tofsee | b8de746feded9dbd1fb290b18d44d33eb02aaa069f789a92fb630ffa585def95

General

Target

file.exe
Size

195KB
MD5

cc2db916f8e2020ed1cf4f741777d101
SHA1

40e5d582687651ec748be305901738e009a77c9b
SHA256

b8de746feded9dbd1fb290b18d44d33eb02aaa069f789a92fb630ffa585def95
SHA512

a527fd44fef11e875c043a92d08e28b307075ab7a498491dc929883f65bdaf1a69a1e046557960406dec925fc8a6f48ec68ae4ec2cc9e98775b34d372741f6e1
SSDEEP

3072:pPTBMwuu/85WrfofsEeF3IedhnrA7kdSzLYrvNR/4k9Y5IAOmKT0:hTBMo/85QgheFNXrr04zNR/r989

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

vanaheim.cn

jotunheim.name

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
1160	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation	file.exe

Executes dropped EXE 1 IoCs

pid	Process
256	rurkbdxn.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4500	sc.exe
860	sc.exe
2004	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3656	1880	WerFault.exe	81

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 1684	1880	file.exe	100
PID 1880 wrote to memory of 1684	1880	file.exe	100
PID 1880 wrote to memory of 1684	1880	file.exe	100
PID 1880 wrote to memory of 3360	1880	file.exe	102
PID 1880 wrote to memory of 3360	1880	file.exe	102
PID 1880 wrote to memory of 3360	1880	file.exe	102
PID 1880 wrote to memory of 4500	1880	file.exe	104
PID 1880 wrote to memory of 4500	1880	file.exe	104
PID 1880 wrote to memory of 4500	1880	file.exe	104
PID 1880 wrote to memory of 860	1880	file.exe	106
PID 1880 wrote to memory of 860	1880	file.exe	106
PID 1880 wrote to memory of 860	1880	file.exe	106
PID 1880 wrote to memory of 2004	1880	file.exe	108
PID 1880 wrote to memory of 2004	1880	file.exe	108
PID 1880 wrote to memory of 2004	1880	file.exe	108
PID 1880 wrote to memory of 1160	1880	file.exe	110
PID 1880 wrote to memory of 1160	1880	file.exe	110
PID 1880 wrote to memory of 1160	1880	file.exe	110

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\epduecpu\
  2⤵
  PID:1684
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\rurkbdxn.exe" C:\Windows\SysWOW64\epduecpu\
  2⤵
  PID:3360
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create epduecpu binPath= "C:\Windows\SysWOW64\epduecpu\rurkbdxn.exe /d\"C:\Users\Admin\AppData\Local\Temp\file.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:4500
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description epduecpu "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:860
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start epduecpu
  2⤵
  - Launches sc.exe
  PID:2004
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:1160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 648
  2⤵
  - Program crash
  PID:3656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1880 -ip 1880
1⤵
PID:1156

C:\Windows\SysWOW64\epduecpu\rurkbdxn.exe
C:\Windows\SysWOW64\epduecpu\rurkbdxn.exe /d"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Executes dropped EXE
PID:256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rurkbdxn.exe

Filesize
10.2MB

MD5
d624de2f76fb52daa110fe24b3d66374

SHA1
edd67fe570b11e588b246e368a006de6b804e78a

SHA256
425c0f83a1a9133af50add0b55c5761f1e6580e74f91224b11f94c28daaa0164

SHA512
1c7d8c1a6e0ac9782380937944fb0210e1dc52d4daa3e699403b583541d2e709776f2305280960bedf5a28b3f5403cd9114f915877062ca5469b3bb6cf5d4395

Download Submit
C:\Windows\SysWOW64\epduecpu\rurkbdxn.exe

Filesize
10.2MB

MD5
d624de2f76fb52daa110fe24b3d66374

SHA1
edd67fe570b11e588b246e368a006de6b804e78a

SHA256
425c0f83a1a9133af50add0b55c5761f1e6580e74f91224b11f94c28daaa0164

SHA512
1c7d8c1a6e0ac9782380937944fb0210e1dc52d4daa3e699403b583541d2e709776f2305280960bedf5a28b3f5403cd9114f915877062ca5469b3bb6cf5d4395

Download Submit
memory/1880-1-0x0000000000700000-0x0000000000800000-memory.dmp

Filesize
1024KB

Download
memory/1880-2-0x0000000000680000-0x0000000000693000-memory.dmp

Filesize
76KB

Download
memory/1880-3-0x0000000000400000-0x00000000005A8000-memory.dmp

Filesize
1.7MB

Download
memory/1880-8-0x0000000000400000-0x00000000005A8000-memory.dmp

Filesize
1.7MB

Download
memory/1880-9-0x0000000000680000-0x0000000000693000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads