tofsee | 787cc52fcb94334b237932627fa7a1a843c5a9f79b3827b1bc899773601e1d4e

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
08/08/2023, 06:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 295KB
Sample230808-gva6mscd71
SHA256 787cc52fcb94334b237932627fa7a1a843c5a9f79b3827b1bc899773601e1d4e
MD5 5c00ce09a4e183802027bb3315473c8d
SHA1 d2cd5774fdfa0b40a26e35e74364f8b54336aefe
SHA512 f974cf2c5950803858511737a58b429d8a7156ba4394e98830bac23674eb3c32de5854685f11df4ea79add488985879bd1f865d5aa240e74c4b20021b552475f
SSDEEP 3072:M27w3MOJE+8lAgf2dgSDuZ+rowNVTdF+7fIdR3ew:zMDJql1ejQyowNVTdFqiJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

vanaheim.cn
jotunheim.name

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
3424	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\jqrbtoua\ImagePath = "C:\\Windows\\SysWOW64\\jqrbtoua\\qtqjacwm.exe"	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
1584	qtqjacwm.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile:.repos	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1584 set thread context of 4196	1584	qtqjacwm.exe	101

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5076	sc.exe
1460	sc.exe
720	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4592	4436	WerFault.exe	81
3476	1584	WerFault.exe	95

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Buses	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\Buses\Config0 = acbb773ca571df0024edb47d450dd49d084297dce82e72baa4c03b8aec55e81d1bb1f98e87cd945d24edb47d470dd49d024195daf71261adc06d04fda6e22673bbc9154961cda56812d886497039e0ad644490bdb57f21e4945e05c4f3be54758df21d5904e0a76a11da814d753fe19d084295d9e13f4bb4c06d00fdadfd542fd69f430a36fba769249ec60b1b79bdf0012dc58eb07420ed945b02cdc4e13b7e85c12b496da0f15d15d882487639e0a8531af459a4e1147c182669fdc48d541ce4ad744a6bbfff02579fc27d440dd49d642df4652fa87698a46d34fdc741461ee4ad743c32ffba6c16df9a4c7c39faa85c2df4bd844d14dda46d34fdc48d541de4ad743d04cd945d24edb47d440dd49d642df4bd844d14dda46d34fdc48d541de4ad743de1cc945d	svchost.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 2292	4436	file.exe	82
PID 4436 wrote to memory of 2292	4436	file.exe	82
PID 4436 wrote to memory of 2292	4436	file.exe	82
PID 4436 wrote to memory of 4792	4436	file.exe	84
PID 4436 wrote to memory of 4792	4436	file.exe	84
PID 4436 wrote to memory of 4792	4436	file.exe	84
PID 4436 wrote to memory of 1460	4436	file.exe	87
PID 4436 wrote to memory of 1460	4436	file.exe	87
PID 4436 wrote to memory of 1460	4436	file.exe	87
PID 4436 wrote to memory of 720	4436	file.exe	89
PID 4436 wrote to memory of 720	4436	file.exe	89
PID 4436 wrote to memory of 720	4436	file.exe	89
PID 4436 wrote to memory of 5076	4436	file.exe	93
PID 4436 wrote to memory of 5076	4436	file.exe	93
PID 4436 wrote to memory of 5076	4436	file.exe	93
PID 4436 wrote to memory of 3424	4436	file.exe	96
PID 4436 wrote to memory of 3424	4436	file.exe	96
PID 4436 wrote to memory of 3424	4436	file.exe	96
PID 1584 wrote to memory of 4196	1584	qtqjacwm.exe	101
PID 1584 wrote to memory of 4196	1584	qtqjacwm.exe	101
PID 1584 wrote to memory of 4196	1584	qtqjacwm.exe	101
PID 1584 wrote to memory of 4196	1584	qtqjacwm.exe	101
PID 1584 wrote to memory of 4196	1584	qtqjacwm.exe	101

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\jqrbtoua\
  2⤵
  PID:2292
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\qtqjacwm.exe" C:\Windows\SysWOW64\jqrbtoua\
  2⤵
  PID:4792
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create jqrbtoua binPath= "C:\Windows\SysWOW64\jqrbtoua\qtqjacwm.exe /d\"C:\Users\Admin\AppData\Local\Temp\file.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:1460
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description jqrbtoua "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:720
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start jqrbtoua
  2⤵
  - Launches sc.exe
  PID:5076
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:3424
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 572
  2⤵
  - Program crash
  PID:4592

C:\Windows\SysWOW64\jqrbtoua\qtqjacwm.exe
C:\Windows\SysWOW64\jqrbtoua\qtqjacwm.exe /d"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:4196
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 560
  2⤵
  - Program crash
  PID:3476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4436 -ip 4436
1⤵
PID:1244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1584 -ip 1584
1⤵
PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qtqjacwm.exe

Path C:\Users\Admin\AppData\Local\Temp\qtqjacwm.exe
Size 14.5MB
SHA256 51e037e1c878e7c769ae444e62d9e40527fcadd3a5085a34d52395467c390be1
MD5 6bca482381d4e487c5e9ae7a2cbbc369
SHA1 44b9b630d7de2ed6e3ecf8a02f7172cfc30c0bd3
SHA512 9d4eaf5246906945438cdeb93ee133eb2fe81297abeb8fbf0783b108fc7624f3140c4d9d92b72d974accc9813547d7ea09cfd3e9d2a33ad4aef38577c04e3b66
SSDEEP 12288:WkEl1ec2LpBJkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkI:Wk97
MD5 SHA1 SHA512 SSDEEP

Submit Download

qtqjacwm.exe

Path C:\Windows\SysWOW64\jqrbtoua\qtqjacwm.exe
Size 14.5MB
SHA256 51e037e1c878e7c769ae444e62d9e40527fcadd3a5085a34d52395467c390be1
MD5 6bca482381d4e487c5e9ae7a2cbbc369
SHA1 44b9b630d7de2ed6e3ecf8a02f7172cfc30c0bd3
SHA512 9d4eaf5246906945438cdeb93ee133eb2fe81297abeb8fbf0783b108fc7624f3140c4d9d92b72d974accc9813547d7ea09cfd3e9d2a33ad4aef38577c04e3b66
SSDEEP 12288:WkEl1ec2LpBJkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkI:Wk97
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1584-144-0x0000000002BC0000-0x0000000002BD3000-memory.dmp

Download

memory/1584-148-0x0000000000400000-0x00000000022F1000-memory.dmp

Download

memory/1584-147-0x0000000000400000-0x00000000022F1000-memory.dmp

Download

memory/1584-142-0x0000000002320000-0x0000000002420000-memory.dmp

Download

memory/4196-143-0x0000000000AB0000-0x0000000000AC5000-memory.dmp

Download

memory/4196-151-0x0000000000AB0000-0x0000000000AC5000-memory.dmp

Download

memory/4196-152-0x0000000000AB0000-0x0000000000AC5000-memory.dmp

Download

memory/4196-153-0x0000000000AB0000-0x0000000000AC5000-memory.dmp

Download

memory/4196-154-0x0000000000AB0000-0x0000000000AC5000-memory.dmp

Download

memory/4436-141-0x00000000024C0000-0x00000000025C0000-memory.dmp

Download

memory/4436-134-0x00000000024C0000-0x00000000025C0000-memory.dmp

Download

memory/4436-137-0x0000000000400000-0x00000000022F1000-memory.dmp

Download

memory/4436-149-0x0000000000400000-0x00000000022F1000-memory.dmp

Download

memory/4436-135-0x0000000002460000-0x0000000002473000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads