tofsee | 00deb73a1738a3b3bfd9504b70775d668581f504481c7f37c20831504f9b77aa

Analysis

max time kernel
236s
max time network
325s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 02:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

сентябрь 2023(570)/0322477813c2550386f1bfa31c31fd9f70b4581df866d0a9b068170b2f6d3373.exe
Size

300KB
MD5

932fedbdcfb766561e80aa60cbf49f50
SHA1

880e555a43c9a937755ad8eb9a0320c74fb53abd
SHA256

0322477813c2550386f1bfa31c31fd9f70b4581df866d0a9b068170b2f6d3373
SHA512

a1c0b3428ece76c8330e74aefa1dc4e5a8c5d307bec3f3415a7fe98f4fed86ce2e443ebe5383a6ad63279b5381cca0973e0beed023b0f90ca156afd2917040d4
SSDEEP

3072:+vbSno5heDId0acndOvVmWlQVheIdSEB6sL2iHQeT6IdjAUu6KC3:eIMesd0aAdOtThIM0Lj+IZAS

Score

10^/10

tofsee trojan

Malware Config

Extracted

Family

tofsee

vanaheim.cn

jotunheim.name

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0322477813c2550386f1bfa31c31fd9f70b4581df866d0a9b068170b2f6d3373.exe

description	pid	process	target process
PID 2288 wrote to memory of 872	2288	0322477813c2550386f1bfa31c31fd9f70b4581df866d0a9b068170b2f6d3373.exe	cmd.exe
PID 2288 wrote to memory of 872	2288	0322477813c2550386f1bfa31c31fd9f70b4581df866d0a9b068170b2f6d3373.exe	cmd.exe
PID 2288 wrote to memory of 872	2288	0322477813c2550386f1bfa31c31fd9f70b4581df866d0a9b068170b2f6d3373.exe	cmd.exe
PID 2288 wrote to memory of 872	2288	0322477813c2550386f1bfa31c31fd9f70b4581df866d0a9b068170b2f6d3373.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\сентябрь 2023(570)\0322477813c2550386f1bfa31c31fd9f70b4581df866d0a9b068170b2f6d3373.exe
"C:\Users\Admin\AppData\Local\Temp\сентябрь 2023(570)\0322477813c2550386f1bfa31c31fd9f70b4581df866d0a9b068170b2f6d3373.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2288

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\0610.bat" "
2⤵
PID:872

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0610.bat
Filesize
338B

MD5
65d495ed023b5fce51ad78f717e32f85

SHA1
f1b05e760aeeb54f1c110fa0070f1e6c39e28190

SHA256
15bc28545dc668b0562b65f305a453c8f5f3dee00fec20825164589621485fb1

SHA512
64ddf8c7ef47a456a6e9a0597921b0de5ecb51f23602488b9d5f7226da320f800670c1f1e80e76115f46a460058387a77a5f615ac9d3f1f417202103f586f929

Download Submit
memory/2288-1-0x0000000002380000-0x0000000002480000-memory.dmp

Filesize
1024KB

Download
memory/2288-2-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download
memory/2288-10-0x0000000000400000-0x0000000002291000-memory.dmp

Filesize
30.6MB

Download
memory/2288-13-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download