tofsee | 4f82ce0fc03fc61ebb8ee507e02d53c4ef047b612d32954d48679ec0e31857eb

General

Target

file.exe
Size

193KB
MD5

85566c0e8a1a7493e65abc47e1ed2f52
SHA1

0fc665eb362732bb0f3749968c60271439e606b4
SHA256

4f82ce0fc03fc61ebb8ee507e02d53c4ef047b612d32954d48679ec0e31857eb
SHA512

2b3d77f8a035d729e40e9285ea02eaff18b7b6383a05f1c9eba477eec4c988000a49c7a19013d53963b1c802ecd26968ca0e4c90423b342b11dc280803158892
SSDEEP

3072:VTeAgFiHFfxX/uC7TU8nS/USEeiHBSIykHrWzcE502+ovV:yilfxBm/dlihRyWqnZV

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

vanaheim.cn

jotunheim.name

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
440	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation	file.exe

Executes dropped EXE 1 IoCs

pid	Process
3260	rdpurxwk.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1696	sc.exe
208	sc.exe
4144	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2524	4740	WerFault.exe	81

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 1280	4740	file.exe	100
PID 4740 wrote to memory of 1280	4740	file.exe	100
PID 4740 wrote to memory of 1280	4740	file.exe	100
PID 4740 wrote to memory of 880	4740	file.exe	102
PID 4740 wrote to memory of 880	4740	file.exe	102
PID 4740 wrote to memory of 880	4740	file.exe	102
PID 4740 wrote to memory of 1696	4740	file.exe	104
PID 4740 wrote to memory of 1696	4740	file.exe	104
PID 4740 wrote to memory of 1696	4740	file.exe	104
PID 4740 wrote to memory of 208	4740	file.exe	106
PID 4740 wrote to memory of 208	4740	file.exe	106
PID 4740 wrote to memory of 208	4740	file.exe	106
PID 4740 wrote to memory of 4144	4740	file.exe	108
PID 4740 wrote to memory of 4144	4740	file.exe	108
PID 4740 wrote to memory of 4144	4740	file.exe	108
PID 4740 wrote to memory of 440	4740	file.exe	110
PID 4740 wrote to memory of 440	4740	file.exe	110
PID 4740 wrote to memory of 440	4740	file.exe	110

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\drmcflyq\
  2⤵
  PID:1280
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\rdpurxwk.exe" C:\Windows\SysWOW64\drmcflyq\
  2⤵
  PID:880
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create drmcflyq binPath= "C:\Windows\SysWOW64\drmcflyq\rdpurxwk.exe /d\"C:\Users\Admin\AppData\Local\Temp\file.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:1696
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description drmcflyq "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:208
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start drmcflyq
  2⤵
  - Launches sc.exe
  PID:4144
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 1260
  2⤵
  - Program crash
  PID:2524

C:\Windows\SysWOW64\drmcflyq\rdpurxwk.exe
C:\Windows\SysWOW64\drmcflyq\rdpurxwk.exe /d"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Executes dropped EXE
PID:3260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4740 -ip 4740
1⤵
PID:984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rdpurxwk.exe

Filesize
14.2MB

MD5
62024b53b011f1f6c72821116595fe87

SHA1
efee57871457affb0a862c00c692a649264e2f7d

SHA256
fe5da4ccc1fc04c831a440697a064ec2deb4d449f45a3ca72eafeccb89d43237

SHA512
1233d52c23d83c79ff7726d6844c5e129bda2cdc3a4f3eb3be4fb73a25a7a0dbfcea7a5128e3d091d1079297014a3d9eadf21d93c18c896bc0d0aa12a44b0a1c

Download Submit
C:\Windows\SysWOW64\drmcflyq\rdpurxwk.exe

Filesize
14.2MB

MD5
62024b53b011f1f6c72821116595fe87

SHA1
efee57871457affb0a862c00c692a649264e2f7d

SHA256
fe5da4ccc1fc04c831a440697a064ec2deb4d449f45a3ca72eafeccb89d43237

SHA512
1233d52c23d83c79ff7726d6844c5e129bda2cdc3a4f3eb3be4fb73a25a7a0dbfcea7a5128e3d091d1079297014a3d9eadf21d93c18c896bc0d0aa12a44b0a1c

Download Submit
memory/4740-0-0x0000000002180000-0x0000000002195000-memory.dmp

Filesize
84KB

Download
memory/4740-1-0x0000000000440000-0x0000000000453000-memory.dmp

Filesize
76KB

Download
memory/4740-2-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4740-5-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4740-7-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4740-8-0x0000000000440000-0x0000000000453000-memory.dmp

Filesize
76KB

Download
memory/4740-9-0x0000000002180000-0x0000000002195000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads