tofsee | dc1bc9d08ef773a4d935b0051c240ef1b9f2ce8dcc000063ffdcab1ef6bd1d50

Analysis

max time kernel
142s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 23:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

293KB
MD5

b4da9897cf577c55aa364a57ce6d6ab6
SHA1

8d2c6b7c0496be939c94db11c1deed3761aa36b1
SHA256

dc1bc9d08ef773a4d935b0051c240ef1b9f2ce8dcc000063ffdcab1ef6bd1d50
SHA512

57e0754e00f7e70a21bf6c2a062fe7b76c422b530b62236455689540f2c1ffb22caac3e936cb4f6616db7558a9b2a81a70103d11449c7ac5bb70c9cb38887d02
SSDEEP

3072:mlNvrtDJVoihS660sTdgmfJFXNQ25xSA2SXux02PiaJxas/aT:E5oihS660shgmfLN/50yXuL/a

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

vanaheim.cn

jotunheim.name

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
2640	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
2564	pnxyawzf.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2784	sc.exe
2200	sc.exe
2960	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 2312	1256	file.exe	28
PID 1256 wrote to memory of 2312	1256	file.exe	28
PID 1256 wrote to memory of 2312	1256	file.exe	28
PID 1256 wrote to memory of 2312	1256	file.exe	28
PID 1256 wrote to memory of 2788	1256	file.exe	30
PID 1256 wrote to memory of 2788	1256	file.exe	30
PID 1256 wrote to memory of 2788	1256	file.exe	30
PID 1256 wrote to memory of 2788	1256	file.exe	30
PID 1256 wrote to memory of 2200	1256	file.exe	32
PID 1256 wrote to memory of 2200	1256	file.exe	32
PID 1256 wrote to memory of 2200	1256	file.exe	32
PID 1256 wrote to memory of 2200	1256	file.exe	32
PID 1256 wrote to memory of 2960	1256	file.exe	34
PID 1256 wrote to memory of 2960	1256	file.exe	34
PID 1256 wrote to memory of 2960	1256	file.exe	34
PID 1256 wrote to memory of 2960	1256	file.exe	34
PID 1256 wrote to memory of 2784	1256	file.exe	36
PID 1256 wrote to memory of 2784	1256	file.exe	36
PID 1256 wrote to memory of 2784	1256	file.exe	36
PID 1256 wrote to memory of 2784	1256	file.exe	36
PID 1256 wrote to memory of 2640	1256	file.exe	38
PID 1256 wrote to memory of 2640	1256	file.exe	38
PID 1256 wrote to memory of 2640	1256	file.exe	38
PID 1256 wrote to memory of 2640	1256	file.exe	38
PID 2564 wrote to memory of 2552	2564	pnxyawzf.exe	41
PID 2564 wrote to memory of 2552	2564	pnxyawzf.exe	41
PID 2564 wrote to memory of 2552	2564	pnxyawzf.exe	41
PID 2564 wrote to memory of 2552	2564	pnxyawzf.exe	41
PID 2564 wrote to memory of 2552	2564	pnxyawzf.exe	41

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\jwwlxfqx\
  2⤵
  PID:2312
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\pnxyawzf.exe" C:\Windows\SysWOW64\jwwlxfqx\
  2⤵
  PID:2788
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create jwwlxfqx binPath= "C:\Windows\SysWOW64\jwwlxfqx\pnxyawzf.exe /d\"C:\Users\Admin\AppData\Local\Temp\file.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:2200
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description jwwlxfqx "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2960
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start jwwlxfqx
  2⤵
  - Launches sc.exe
  PID:2784
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:2640

C:\Windows\SysWOW64\jwwlxfqx\pnxyawzf.exe
C:\Windows\SysWOW64\jwwlxfqx\pnxyawzf.exe /d"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\pnxyawzf.exe

Filesize
13.0MB

MD5
dbf6d106f340daa6cd2d87793da45680

SHA1
5135a2234107a42406205fb0acb1d9ffb347b15d

SHA256
3fea56d4baac407b86e3d591e43195799a857a67ec63626fa8472b2b242b7b9b

SHA512
e9975252eb7e9edc30276ba0cf3f98262ccc7967d441045d254e0ab06f3c8cc069bcf06ddf9c500112d37122cd5e249ad8ed9423343584e4b4c24a4d98fcfe5f

Download Submit
C:\Windows\SysWOW64\jwwlxfqx\pnxyawzf.exe

Filesize
13.0MB

MD5
dbf6d106f340daa6cd2d87793da45680

SHA1
5135a2234107a42406205fb0acb1d9ffb347b15d

SHA256
3fea56d4baac407b86e3d591e43195799a857a67ec63626fa8472b2b242b7b9b

SHA512
e9975252eb7e9edc30276ba0cf3f98262ccc7967d441045d254e0ab06f3c8cc069bcf06ddf9c500112d37122cd5e249ad8ed9423343584e4b4c24a4d98fcfe5f

Download Submit
memory/1256-1-0x00000000026D0000-0x00000000027D0000-memory.dmp

Filesize
1024KB

Download
memory/1256-2-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download
memory/1256-4-0x0000000000400000-0x0000000002287000-memory.dmp

Filesize
30.5MB

Download
memory/1256-7-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download
memory/1256-6-0x0000000000400000-0x0000000002287000-memory.dmp

Filesize
30.5MB

Download
memory/2552-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2552-11-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2564-10-0x0000000002440000-0x0000000002540000-memory.dmp

Filesize
1024KB

Download
memory/2564-14-0x0000000000400000-0x0000000002287000-memory.dmp

Filesize
30.5MB

Download
memory/2564-15-0x0000000002440000-0x0000000002540000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads