tofsee | 00deb73a1738a3b3bfd9504b70775d668581f504481c7f37c20831504f9b77aa

Analysis

max time kernel
146s
max time network
395s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 02:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

сентябрь 2023(570)/018f7e7da2bf6e6cfd768c6ec8c568e0866654bd03eeb1e672d115811741e6ba.exe
Size

246KB
MD5

cdc39c2b9ad647c285c16e734f8a42ab
SHA1

18ea017d22592adce69d7bd9dabca3f3336d3602
SHA256

018f7e7da2bf6e6cfd768c6ec8c568e0866654bd03eeb1e672d115811741e6ba
SHA512

37003ddc3f7ebf119b496b68e526351e62521e08aa916530147ae9f940690b4f89037e45e08bda0e6cbbb98de7b31479be2ccfb45e8c91f78430a80306e8c078
SSDEEP

6144:iF5QP2lHLJIGWj4RjZotIWspGzgu4edgthBuVTtL:iLiUHZWj4R5WsAxsBuBp

Score

10^/10

tofsee trojan

Malware Config

Extracted

Family

tofsee

vanaheim.cn

jotunheim.name

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

018f7e7da2bf6e6cfd768c6ec8c568e0866654bd03eeb1e672d115811741e6ba.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	018f7e7da2bf6e6cfd768c6ec8c568e0866654bd03eeb1e672d115811741e6ba.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3184 764 WerFault.exe 018f7e7da2bf6e6cfd768c6ec8c568e0866654bd03eeb1e672d115811741e6ba.exe

pid	pid_target	process	target process
3184	764	WerFault.exe	018f7e7da2bf6e6cfd768c6ec8c568e0866654bd03eeb1e672d115811741e6ba.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

018f7e7da2bf6e6cfd768c6ec8c568e0866654bd03eeb1e672d115811741e6ba.exe

description	pid	process	target process
PID 764 wrote to memory of 820	764	018f7e7da2bf6e6cfd768c6ec8c568e0866654bd03eeb1e672d115811741e6ba.exe	cmd.exe
PID 764 wrote to memory of 820	764	018f7e7da2bf6e6cfd768c6ec8c568e0866654bd03eeb1e672d115811741e6ba.exe	cmd.exe
PID 764 wrote to memory of 820	764	018f7e7da2bf6e6cfd768c6ec8c568e0866654bd03eeb1e672d115811741e6ba.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\сентябрь 2023(570)\018f7e7da2bf6e6cfd768c6ec8c568e0866654bd03eeb1e672d115811741e6ba.exe
"C:\Users\Admin\AppData\Local\Temp\сентябрь 2023(570)\018f7e7da2bf6e6cfd768c6ec8c568e0866654bd03eeb1e672d115811741e6ba.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:764

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8516.bat" "
2⤵
PID:820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 1116
2⤵
- Program crash
PID:3184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 764 -ip 764
1⤵
PID:220

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8516.bat
Filesize
338B

MD5
2a6139b7143b634b7f9d941c6bdf2f83

SHA1
30122bd8a3244fbdfa4986be0c31d834c43e3d2e

SHA256
91544ab70ae8f3899508ab31af23a119b4da22f6a36ffd5d68de4c9b1067bb03

SHA512
a69cfcae088dd3b62b2667cecf19c82ff55092d67e9b80a12638cae0cb7bc201dfdd327344777a542ba341347d56755398218ab35fa70131052f48065e4d65b1

Download Submit
memory/764-0-0x00000000006F0000-0x0000000000705000-memory.dmp

Filesize
84KB

Download
memory/764-1-0x00000000001C0000-0x00000000001D3000-memory.dmp

Filesize
76KB

Download
memory/764-3-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/764-8-0x00000000001C0000-0x00000000001D3000-memory.dmp

Filesize
76KB

Download
memory/764-7-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download