Analysis
-
max time kernel
151s -
max time network
195s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
07-05-2023 06:13
Static task
static1
Behavioral task
behavioral1
Sample
Backdoor.Win32.Tofsee.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Backdoor.Win32.Tofsee.exe
Resource
win10v2004-20230220-en
General
-
Target
Backdoor.Win32.Tofsee.exe
-
Size
156KB
-
MD5
5a1b9badb9af104e121379fe3c7f7e4c
-
SHA1
0d4e9cc2af85424606ddb981c3060f19f7aa834b
-
SHA256
b30d031ba00884201f134275fba470347847c79c202730a99aba28ba0af5164d
-
SHA512
049b178dd0a9697e94cba8895dc7ab28f4a754140f777781fdc2213348874f47234e8d5addf332c52396a20ead98ad1e147855a9b0abc4c2d18e6cc239d0454a
-
SSDEEP
3072:jcyXKgAPWYnaqlhdlEMOMk3M1HhyOGxx:jcQKgAvaudyMOv2yO
Malware Config
Extracted
tofsee
43.225.38.217
111.121.193.242
188.190.120.101
188.165.132.183
213.155.0.208
rgtryhbgddtyh.biz
wertdghbyrukl.ch
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
otsvmrjf.exeotsvmrjf.exepid process 696 otsvmrjf.exe 1692 otsvmrjf.exe -
Loads dropped DLL 2 IoCs
Processes:
Backdoor.Win32.Tofsee.exepid process 520 Backdoor.Win32.Tofsee.exe 520 Backdoor.Win32.Tofsee.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Backdoor.Win32.Tofsee.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSConfig = "\"C:\\Users\\Admin\\otsvmrjf.exe\"" Backdoor.Win32.Tofsee.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Backdoor.Win32.Tofsee.exeotsvmrjf.exeotsvmrjf.exedescription pid process target process PID 1384 set thread context of 520 1384 Backdoor.Win32.Tofsee.exe Backdoor.Win32.Tofsee.exe PID 696 set thread context of 1692 696 otsvmrjf.exe otsvmrjf.exe PID 696 set thread context of 1692 696 otsvmrjf.exe otsvmrjf.exe PID 1692 set thread context of 760 1692 otsvmrjf.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 3 IoCs
Processes:
PING.EXEPING.EXEPING.EXEpid process 1984 PING.EXE 1416 PING.EXE 1576 PING.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
Backdoor.Win32.Tofsee.exeotsvmrjf.exepid process 1384 Backdoor.Win32.Tofsee.exe 696 otsvmrjf.exe -
Suspicious use of WriteProcessMemory 48 IoCs
Processes:
Backdoor.Win32.Tofsee.exeBackdoor.Win32.Tofsee.exeotsvmrjf.exeotsvmrjf.execmd.exedescription pid process target process PID 1384 wrote to memory of 520 1384 Backdoor.Win32.Tofsee.exe Backdoor.Win32.Tofsee.exe PID 1384 wrote to memory of 520 1384 Backdoor.Win32.Tofsee.exe Backdoor.Win32.Tofsee.exe PID 1384 wrote to memory of 520 1384 Backdoor.Win32.Tofsee.exe Backdoor.Win32.Tofsee.exe PID 1384 wrote to memory of 520 1384 Backdoor.Win32.Tofsee.exe Backdoor.Win32.Tofsee.exe PID 1384 wrote to memory of 520 1384 Backdoor.Win32.Tofsee.exe Backdoor.Win32.Tofsee.exe PID 1384 wrote to memory of 520 1384 Backdoor.Win32.Tofsee.exe Backdoor.Win32.Tofsee.exe PID 1384 wrote to memory of 520 1384 Backdoor.Win32.Tofsee.exe Backdoor.Win32.Tofsee.exe PID 1384 wrote to memory of 520 1384 Backdoor.Win32.Tofsee.exe Backdoor.Win32.Tofsee.exe PID 1384 wrote to memory of 520 1384 Backdoor.Win32.Tofsee.exe Backdoor.Win32.Tofsee.exe PID 1384 wrote to memory of 520 1384 Backdoor.Win32.Tofsee.exe Backdoor.Win32.Tofsee.exe PID 1384 wrote to memory of 520 1384 Backdoor.Win32.Tofsee.exe Backdoor.Win32.Tofsee.exe PID 520 wrote to memory of 696 520 Backdoor.Win32.Tofsee.exe otsvmrjf.exe PID 520 wrote to memory of 696 520 Backdoor.Win32.Tofsee.exe otsvmrjf.exe PID 520 wrote to memory of 696 520 Backdoor.Win32.Tofsee.exe otsvmrjf.exe PID 520 wrote to memory of 696 520 Backdoor.Win32.Tofsee.exe otsvmrjf.exe PID 696 wrote to memory of 1692 696 otsvmrjf.exe otsvmrjf.exe PID 696 wrote to memory of 1692 696 otsvmrjf.exe otsvmrjf.exe PID 696 wrote to memory of 1692 696 otsvmrjf.exe otsvmrjf.exe PID 696 wrote to memory of 1692 696 otsvmrjf.exe otsvmrjf.exe PID 696 wrote to memory of 1692 696 otsvmrjf.exe otsvmrjf.exe PID 696 wrote to memory of 1692 696 otsvmrjf.exe otsvmrjf.exe PID 696 wrote to memory of 1692 696 otsvmrjf.exe otsvmrjf.exe PID 696 wrote to memory of 1692 696 otsvmrjf.exe otsvmrjf.exe PID 696 wrote to memory of 1692 696 otsvmrjf.exe otsvmrjf.exe PID 696 wrote to memory of 1692 696 otsvmrjf.exe otsvmrjf.exe PID 696 wrote to memory of 1692 696 otsvmrjf.exe otsvmrjf.exe PID 1692 wrote to memory of 760 1692 otsvmrjf.exe svchost.exe PID 1692 wrote to memory of 760 1692 otsvmrjf.exe svchost.exe PID 1692 wrote to memory of 760 1692 otsvmrjf.exe svchost.exe PID 1692 wrote to memory of 760 1692 otsvmrjf.exe svchost.exe PID 1692 wrote to memory of 760 1692 otsvmrjf.exe svchost.exe PID 1692 wrote to memory of 760 1692 otsvmrjf.exe svchost.exe PID 520 wrote to memory of 1404 520 Backdoor.Win32.Tofsee.exe cmd.exe PID 520 wrote to memory of 1404 520 Backdoor.Win32.Tofsee.exe cmd.exe PID 520 wrote to memory of 1404 520 Backdoor.Win32.Tofsee.exe cmd.exe PID 520 wrote to memory of 1404 520 Backdoor.Win32.Tofsee.exe cmd.exe PID 1404 wrote to memory of 1984 1404 cmd.exe PING.EXE PID 1404 wrote to memory of 1984 1404 cmd.exe PING.EXE PID 1404 wrote to memory of 1984 1404 cmd.exe PING.EXE PID 1404 wrote to memory of 1984 1404 cmd.exe PING.EXE PID 1404 wrote to memory of 1416 1404 cmd.exe PING.EXE PID 1404 wrote to memory of 1416 1404 cmd.exe PING.EXE PID 1404 wrote to memory of 1416 1404 cmd.exe PING.EXE PID 1404 wrote to memory of 1416 1404 cmd.exe PING.EXE PID 1404 wrote to memory of 1576 1404 cmd.exe PING.EXE PID 1404 wrote to memory of 1576 1404 cmd.exe PING.EXE PID 1404 wrote to memory of 1576 1404 cmd.exe PING.EXE PID 1404 wrote to memory of 1576 1404 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\Backdoor.Win32.Tofsee.exe"C:\Users\Admin\AppData\Local\Temp\Backdoor.Win32.Tofsee.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Backdoor.Win32.Tofsee.exe"C:\Users\Admin\AppData\Local\Temp\Backdoor.Win32.Tofsee.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\otsvmrjf.exe"C:\Users\Admin\otsvmrjf.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\otsvmrjf.exe"C:\Users\Admin\otsvmrjf.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\8340.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.14⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\8340.batFilesize
216B
MD509df633913a0e95a0b74bcb990a9598a
SHA14feb02b98298b7ed9eabb55cc00b76dd5bd9ad85
SHA256df2b4923e7429d4681082218e29f0b5af94ac6fa247dec5f9cb8f3bb708b967f
SHA51214a57df6f0e95bee58c3b4c56cfea00c2e0c8e27365eff99d5feae28e02c1d49f0c11f7cc45d3ad744d163868bd76e2ef882a336b43ce68ddfdbecfb96b9fe71
-
C:\Users\Admin\AppData\Local\Temp\8340.batFilesize
216B
MD509df633913a0e95a0b74bcb990a9598a
SHA14feb02b98298b7ed9eabb55cc00b76dd5bd9ad85
SHA256df2b4923e7429d4681082218e29f0b5af94ac6fa247dec5f9cb8f3bb708b967f
SHA51214a57df6f0e95bee58c3b4c56cfea00c2e0c8e27365eff99d5feae28e02c1d49f0c11f7cc45d3ad744d163868bd76e2ef882a336b43ce68ddfdbecfb96b9fe71
-
C:\Users\Admin\otsvmrjf.exeFilesize
45.6MB
MD5ec69e31e88a1bd352cee621d0a6bb1ff
SHA15f9fb035c71424b869ae8d4058dfd768ed80cefe
SHA256235daaf1dc95405d349b22e9167cf7ed015878fee91f63f72094c48700783383
SHA5120295c270ba50b342cc4f5b7235d9e6d21c88e778c65604e705c9911d6310f29c40aaad1fdcfc5d9d9a5edd16730fc157b83d349f6f445569ada654a26026f07d
-
C:\Users\Admin\otsvmrjf.exeFilesize
45.6MB
MD5ec69e31e88a1bd352cee621d0a6bb1ff
SHA15f9fb035c71424b869ae8d4058dfd768ed80cefe
SHA256235daaf1dc95405d349b22e9167cf7ed015878fee91f63f72094c48700783383
SHA5120295c270ba50b342cc4f5b7235d9e6d21c88e778c65604e705c9911d6310f29c40aaad1fdcfc5d9d9a5edd16730fc157b83d349f6f445569ada654a26026f07d
-
C:\Users\Admin\otsvmrjf.exeFilesize
45.6MB
MD5ec69e31e88a1bd352cee621d0a6bb1ff
SHA15f9fb035c71424b869ae8d4058dfd768ed80cefe
SHA256235daaf1dc95405d349b22e9167cf7ed015878fee91f63f72094c48700783383
SHA5120295c270ba50b342cc4f5b7235d9e6d21c88e778c65604e705c9911d6310f29c40aaad1fdcfc5d9d9a5edd16730fc157b83d349f6f445569ada654a26026f07d
-
C:\Users\Admin\otsvmrjf.exeFilesize
45.6MB
MD5ec69e31e88a1bd352cee621d0a6bb1ff
SHA15f9fb035c71424b869ae8d4058dfd768ed80cefe
SHA256235daaf1dc95405d349b22e9167cf7ed015878fee91f63f72094c48700783383
SHA5120295c270ba50b342cc4f5b7235d9e6d21c88e778c65604e705c9911d6310f29c40aaad1fdcfc5d9d9a5edd16730fc157b83d349f6f445569ada654a26026f07d
-
\Users\Admin\otsvmrjf.exeFilesize
45.6MB
MD5ec69e31e88a1bd352cee621d0a6bb1ff
SHA15f9fb035c71424b869ae8d4058dfd768ed80cefe
SHA256235daaf1dc95405d349b22e9167cf7ed015878fee91f63f72094c48700783383
SHA5120295c270ba50b342cc4f5b7235d9e6d21c88e778c65604e705c9911d6310f29c40aaad1fdcfc5d9d9a5edd16730fc157b83d349f6f445569ada654a26026f07d
-
\Users\Admin\otsvmrjf.exeFilesize
45.6MB
MD5ec69e31e88a1bd352cee621d0a6bb1ff
SHA15f9fb035c71424b869ae8d4058dfd768ed80cefe
SHA256235daaf1dc95405d349b22e9167cf7ed015878fee91f63f72094c48700783383
SHA5120295c270ba50b342cc4f5b7235d9e6d21c88e778c65604e705c9911d6310f29c40aaad1fdcfc5d9d9a5edd16730fc157b83d349f6f445569ada654a26026f07d
-
memory/520-56-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/520-65-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/520-73-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/760-99-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB
-
memory/760-92-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB
-
memory/760-94-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB
-
memory/760-93-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/760-100-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB
-
memory/760-104-0x00000000000A0000-0x00000000000A1000-memory.dmpFilesize
4KB
-
memory/760-105-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB
-
memory/760-106-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB
-
memory/760-119-0x0000000000080000-0x0000000000092000-memory.dmpFilesize
72KB
-
memory/1692-95-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1692-90-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1692-87-0x0000000000400000-0x0000000000400000-memory.dmp