tofsee | 67a4c57e1141be6c84787dad422d19dd0193b0ecf5d7771c496b128226420ee7

General

Target

67a4c57e1141be6c84787dad422d19dd0193b0ecf5d7771c496b128226420ee7_JC.exe
Size

242KB
MD5

d7397119dbb60e42850f5db8c0d3cc16
SHA1

e9aade2f2c626f3d3b2252c3de72c63ef53b2c2f
SHA256

67a4c57e1141be6c84787dad422d19dd0193b0ecf5d7771c496b128226420ee7
SHA512

5e90b23cc1dd4c1388a3985e97cfe73c2d2e4f143f3a244e3c447b08b10a1ac1f29c37c6283d8aa1e42bbb026baa93f24e6f87a943818d9feb4c311c20ff095e
SSDEEP

3072:fWC+t9BtK2qqscMrhAtzkPK8BZ3R0m/2PmOo9dBn5cp281TWO:fJMTK+szrhAxB+ZOme6Qp91Tj

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

vanaheim.cn

jotunheim.name

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
3352	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation	67a4c57e1141be6c84787dad422d19dd0193b0ecf5d7771c496b128226420ee7_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
2764	qzfqodv.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2448	sc.exe
1748	sc.exe
4996	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2456	4908	WerFault.exe	81

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 2152	4908	67a4c57e1141be6c84787dad422d19dd0193b0ecf5d7771c496b128226420ee7_JC.exe	100
PID 4908 wrote to memory of 2152	4908	67a4c57e1141be6c84787dad422d19dd0193b0ecf5d7771c496b128226420ee7_JC.exe	100
PID 4908 wrote to memory of 2152	4908	67a4c57e1141be6c84787dad422d19dd0193b0ecf5d7771c496b128226420ee7_JC.exe	100
PID 4908 wrote to memory of 1784	4908	67a4c57e1141be6c84787dad422d19dd0193b0ecf5d7771c496b128226420ee7_JC.exe	103
PID 4908 wrote to memory of 1784	4908	67a4c57e1141be6c84787dad422d19dd0193b0ecf5d7771c496b128226420ee7_JC.exe	103
PID 4908 wrote to memory of 1784	4908	67a4c57e1141be6c84787dad422d19dd0193b0ecf5d7771c496b128226420ee7_JC.exe	103
PID 4908 wrote to memory of 4996	4908	67a4c57e1141be6c84787dad422d19dd0193b0ecf5d7771c496b128226420ee7_JC.exe	105
PID 4908 wrote to memory of 4996	4908	67a4c57e1141be6c84787dad422d19dd0193b0ecf5d7771c496b128226420ee7_JC.exe	105
PID 4908 wrote to memory of 4996	4908	67a4c57e1141be6c84787dad422d19dd0193b0ecf5d7771c496b128226420ee7_JC.exe	105
PID 4908 wrote to memory of 2448	4908	67a4c57e1141be6c84787dad422d19dd0193b0ecf5d7771c496b128226420ee7_JC.exe	107
PID 4908 wrote to memory of 2448	4908	67a4c57e1141be6c84787dad422d19dd0193b0ecf5d7771c496b128226420ee7_JC.exe	107
PID 4908 wrote to memory of 2448	4908	67a4c57e1141be6c84787dad422d19dd0193b0ecf5d7771c496b128226420ee7_JC.exe	107
PID 4908 wrote to memory of 1748	4908	67a4c57e1141be6c84787dad422d19dd0193b0ecf5d7771c496b128226420ee7_JC.exe	109
PID 4908 wrote to memory of 1748	4908	67a4c57e1141be6c84787dad422d19dd0193b0ecf5d7771c496b128226420ee7_JC.exe	109
PID 4908 wrote to memory of 1748	4908	67a4c57e1141be6c84787dad422d19dd0193b0ecf5d7771c496b128226420ee7_JC.exe	109
PID 4908 wrote to memory of 3352	4908	67a4c57e1141be6c84787dad422d19dd0193b0ecf5d7771c496b128226420ee7_JC.exe	112
PID 4908 wrote to memory of 3352	4908	67a4c57e1141be6c84787dad422d19dd0193b0ecf5d7771c496b128226420ee7_JC.exe	112
PID 4908 wrote to memory of 3352	4908	67a4c57e1141be6c84787dad422d19dd0193b0ecf5d7771c496b128226420ee7_JC.exe	112

C:\Users\Admin\AppData\Local\Temp\67a4c57e1141be6c84787dad422d19dd0193b0ecf5d7771c496b128226420ee7_JC.exe
"C:\Users\Admin\AppData\Local\Temp\67a4c57e1141be6c84787dad422d19dd0193b0ecf5d7771c496b128226420ee7_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\jdtytfue\
  2⤵
  PID:2152
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\qzfqodv.exe" C:\Windows\SysWOW64\jdtytfue\
  2⤵
  PID:1784
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create jdtytfue binPath= "C:\Windows\SysWOW64\jdtytfue\qzfqodv.exe /d\"C:\Users\Admin\AppData\Local\Temp\67a4c57e1141be6c84787dad422d19dd0193b0ecf5d7771c496b128226420ee7_JC.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:4996
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description jdtytfue "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2448
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start jdtytfue
  2⤵
  - Launches sc.exe
  PID:1748
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:3352
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 1256
  2⤵
  - Program crash
  PID:2456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4908 -ip 4908
1⤵
PID:1596

C:\Windows\SysWOW64\jdtytfue\qzfqodv.exe
C:\Windows\SysWOW64\jdtytfue\qzfqodv.exe /d"C:\Users\Admin\AppData\Local\Temp\67a4c57e1141be6c84787dad422d19dd0193b0ecf5d7771c496b128226420ee7_JC.exe"
1⤵
- Executes dropped EXE
PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\qzfqodv.exe

Filesize
13.3MB

MD5
eec2c7afbee8098129deb515176ea84b

SHA1
09b14e3c5fbf3c6da1743d16811b870f275988aa

SHA256
48d16a2c180da6504f2c99b3961b4b32c920bd3a220d47d63fadc0d5b28e35bc

SHA512
03085e1e579b79b14c07c1e079fbc5f833baf4b9dcb246bfbd6e01246288bf901c882173a3dde112e8ec48e65052122883c5166f20630793e6b36c42a38fb078

Download Submit
C:\Windows\SysWOW64\jdtytfue\qzfqodv.exe

Filesize
13.3MB

MD5
eec2c7afbee8098129deb515176ea84b

SHA1
09b14e3c5fbf3c6da1743d16811b870f275988aa

SHA256
48d16a2c180da6504f2c99b3961b4b32c920bd3a220d47d63fadc0d5b28e35bc

SHA512
03085e1e579b79b14c07c1e079fbc5f833baf4b9dcb246bfbd6e01246288bf901c882173a3dde112e8ec48e65052122883c5166f20630793e6b36c42a38fb078

Download Submit
memory/4908-0-0x0000000002190000-0x00000000021A5000-memory.dmp

Filesize
84KB

Download
memory/4908-1-0x0000000000520000-0x0000000000533000-memory.dmp

Filesize
76KB

Download
memory/4908-2-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/4908-7-0x0000000000520000-0x0000000000533000-memory.dmp

Filesize
76KB

Download
memory/4908-6-0x0000000002190000-0x00000000021A5000-memory.dmp

Filesize
84KB

Download
memory/4908-5-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads