0ad575a1f797bfe59b368cbe9cad649cd07d653f7ba3edc867675f64aa61c82fbb759c3f8a451c760e5462376b68eba
-
C:\Users\Admin\jonqhmea.exeFilesize
42.4MB
MD5359e433cd99475cc732cdac36c29e112
SHA1b3f903413b0fdd37b9b9067a09e2979ba53024a4
SHA2561f24846e55ac095876a03fa612a690ca8c7b9849694abb708a84627816e97c58
SHA5124463dd78201b7b7329792503307403daa0ad575a1f797bfe59b368cbe9cad649cd07d653f7ba3edc867675f64aa61c82fbb759c3f8a451c760e5462376b68eba
-
C:\Users\Admin\jonqhmea.exeFilesize
42.4MB
MD5359e433cd99475cc732cdac36c29e112
SHA1b3f903413b0fdd37b9b9067a09e2979ba53024a4
SHA2561f24846e55ac095876a03fa612a690ca8c7b9849694abb708a84627816e97c58
SHA5124463dd78201b7b7329792503307403daa0ad575a1f797bfe59b368cbe9cad649cd07d653f7ba3edc867675f64aa61c82fbb759c3f8a451c760e5462376b68eba
-
C:\Users\Admin\jonqhmea.exeFilesize
42.4MB
MD5359e433cd99475cc732cdac36c29e112
SHA1b3f903413b0fdd37b9b9067a09e2979ba53024a4
SHA2561f24846e55ac095876a03fa612a690ca8c7b9849694abb708a84627816e97c58
SHA5124463dd78201b7b7329792503307403daa0ad575a1f797bfe59b368cbe9cad649cd07d653f7ba3edc867675f64aa61c82fbb759c3f8a451c760e5462376b68eba
-
\Users\Admin\jonqhmea.exeFilesize
42.4MB
MD5359e433cd99475cc732cdac36c29e112
SHA1b3f903413b0fdd37b9b9067a09e2979ba53024a4
SHA2561f24846e55ac095876a03fa612a690ca8c7b9849694abb708a84627816e97c58
SHA5124463dd78201b7b7329792503307403daa0ad575a1f797bfe59b368cbe9cad649cd07d653f7ba3edc867675f64aa61c82fbb759c3f8a451c760e5462376b68eba
-
\Users\Admin\jonqhmea.exeFilesize
42.4MB
MD5359e433cd99475cc732cdac36c29e112
SHA1b3f903413b0fdd37b9b9067a09e2979ba53024a4
SHA2561f24846e55ac095876a03fa612a690ca8c7b9849694abb708a84627816e97c58
SHA5124463dd78201b7b7329792503307403daa0ad575a1f797bfe59b368cbe9cad649cd07d653f7ba3edc867675f64aa61c82fbb759c3f8a451c760e5462376b68eba
-
memory/436-89-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/436-85-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1112-87-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1112-88-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB
-
memory/1112-86-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB
-
memory/1112-93-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB
-
memory/1112-94-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB
-
memory/1112-98-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB
-
memory/1112-99-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB
-
memory/1112-100-0x0000000000190000-0x0000000000191000-memory.dmpFilesize
4KB
-
memory/1112-113-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB
-
memory/1728-56-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1728-74-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1728-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB