tofsee | 8e7b46b880092192df1a09ea0fd5878b17d1ba9ae89c5de6d61d74d1dd3e35f6

General

Target

file.exe
Size

351KB
MD5

9f95df4831aaa8dc6bd0cd4584f59e9b
SHA1

14db8de87695de3074043932e8479e18ac2dd5d3
SHA256

8e7b46b880092192df1a09ea0fd5878b17d1ba9ae89c5de6d61d74d1dd3e35f6
SHA512

e2473f43d1898f6560935a4411de525ebdec2780d3c43132ebfec6adaa4e4de43b2af4ad4542ee1c3cd910a30718b79b04aa52143ea03c7b1edb78d495f71aee
SSDEEP

6144:r/eUB2wMyGWA1qom6IvMlU9kaXOOEbLQHl2QSzVhn25Y:r/hBVPGWA106bha+OKsRSL6Y

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

vanaheim.cn

jotunheim.name

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\fififukb = "0"	svchost.exe

Creates new service(s) 1 TTPs
persistence

New Service
T1050
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1920 netsh.exe

pid	process
1920	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\fififukb\ImagePath = "C:\\Windows\\SysWOW64\\fififukb\\trgohxso.exe"	svchost.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

1776 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

trgohxso.exe

pid process

336 trgohxso.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

trgohxso.exe

description pid process target process

PID 336 set thread context of 1776 336 trgohxso.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

1168 sc.exe
580 sc.exe
1072 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1776	svchost.exe

pid	process
336	trgohxso.exe

description	pid	process	target process
PID 336 set thread context of 1776	336	trgohxso.exe	svchost.exe

pid	process
1168	sc.exe
580	sc.exe
1072	sc.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

file.exetrgohxso.exe

description	pid	process	target process
PID 2040 wrote to memory of 1992	2040	file.exe	cmd.exe
PID 2040 wrote to memory of 1992	2040	file.exe	cmd.exe
PID 2040 wrote to memory of 1992	2040	file.exe	cmd.exe
PID 2040 wrote to memory of 1992	2040	file.exe	cmd.exe
PID 2040 wrote to memory of 1968	2040	file.exe	cmd.exe
PID 2040 wrote to memory of 1968	2040	file.exe	cmd.exe
PID 2040 wrote to memory of 1968	2040	file.exe	cmd.exe
PID 2040 wrote to memory of 1968	2040	file.exe	cmd.exe
PID 2040 wrote to memory of 1168	2040	file.exe	sc.exe
PID 2040 wrote to memory of 1168	2040	file.exe	sc.exe
PID 2040 wrote to memory of 1168	2040	file.exe	sc.exe
PID 2040 wrote to memory of 1168	2040	file.exe	sc.exe
PID 2040 wrote to memory of 580	2040	file.exe	sc.exe
PID 2040 wrote to memory of 580	2040	file.exe	sc.exe
PID 2040 wrote to memory of 580	2040	file.exe	sc.exe
PID 2040 wrote to memory of 580	2040	file.exe	sc.exe
PID 2040 wrote to memory of 1072	2040	file.exe	sc.exe
PID 2040 wrote to memory of 1072	2040	file.exe	sc.exe
PID 2040 wrote to memory of 1072	2040	file.exe	sc.exe
PID 2040 wrote to memory of 1072	2040	file.exe	sc.exe
PID 2040 wrote to memory of 1920	2040	file.exe	netsh.exe
PID 2040 wrote to memory of 1920	2040	file.exe	netsh.exe
PID 2040 wrote to memory of 1920	2040	file.exe	netsh.exe
PID 2040 wrote to memory of 1920	2040	file.exe	netsh.exe
PID 336 wrote to memory of 1776	336	trgohxso.exe	svchost.exe
PID 336 wrote to memory of 1776	336	trgohxso.exe	svchost.exe
PID 336 wrote to memory of 1776	336	trgohxso.exe	svchost.exe
PID 336 wrote to memory of 1776	336	trgohxso.exe	svchost.exe
PID 336 wrote to memory of 1776	336	trgohxso.exe	svchost.exe
PID 336 wrote to memory of 1776	336	trgohxso.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\fififukb\
2⤵
PID:1992

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\trgohxso.exe" C:\Windows\SysWOW64\fififukb\
2⤵
PID:1968

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create fififukb binPath= "C:\Windows\SysWOW64\fififukb\trgohxso.exe /d\"C:\Users\Admin\AppData\Local\Temp\file.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:1168

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description fififukb "wifi internet conection"
2⤵
- Launches sc.exe
PID:580

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start fififukb
2⤵
- Launches sc.exe
PID:1072

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:1920

C:\Windows\SysWOW64\fififukb\trgohxso.exe
C:\Windows\SysWOW64\fififukb\trgohxso.exe /d"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:336

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
PID:1776

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

New Service

1

T1050

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

New Service

1

T1050

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\trgohxso.exe
Filesize
11.0MB

MD5
26843974afbe2ed47e619de41e95c5fc

SHA1
37ca5ecd6124aef43f0f57d2ca0d6e016642e6f9

SHA256
2f2b70d0651365389aa05c021ffb7c199ac72c0bfa70813d42fa5cca920bf961

SHA512
a2bab6b376b14d5fc67653389afb9bbeb857bf3794668b767e59b8c8f228ea93cafec12e67ae26c69cb745aa182e232655a4ca0bd1a3ab3d5bf161e4a2f2fe0a

Download Submit
C:\Windows\SysWOW64\fififukb\trgohxso.exe
Filesize
11.0MB

MD5
26843974afbe2ed47e619de41e95c5fc

SHA1
37ca5ecd6124aef43f0f57d2ca0d6e016642e6f9

SHA256
2f2b70d0651365389aa05c021ffb7c199ac72c0bfa70813d42fa5cca920bf961

SHA512
a2bab6b376b14d5fc67653389afb9bbeb857bf3794668b767e59b8c8f228ea93cafec12e67ae26c69cb745aa182e232655a4ca0bd1a3ab3d5bf161e4a2f2fe0a

Download Submit
memory/336-64-0x0000000000400000-0x00000000007FC000-memory.dmp

Filesize
4.0MB

Download
memory/1776-62-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1776-61-0x00000000000C0000-0x00000000000D5000-memory.dmp

Filesize
84KB

Download
memory/1776-63-0x00000000000C0000-0x00000000000D5000-memory.dmp

Filesize
84KB

Download
memory/1776-67-0x00000000000C0000-0x00000000000D5000-memory.dmp

Filesize
84KB

Download
memory/1776-68-0x00000000000C0000-0x00000000000D5000-memory.dmp

Filesize
84KB

Download
memory/1776-69-0x00000000000C0000-0x00000000000D5000-memory.dmp

Filesize
84KB

Download
memory/1776-70-0x00000000000C0000-0x00000000000D5000-memory.dmp

Filesize
84KB

Download
memory/2040-56-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download
memory/2040-58-0x0000000000400000-0x00000000007FC000-memory.dmp

Filesize
4.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads