tofsee | 00deb73a1738a3b3bfd9504b70775d668581f504481c7f37c20831504f9b77aa

Analysis

max time kernel
240s
max time network
295s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 02:04

Target

сентябрь 2023(570)/018f7e7da2bf6e6cfd768c6ec8c568e0866654bd03eeb1e672d115811741e6ba.exe
Size

246KB
MD5

cdc39c2b9ad647c285c16e734f8a42ab
SHA1

18ea017d22592adce69d7bd9dabca3f3336d3602
SHA256

018f7e7da2bf6e6cfd768c6ec8c568e0866654bd03eeb1e672d115811741e6ba
SHA512

37003ddc3f7ebf119b496b68e526351e62521e08aa916530147ae9f940690b4f89037e45e08bda0e6cbbb98de7b31479be2ccfb45e8c91f78430a80306e8c078
SSDEEP

6144:iF5QP2lHLJIGWj4RjZotIWspGzgu4edgthBuVTtL:iLiUHZWj4R5WsAxsBuBp

Score

10^/10

tofsee trojan

Family

tofsee

vanaheim.cn

jotunheim.name

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

018f7e7da2bf6e6cfd768c6ec8c568e0866654bd03eeb1e672d115811741e6ba.exe

description	pid	process	target process
PID 1788 wrote to memory of 2160	1788	018f7e7da2bf6e6cfd768c6ec8c568e0866654bd03eeb1e672d115811741e6ba.exe	cmd.exe
PID 1788 wrote to memory of 2160	1788	018f7e7da2bf6e6cfd768c6ec8c568e0866654bd03eeb1e672d115811741e6ba.exe	cmd.exe
PID 1788 wrote to memory of 2160	1788	018f7e7da2bf6e6cfd768c6ec8c568e0866654bd03eeb1e672d115811741e6ba.exe	cmd.exe
PID 1788 wrote to memory of 2160	1788	018f7e7da2bf6e6cfd768c6ec8c568e0866654bd03eeb1e672d115811741e6ba.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\сентябрь 2023(570)\018f7e7da2bf6e6cfd768c6ec8c568e0866654bd03eeb1e672d115811741e6ba.exe
"C:\Users\Admin\AppData\Local\Temp\сентябрь 2023(570)\018f7e7da2bf6e6cfd768c6ec8c568e0866654bd03eeb1e672d115811741e6ba.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\5131.bat" "
  2⤵
  PID:2160

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\5131.bat

Filesize
338B

MD5
2a6139b7143b634b7f9d941c6bdf2f83

SHA1
30122bd8a3244fbdfa4986be0c31d834c43e3d2e

SHA256
91544ab70ae8f3899508ab31af23a119b4da22f6a36ffd5d68de4c9b1067bb03

SHA512
a69cfcae088dd3b62b2667cecf19c82ff55092d67e9b80a12638cae0cb7bc201dfdd327344777a542ba341347d56755398218ab35fa70131052f48065e4d65b1

Download Submit
memory/1788-0-0x00000000001B0000-0x00000000001C5000-memory.dmp

Filesize
84KB

Download
memory/1788-1-0x0000000000260000-0x0000000000273000-memory.dmp

Filesize
76KB

Download
memory/1788-2-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1788-11-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1788-13-0x00000000001B0000-0x00000000001C5000-memory.dmp

Filesize
84KB

Download
memory/1788-12-0x0000000000260000-0x0000000000273000-memory.dmp

Filesize
76KB

Download