tofsee | 592d40863ff1e617388d42e0886b1a3280602fc6e25217d74436d232a32041c1

General

Target

file.exe
Size

217KB
MD5

d463534b0954694b60167a0cb04efaeb
SHA1

a87d785486046ae80d796207f917e8f56d13a4b5
SHA256

592d40863ff1e617388d42e0886b1a3280602fc6e25217d74436d232a32041c1
SHA512

564b84a451b449c6499cbe8de41dacaf3f5bf9e949d4fde52d1b12d03f19b74bda0bf33502a6a8e6e2451c4fbdd97e7bc52d5b0f096e002310e8b6785944f755
SSDEEP

3072:oHXkUCqSTZLMGAfp3C1rlodZNE6nZ1Vb96fQd0Dha5mT9:qkUCDLyfJoGdZ26Z1V5JKhNT

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

vanaheim.cn

jotunheim.name

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
4904	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation	file.exe

Executes dropped EXE 1 IoCs

pid	Process
4900	iccuxhlx.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4028	sc.exe
4172	sc.exe
2040	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1548	552	WerFault.exe	81

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 1860	552	file.exe	100
PID 552 wrote to memory of 1860	552	file.exe	100
PID 552 wrote to memory of 1860	552	file.exe	100
PID 552 wrote to memory of 4156	552	file.exe	102
PID 552 wrote to memory of 4156	552	file.exe	102
PID 552 wrote to memory of 4156	552	file.exe	102
PID 552 wrote to memory of 4028	552	file.exe	104
PID 552 wrote to memory of 4028	552	file.exe	104
PID 552 wrote to memory of 4028	552	file.exe	104
PID 552 wrote to memory of 4172	552	file.exe	106
PID 552 wrote to memory of 4172	552	file.exe	106
PID 552 wrote to memory of 4172	552	file.exe	106
PID 552 wrote to memory of 2040	552	file.exe	108
PID 552 wrote to memory of 2040	552	file.exe	108
PID 552 wrote to memory of 2040	552	file.exe	108
PID 552 wrote to memory of 4904	552	file.exe	110
PID 552 wrote to memory of 4904	552	file.exe	110
PID 552 wrote to memory of 4904	552	file.exe	110

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:552
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\denrmgsq\
  2⤵
  PID:1860
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\iccuxhlx.exe" C:\Windows\SysWOW64\denrmgsq\
  2⤵
  PID:4156
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create denrmgsq binPath= "C:\Windows\SysWOW64\denrmgsq\iccuxhlx.exe /d\"C:\Users\Admin\AppData\Local\Temp\file.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:4028
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description denrmgsq "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:4172
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start denrmgsq
  2⤵
  - Launches sc.exe
  PID:2040
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:4904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 1040
  2⤵
  - Program crash
  PID:1548

C:\Windows\SysWOW64\denrmgsq\iccuxhlx.exe
C:\Windows\SysWOW64\denrmgsq\iccuxhlx.exe /d"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Executes dropped EXE
PID:4900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 552 -ip 552
1⤵
PID:4988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\iccuxhlx.exe

Filesize
10.9MB

MD5
1cc44b3237fdff05c6cbd93ac581df08

SHA1
a0195a804ca8044f93019d0e645c947f755dfa88

SHA256
daee0f4fea9de03c930a2b1b4ea1d22dbf6505ac527ce11ae4d6f1d66bf55586

SHA512
69e456ac0765c3fd08a52ea4d54158318e39381aa447542602bd89aef4aa7147ec3d8eeb0370aac95d2505a8f8a925a1a21aaa1d40d20527490f31eecfb6726d

Download Submit
C:\Windows\SysWOW64\denrmgsq\iccuxhlx.exe

Filesize
10.9MB

MD5
1cc44b3237fdff05c6cbd93ac581df08

SHA1
a0195a804ca8044f93019d0e645c947f755dfa88

SHA256
daee0f4fea9de03c930a2b1b4ea1d22dbf6505ac527ce11ae4d6f1d66bf55586

SHA512
69e456ac0765c3fd08a52ea4d54158318e39381aa447542602bd89aef4aa7147ec3d8eeb0370aac95d2505a8f8a925a1a21aaa1d40d20527490f31eecfb6726d

Download Submit
memory/552-1-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/552-2-0x00000000001C0000-0x00000000001D3000-memory.dmp

Filesize
76KB

Download
memory/552-3-0x0000000000400000-0x00000000005AE000-memory.dmp

Filesize
1.7MB

Download
memory/552-8-0x0000000000400000-0x00000000005AE000-memory.dmp

Filesize
1.7MB

Download
memory/552-9-0x00000000001C0000-0x00000000001D3000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads