tofsee | 72d074460e5807725c7d6f0ca1f923dbd069b93f86f718f3cb91c9140dd08007

General

Target

file.exe
Size

294KB
MD5

49c95ae2a4f0069f5ef8cb7c70860531
SHA1

1fc8490eb5d14a148a263e744bd791b1f01e6f6a
SHA256

72d074460e5807725c7d6f0ca1f923dbd069b93f86f718f3cb91c9140dd08007
SHA512

28be09331d4bf0191a8bb909fdb17a99bafc193e4433ebd6ff1614ba4ecdb3d3ed8ab0840bcae2b59aee04aea41b6ef9bd12b62332b308417b755c2aaaad5c66
SSDEEP

3072:/pXlqtP8WsLZPdb/3dLhA2AquW0eAb14h+8hsFd825sCwKV1IN:1lkPHsLZPV/3aquSA5U6dUCa

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

vanaheim.cn

jotunheim.name

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\kitygzle = "0"	svchost.exe

Creates new service(s) 1 TTPs
persistence

New Service
T1050
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1700 netsh.exe

pid	process
1700	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\kitygzle\ImagePath = "C:\\Windows\\SysWOW64\\kitygzle\\hovynbue.exe"	svchost.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

936 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

hovynbue.exe

pid process

1188 hovynbue.exe
Drops file in System32 directory 1 IoCs

Processes:

svchost.exe

description ioc process

File created C:\Windows\SysWOW64\config\systemprofile:.repos svchost.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

hovynbue.exe

description pid process target process

PID 1188 set thread context of 936 1188 hovynbue.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

584 sc.exe
520 sc.exe
976 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
936	svchost.exe

pid	process
1188	hovynbue.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile:.repos	svchost.exe

description	pid	process	target process
PID 1188 set thread context of 936	1188	hovynbue.exe	svchost.exe

pid	process
584	sc.exe
520	sc.exe
976	sc.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Buses	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\Buses\Config0 = 3cc8143df8f34d0124edb47d450dd49d084297dce82e72baa49c11fd207f711d249dd16281cd945d24edb47d470dd49d024195daf71261adc06d04fda6e22673bbc9154961cda56811da8349753ee4af644490bdb57b27ef945902c8f4ba54758df21d5904e0a66d1dda87457d3ae2aa64419bdce0286682cd0934c9c4e4241ddd9e410936faa6691cedc70f3252a0f40948f490b57425ef905f00ccf3bc54718bce15515bb9fd3041ed8548713ae3a9551ec48584a934d4a4910a24988d541de4ac743d04bafb2f4fb2c70f320dd49d642df4bd843a7e54b22834fdc48d57d1f6ae743d04ccac6d0adb82537338faaf5119f4bd844d14dda46d34fdc48d541de4ad743d04cd945d24edb47d440dd49d642df4bd844d14dda46d34fdc48d541de4ad743d04cd775c24ed	svchost.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

file.exehovynbue.exe

description	pid	process	target process
PID 1400 wrote to memory of 1316	1400	file.exe	cmd.exe
PID 1400 wrote to memory of 1316	1400	file.exe	cmd.exe
PID 1400 wrote to memory of 1316	1400	file.exe	cmd.exe
PID 1400 wrote to memory of 1316	1400	file.exe	cmd.exe
PID 1400 wrote to memory of 2032	1400	file.exe	cmd.exe
PID 1400 wrote to memory of 2032	1400	file.exe	cmd.exe
PID 1400 wrote to memory of 2032	1400	file.exe	cmd.exe
PID 1400 wrote to memory of 2032	1400	file.exe	cmd.exe
PID 1400 wrote to memory of 584	1400	file.exe	sc.exe
PID 1400 wrote to memory of 584	1400	file.exe	sc.exe
PID 1400 wrote to memory of 584	1400	file.exe	sc.exe
PID 1400 wrote to memory of 584	1400	file.exe	sc.exe
PID 1400 wrote to memory of 520	1400	file.exe	sc.exe
PID 1400 wrote to memory of 520	1400	file.exe	sc.exe
PID 1400 wrote to memory of 520	1400	file.exe	sc.exe
PID 1400 wrote to memory of 520	1400	file.exe	sc.exe
PID 1400 wrote to memory of 976	1400	file.exe	sc.exe
PID 1400 wrote to memory of 976	1400	file.exe	sc.exe
PID 1400 wrote to memory of 976	1400	file.exe	sc.exe
PID 1400 wrote to memory of 976	1400	file.exe	sc.exe
PID 1400 wrote to memory of 1700	1400	file.exe	netsh.exe
PID 1400 wrote to memory of 1700	1400	file.exe	netsh.exe
PID 1400 wrote to memory of 1700	1400	file.exe	netsh.exe
PID 1400 wrote to memory of 1700	1400	file.exe	netsh.exe
PID 1188 wrote to memory of 936	1188	hovynbue.exe	svchost.exe
PID 1188 wrote to memory of 936	1188	hovynbue.exe	svchost.exe
PID 1188 wrote to memory of 936	1188	hovynbue.exe	svchost.exe
PID 1188 wrote to memory of 936	1188	hovynbue.exe	svchost.exe
PID 1188 wrote to memory of 936	1188	hovynbue.exe	svchost.exe
PID 1188 wrote to memory of 936	1188	hovynbue.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1400

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\kitygzle\
2⤵
PID:1316

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\hovynbue.exe" C:\Windows\SysWOW64\kitygzle\
2⤵
PID:2032

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create kitygzle binPath= "C:\Windows\SysWOW64\kitygzle\hovynbue.exe /d\"C:\Users\Admin\AppData\Local\Temp\file.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:584

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description kitygzle "wifi internet conection"
2⤵
- Launches sc.exe
PID:520

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start kitygzle
2⤵
- Launches sc.exe
PID:976

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:1700

C:\Windows\SysWOW64\kitygzle\hovynbue.exe
C:\Windows\SysWOW64\kitygzle\hovynbue.exe /d"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1188

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:936

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

New Service

1

T1050

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

New Service

1

T1050

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hovynbue.exe
Filesize
10.1MB

MD5
0813e80ca6466fb4f99c52fe7d8ff887

SHA1
f7affe702bc7b051e24a38c5c5d435ae273fc780

SHA256
9e56d5073accab613f85a2a83d9550c9072bda575f3d9c3483bbb554602ad83f

SHA512
56db219330f505de1875782e03b63fd35f02dae4dd28556c0fc03187705b3ca8097a341cb066131f9b8c91b970cde8436d3a5f78ee58fb71856c94d60ecc87c2

Download Submit
C:\Windows\SysWOW64\kitygzle\hovynbue.exe
Filesize
10.1MB

MD5
0813e80ca6466fb4f99c52fe7d8ff887

SHA1
f7affe702bc7b051e24a38c5c5d435ae273fc780

SHA256
9e56d5073accab613f85a2a83d9550c9072bda575f3d9c3483bbb554602ad83f

SHA512
56db219330f505de1875782e03b63fd35f02dae4dd28556c0fc03187705b3ca8097a341cb066131f9b8c91b970cde8436d3a5f78ee58fb71856c94d60ecc87c2

Download Submit
memory/936-61-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/936-62-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/936-63-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/936-67-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/936-68-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/936-69-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/936-71-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/1188-64-0x0000000000400000-0x0000000002367000-memory.dmp

Filesize
31.4MB

Download
memory/1400-56-0x00000000001B0000-0x00000000001C3000-memory.dmp

Filesize
76KB

Download
memory/1400-60-0x0000000000400000-0x0000000002367000-memory.dmp

Filesize
31.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads