tofsee | eb83af89295470eacddb4854fdce4d921f814ad636e70648ddd3b03295463492

General

Target

yoepjxj2k.exe
Size

231KB
MD5

e24bde37506309010eaaa9cd16543deb
SHA1

7b3184f8b36410489725fab73d8f3b699811fcdd
SHA256

eb83af89295470eacddb4854fdce4d921f814ad636e70648ddd3b03295463492
SHA512

13a8697c00f591bf354e8e477b0248b6668d2c5e0ea98b5b390bd6922df94a67476d9e68e017ca685d0e0d14a0bd0ab1f127476d808aefc9c06199624f8fe421
SSDEEP

3072:kJqiwS9dIvHI/vMkB3ld6iV8/1F5MwmF7a19Zubmqv5NxFul5gR/8WI4Oh6Ixq:K53dEoHM43haF5MwEakhLCyR0Wy

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

vanaheim.cn

jotunheim.name

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

New Service
T1050
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

2532 netsh.exe

pid	process
2532	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xufbsuyq\ImagePath = "C:\\Windows\\SysWOW64\\xufbsuyq\\htbyerxv.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

yoepjxj2k.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	yoepjxj2k.exe

Executes dropped EXE 1 IoCs

Processes:

htbyerxv.exe

pid process

2416 htbyerxv.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

htbyerxv.exe

description pid process target process

PID 2416 set thread context of 32 2416 htbyerxv.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

4500 sc.exe
1416 sc.exe
4504 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2296 2116 WerFault.exe yoepjxj2k.exe
460 2416 WerFault.exe htbyerxv.exe

pid	process
2416	htbyerxv.exe

description	pid	process	target process
PID 2416 set thread context of 32	2416	htbyerxv.exe	svchost.exe

pid	process
4500	sc.exe
1416	sc.exe
4504	sc.exe

pid	pid_target	process	target process
2296	2116	WerFault.exe	yoepjxj2k.exe
460	2416	WerFault.exe	htbyerxv.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

yoepjxj2k.exehtbyerxv.exe

description	pid	process	target process
PID 2116 wrote to memory of 2072	2116	yoepjxj2k.exe	cmd.exe
PID 2116 wrote to memory of 2072	2116	yoepjxj2k.exe	cmd.exe
PID 2116 wrote to memory of 2072	2116	yoepjxj2k.exe	cmd.exe
PID 2116 wrote to memory of 3884	2116	yoepjxj2k.exe	cmd.exe
PID 2116 wrote to memory of 3884	2116	yoepjxj2k.exe	cmd.exe
PID 2116 wrote to memory of 3884	2116	yoepjxj2k.exe	cmd.exe
PID 2116 wrote to memory of 4500	2116	yoepjxj2k.exe	sc.exe
PID 2116 wrote to memory of 4500	2116	yoepjxj2k.exe	sc.exe
PID 2116 wrote to memory of 4500	2116	yoepjxj2k.exe	sc.exe
PID 2116 wrote to memory of 1416	2116	yoepjxj2k.exe	sc.exe
PID 2116 wrote to memory of 1416	2116	yoepjxj2k.exe	sc.exe
PID 2116 wrote to memory of 1416	2116	yoepjxj2k.exe	sc.exe
PID 2116 wrote to memory of 4504	2116	yoepjxj2k.exe	sc.exe
PID 2116 wrote to memory of 4504	2116	yoepjxj2k.exe	sc.exe
PID 2116 wrote to memory of 4504	2116	yoepjxj2k.exe	sc.exe
PID 2116 wrote to memory of 2532	2116	yoepjxj2k.exe	netsh.exe
PID 2116 wrote to memory of 2532	2116	yoepjxj2k.exe	netsh.exe
PID 2116 wrote to memory of 2532	2116	yoepjxj2k.exe	netsh.exe
PID 2416 wrote to memory of 32	2416	htbyerxv.exe	svchost.exe
PID 2416 wrote to memory of 32	2416	htbyerxv.exe	svchost.exe
PID 2416 wrote to memory of 32	2416	htbyerxv.exe	svchost.exe
PID 2416 wrote to memory of 32	2416	htbyerxv.exe	svchost.exe
PID 2416 wrote to memory of 32	2416	htbyerxv.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\yoepjxj2k.exe
"C:\Users\Admin\AppData\Local\Temp\yoepjxj2k.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2116

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\xufbsuyq\
2⤵
PID:2072

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\htbyerxv.exe" C:\Windows\SysWOW64\xufbsuyq\
2⤵
PID:3884

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create xufbsuyq binPath= "C:\Windows\SysWOW64\xufbsuyq\htbyerxv.exe /d\"C:\Users\Admin\AppData\Local\Temp\yoepjxj2k.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:4500

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description xufbsuyq "wifi internet conection"
2⤵
- Launches sc.exe
PID:1416

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start xufbsuyq
2⤵
- Launches sc.exe
PID:4504

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:2532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 1200
2⤵
- Program crash
PID:2296

C:\Windows\SysWOW64\xufbsuyq\htbyerxv.exe
C:\Windows\SysWOW64\xufbsuyq\htbyerxv.exe /d"C:\Users\Admin\AppData\Local\Temp\yoepjxj2k.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2416

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Sets service image path in registry
PID:32

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 512
2⤵
- Program crash
PID:460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2116 -ip 2116
1⤵
PID:1552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2416 -ip 2416
1⤵
PID:324

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

New Service

1

T1050

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

New Service

1

T1050

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\htbyerxv.exe
Filesize
10.2MB

MD5
b65b722d414731f8a3d92cd3b1db6756

SHA1
14d1e6b326d6651d500c391344f632e048021807

SHA256
fda79b9be9c786367b1f1e4e657e484931ba35f11f2ac1e876ca1489f7ab616c

SHA512
e7160f3106289222c68c9427754dcc68d8024c955a5153deb90057d1529fcce67021f9b167af31684ca961544ce8ebb52faa0f87d5a14393306bef865656410d

Download Submit
C:\Windows\SysWOW64\xufbsuyq\htbyerxv.exe
Filesize
10.2MB

MD5
b65b722d414731f8a3d92cd3b1db6756

SHA1
14d1e6b326d6651d500c391344f632e048021807

SHA256
fda79b9be9c786367b1f1e4e657e484931ba35f11f2ac1e876ca1489f7ab616c

SHA512
e7160f3106289222c68c9427754dcc68d8024c955a5153deb90057d1529fcce67021f9b167af31684ca961544ce8ebb52faa0f87d5a14393306bef865656410d

Download Submit
memory/32-140-0x0000000000790000-0x00000000007A5000-memory.dmp

Filesize
84KB

Download
memory/32-143-0x0000000000790000-0x00000000007A5000-memory.dmp

Filesize
84KB

Download
memory/32-145-0x0000000000790000-0x00000000007A5000-memory.dmp

Filesize
84KB

Download
memory/32-146-0x0000000000790000-0x00000000007A5000-memory.dmp

Filesize
84KB

Download
memory/32-147-0x0000000000790000-0x00000000007A5000-memory.dmp

Filesize
84KB

Download
memory/2116-135-0x00000000022E0000-0x00000000022F3000-memory.dmp

Filesize
76KB

Download
memory/2116-138-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/2416-144-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads