tofsee | 00deb73a1738a3b3bfd9504b70775d668581f504481c7f37c20831504f9b77aa

Analysis

max time kernel
236s
max time network
325s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 02:04

Target

сентябрь 2023(570)/0322477813c2550386f1bfa31c31fd9f70b4581df866d0a9b068170b2f6d3373.exe
Size

300KB
MD5

932fedbdcfb766561e80aa60cbf49f50
SHA1

880e555a43c9a937755ad8eb9a0320c74fb53abd
SHA256

0322477813c2550386f1bfa31c31fd9f70b4581df866d0a9b068170b2f6d3373
SHA512

a1c0b3428ece76c8330e74aefa1dc4e5a8c5d307bec3f3415a7fe98f4fed86ce2e443ebe5383a6ad63279b5381cca0973e0beed023b0f90ca156afd2917040d4
SSDEEP

3072:+vbSno5heDId0acndOvVmWlQVheIdSEB6sL2iHQeT6IdjAUu6KC3:eIMesd0aAdOtThIM0Lj+IZAS

Score

10^/10

tofsee trojan

Family

tofsee

vanaheim.cn

jotunheim.name

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0322477813c2550386f1bfa31c31fd9f70b4581df866d0a9b068170b2f6d3373.exe

description	pid	process	target process
PID 2288 wrote to memory of 872	2288	0322477813c2550386f1bfa31c31fd9f70b4581df866d0a9b068170b2f6d3373.exe	cmd.exe
PID 2288 wrote to memory of 872	2288	0322477813c2550386f1bfa31c31fd9f70b4581df866d0a9b068170b2f6d3373.exe	cmd.exe
PID 2288 wrote to memory of 872	2288	0322477813c2550386f1bfa31c31fd9f70b4581df866d0a9b068170b2f6d3373.exe	cmd.exe
PID 2288 wrote to memory of 872	2288	0322477813c2550386f1bfa31c31fd9f70b4581df866d0a9b068170b2f6d3373.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\сентябрь 2023(570)\0322477813c2550386f1bfa31c31fd9f70b4581df866d0a9b068170b2f6d3373.exe
"C:\Users\Admin\AppData\Local\Temp\сентябрь 2023(570)\0322477813c2550386f1bfa31c31fd9f70b4581df866d0a9b068170b2f6d3373.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\0610.bat" "
  2⤵
  PID:872

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\0610.bat

Filesize
338B

MD5
65d495ed023b5fce51ad78f717e32f85

SHA1
f1b05e760aeeb54f1c110fa0070f1e6c39e28190

SHA256
15bc28545dc668b0562b65f305a453c8f5f3dee00fec20825164589621485fb1

SHA512
64ddf8c7ef47a456a6e9a0597921b0de5ecb51f23602488b9d5f7226da320f800670c1f1e80e76115f46a460058387a77a5f615ac9d3f1f417202103f586f929

Download Submit
memory/2288-1-0x0000000002380000-0x0000000002480000-memory.dmp

Filesize
1024KB

Download
memory/2288-2-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download
memory/2288-10-0x0000000000400000-0x0000000002291000-memory.dmp

Filesize
30.6MB

Download
memory/2288-13-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download