tofsee | 53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462

General

Target

file.exe
Size

292KB
MD5

4e39579f1251ae570e145e352e7393f7
SHA1

07497b310187f77e2c18364c7a0e31068be822d1
SHA256

53c6ebd75518ed05b22ab762b476f48313b700283358dccb7d55b02f29cfe462
SHA512

29dd728463e77e3988a074a97b36ebba3f0876e684ea96746b3ec0aeaf78e4ee25182b34a51900b6400fd8a22ea9a911bb15ae195bd04419f8303b9412920009
SSDEEP

3072:Xk6e+HiNFjbrieXWP72/BRczZpgAhtBE3k2Bxz+4a2GMW/ft/Dr05xK:7zkjbrFi78BkpgKC3z2YK

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

vanaheim.cn

jotunheim.name

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

New Service
T1050
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

4752 netsh.exe

pid	process
4752	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xgiqqtfq\ImagePath = "C:\\Windows\\SysWOW64\\xgiqqtfq\\oinlgjgi.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

file.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation file.exe
Executes dropped EXE 1 IoCs

Processes:

oinlgjgi.exe

pid process

640 oinlgjgi.exe
Drops file in System32 directory 1 IoCs

Processes:

svchost.exe

description ioc process

File created C:\Windows\SysWOW64\config\systemprofile:.repos svchost.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

oinlgjgi.exe

description pid process target process

PID 640 set thread context of 1912 640 oinlgjgi.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

3000 sc.exe
5080 sc.exe
748 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

348 2980 WerFault.exe file.exe
1308 640 WerFault.exe oinlgjgi.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	file.exe

pid	process
640	oinlgjgi.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile:.repos	svchost.exe

description	pid	process	target process
PID 640 set thread context of 1912	640	oinlgjgi.exe	svchost.exe

pid	process
3000	sc.exe
5080	sc.exe
748	sc.exe

pid	pid_target	process	target process
348	2980	WerFault.exe	file.exe
1308	640	WerFault.exe	oinlgjgi.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Buses	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\Buses\Config0 = 4cbdd73db6f0440124edb47d450dd49d084297dce82e72baa4c01f8a7cd27b1d577fa7dc87cd945d24edb47d470dd49d024195daf71261adc06d04fda6e22673bbc9154961cda56811da8548753ce1ad644490bdbc7f26e5945903cdf38d3c74bbc4103d32f5a56b10d98649760db8f2054991cfdb2470dd906d5d8dc4bf652fd29b440431f5a05d579fc2223064b9f86400c58eb27421ed945d00c9c4e13b7e85c12b496da0f15d15d8814a7538e5ac5119f459a475146f99bd68fdc48d541ce4ad744a6bbfff02579fc27d440dd49d642df4caeec40298a46d34fdc741461ee4ad743c3cfdba6b12c383486a3fe1a9642df4bd844d14dda46d34fdc48d541de4ad743d04cd945d24edb47d440dd49d642df4bd844d14dda46d34fdc48d541de4ad743de7cc945d	svchost.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

file.exeoinlgjgi.exe

description	pid	process	target process
PID 2980 wrote to memory of 4784	2980	file.exe	cmd.exe
PID 2980 wrote to memory of 4784	2980	file.exe	cmd.exe
PID 2980 wrote to memory of 4784	2980	file.exe	cmd.exe
PID 2980 wrote to memory of 2032	2980	file.exe	cmd.exe
PID 2980 wrote to memory of 2032	2980	file.exe	cmd.exe
PID 2980 wrote to memory of 2032	2980	file.exe	cmd.exe
PID 2980 wrote to memory of 3000	2980	file.exe	sc.exe
PID 2980 wrote to memory of 3000	2980	file.exe	sc.exe
PID 2980 wrote to memory of 3000	2980	file.exe	sc.exe
PID 2980 wrote to memory of 5080	2980	file.exe	sc.exe
PID 2980 wrote to memory of 5080	2980	file.exe	sc.exe
PID 2980 wrote to memory of 5080	2980	file.exe	sc.exe
PID 2980 wrote to memory of 748	2980	file.exe	sc.exe
PID 2980 wrote to memory of 748	2980	file.exe	sc.exe
PID 2980 wrote to memory of 748	2980	file.exe	sc.exe
PID 2980 wrote to memory of 4752	2980	file.exe	netsh.exe
PID 2980 wrote to memory of 4752	2980	file.exe	netsh.exe
PID 2980 wrote to memory of 4752	2980	file.exe	netsh.exe
PID 640 wrote to memory of 1912	640	oinlgjgi.exe	svchost.exe
PID 640 wrote to memory of 1912	640	oinlgjgi.exe	svchost.exe
PID 640 wrote to memory of 1912	640	oinlgjgi.exe	svchost.exe
PID 640 wrote to memory of 1912	640	oinlgjgi.exe	svchost.exe
PID 640 wrote to memory of 1912	640	oinlgjgi.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\xgiqqtfq\
  2⤵
  PID:4784
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\oinlgjgi.exe" C:\Windows\SysWOW64\xgiqqtfq\
  2⤵
  PID:2032
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create xgiqqtfq binPath= "C:\Windows\SysWOW64\xgiqqtfq\oinlgjgi.exe /d\"C:\Users\Admin\AppData\Local\Temp\file.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:3000
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description xgiqqtfq "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:5080
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start xgiqqtfq
  2⤵
  - Launches sc.exe
  PID:748
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:4752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 1032
  2⤵
  - Program crash
  PID:348

C:\Windows\SysWOW64\xgiqqtfq\oinlgjgi.exe
C:\Windows\SysWOW64\xgiqqtfq\oinlgjgi.exe /d"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:640
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:1912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 516
  2⤵
  - Program crash
  PID:1308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2980 -ip 2980
1⤵
PID:2752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 640 -ip 640
1⤵
PID:1832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

New Service

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

New Service

1

T1050

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\oinlgjgi.exe

Filesize
13.4MB

MD5
3dcec00ce9735d74a50cd132b75f8c59

SHA1
46be533fba3b95c3e7fef4e56ec280a29041de5d

SHA256
702d6d3d774062e10bcc5ac976186e9049d5288479fde3b6486469e0e134c3cb

SHA512
9418d38bf3fdef2473993e4a92499358aeeb38cf7ae8cc51775813d6f18cbcdb6743f0269082fce462ff74b9c0a18bdf86f930eaea631f77d7002b12dc18ce52

Download Submit
C:\Windows\SysWOW64\xgiqqtfq\oinlgjgi.exe

Filesize
13.4MB

MD5
3dcec00ce9735d74a50cd132b75f8c59

SHA1
46be533fba3b95c3e7fef4e56ec280a29041de5d

SHA256
702d6d3d774062e10bcc5ac976186e9049d5288479fde3b6486469e0e134c3cb

SHA512
9418d38bf3fdef2473993e4a92499358aeeb38cf7ae8cc51775813d6f18cbcdb6743f0269082fce462ff74b9c0a18bdf86f930eaea631f77d7002b12dc18ce52

Download Submit
memory/640-144-0x0000000000400000-0x00000000006C7000-memory.dmp

Filesize
2.8MB

Download
memory/1912-140-0x0000000000370000-0x0000000000385000-memory.dmp

Filesize
84KB

Download
memory/1912-143-0x0000000000370000-0x0000000000385000-memory.dmp

Filesize
84KB

Download
memory/1912-145-0x0000000000370000-0x0000000000385000-memory.dmp

Filesize
84KB

Download
memory/1912-146-0x0000000000370000-0x0000000000385000-memory.dmp

Filesize
84KB

Download
memory/1912-148-0x0000000000370000-0x0000000000385000-memory.dmp

Filesize
84KB

Download
memory/2980-135-0x0000000002300000-0x0000000002313000-memory.dmp

Filesize
76KB

Download
memory/2980-138-0x0000000000400000-0x00000000006C7000-memory.dmp

Filesize
2.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads