tofsee | fb27e9ed9c3404d7e40c916b8ca7de5f628093e85d4ca60d19538bad9ecce4c4

General

Target

03a89ba2c406fa77df7d69b272c61e64.exe
Size

11.9MB
MD5

03a89ba2c406fa77df7d69b272c61e64
SHA1

059f965ad5651c5ffacd8ec1628cfe2938679bcf
SHA256

fb27e9ed9c3404d7e40c916b8ca7de5f628093e85d4ca60d19538bad9ecce4c4
SHA512

cdc568cfce3194970b6efb8426a87ebc60a7ba92fd6f5b8e2198ee38bc37a768f101023bf3a81389c52ad3dbe72791446896fc00edabefd2f7d715b840a15a87
SSDEEP

24576:dgdy5yNM44444444444444444444444444444444444444444444444444444440:

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
1116	netsh.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2552	sc.exe
2588	sc.exe
2700	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2184	3040	03a89ba2c406fa77df7d69b272c61e64.exe	29
PID 3040 wrote to memory of 2184	3040	03a89ba2c406fa77df7d69b272c61e64.exe	29
PID 3040 wrote to memory of 2184	3040	03a89ba2c406fa77df7d69b272c61e64.exe	29
PID 3040 wrote to memory of 2184	3040	03a89ba2c406fa77df7d69b272c61e64.exe	29
PID 3040 wrote to memory of 3008	3040	03a89ba2c406fa77df7d69b272c61e64.exe	31
PID 3040 wrote to memory of 3008	3040	03a89ba2c406fa77df7d69b272c61e64.exe	31
PID 3040 wrote to memory of 3008	3040	03a89ba2c406fa77df7d69b272c61e64.exe	31
PID 3040 wrote to memory of 3008	3040	03a89ba2c406fa77df7d69b272c61e64.exe	31
PID 3040 wrote to memory of 2552	3040	03a89ba2c406fa77df7d69b272c61e64.exe	32
PID 3040 wrote to memory of 2552	3040	03a89ba2c406fa77df7d69b272c61e64.exe	32
PID 3040 wrote to memory of 2552	3040	03a89ba2c406fa77df7d69b272c61e64.exe	32
PID 3040 wrote to memory of 2552	3040	03a89ba2c406fa77df7d69b272c61e64.exe	32

C:\Users\Admin\AppData\Local\Temp\03a89ba2c406fa77df7d69b272c61e64.exe
"C:\Users\Admin\AppData\Local\Temp\03a89ba2c406fa77df7d69b272c61e64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\qrjzfkwe\
  2⤵
  PID:2184
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\cgnrtwmy.exe" C:\Windows\SysWOW64\qrjzfkwe\
  2⤵
  PID:3008
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create qrjzfkwe binPath= "C:\Windows\SysWOW64\qrjzfkwe\cgnrtwmy.exe /d\"C:\Users\Admin\AppData\Local\Temp\03a89ba2c406fa77df7d69b272c61e64.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:2552
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description qrjzfkwe "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2588
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start qrjzfkwe
  2⤵
  - Launches sc.exe
  PID:2700
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:1116

C:\Windows\SysWOW64\qrjzfkwe\cgnrtwmy.exe
C:\Windows\SysWOW64\qrjzfkwe\cgnrtwmy.exe /d"C:\Users\Admin\AppData\Local\Temp\03a89ba2c406fa77df7d69b272c61e64.exe"
1⤵
PID:2608
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cgnrtwmy.exe

Filesize
73KB

MD5
aa2b3ffa2e5e954160fe6206c51fbe6c

SHA1
b25152f13cffdf862d63654341cc046457fad565

SHA256
f1dae621ae8b64bdefb038a094d85779b7f0271304aee790941012b5b51e98bd

SHA512
510118e4296c46000ce5fa960c25a82e4d3d148bb691e66e2bdbf983b3eb9845dcec255cec50f705872acd6adc02a2cb8e7692372d93d11d9f34636b1ce96723

Download Submit
C:\Windows\SysWOW64\qrjzfkwe\cgnrtwmy.exe

Filesize
49KB

MD5
382c7ac780f70172c9f2458a3839ed85

SHA1
81c5816375de629a7e11368fa3aaa62b9b8137cb

SHA256
224b53f774f3fd26989e7a7c7e38e24145b943687cf299568d55e2389ee0d661

SHA512
dd3897be50bab69d84d8fd36cecd1365ad137f99c79ac5a06b73955e2961d398101dfc68018611cd53698ce6ed47507715101ce21cc3538f9a7deef08a3ddb6e

Download Submit
memory/2484-19-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2484-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2484-21-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2484-9-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2484-14-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2484-20-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2484-18-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2608-15-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2608-12-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2608-10-0x00000000008A0000-0x00000000009A0000-memory.dmp

Filesize
1024KB

Download
memory/3040-4-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/3040-1-0x0000000000570000-0x0000000000670000-memory.dmp

Filesize
1024KB

Download
memory/3040-8-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/3040-3-0x0000000000240000-0x0000000000253000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads