tofsee | 653bb56b0d56694921a92ff391a5f43f60e95fe6e34286263023f3ebdd0764b9

General

Target

f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe
Size

291KB
MD5

66ebc32e8c190f890b24ccdac2e9a428
SHA1

5c3f23e69bfe7dc42c6a25bb670357a18c8455c7
SHA256

f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834
SHA512

7c7ef99016cd154d649f6fd0de6457d43a3e2e6e52735306c9be7ddaa9eb9f7d0110cfbf839eaf4b56c7c57db92ebe1653abae569a9b3d6f38c83fc2b5b13142
SSDEEP

3072:GDq1IwpTDlRRfAIiLGFJuQIjn5KK8PNUX558:wpwT3RfEJ3sZKA

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

vanaheim.cn

jotunheim.name

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

2748 netsh.exe

pid	process
2748	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation	f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe

Executes dropped EXE 1 IoCs

Processes:

ovcfuibl.exe

pid process

3232 ovcfuibl.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

5016 sc.exe
876 sc.exe
2868 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4140 1824 WerFault.exe f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe

pid	process
3232	ovcfuibl.exe

pid	process
5016	sc.exe
876	sc.exe
2868	sc.exe

pid	pid_target	process	target process
4140	1824	WerFault.exe	f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe

description	pid	process	target process
PID 1824 wrote to memory of 5768	1824	f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe	cmd.exe
PID 1824 wrote to memory of 5768	1824	f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe	cmd.exe
PID 1824 wrote to memory of 5768	1824	f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe	cmd.exe
PID 1824 wrote to memory of 3384	1824	f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe	cmd.exe
PID 1824 wrote to memory of 3384	1824	f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe	cmd.exe
PID 1824 wrote to memory of 3384	1824	f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe	cmd.exe
PID 1824 wrote to memory of 2868	1824	f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe	sc.exe
PID 1824 wrote to memory of 2868	1824	f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe	sc.exe
PID 1824 wrote to memory of 2868	1824	f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe	sc.exe
PID 1824 wrote to memory of 5016	1824	f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe	sc.exe
PID 1824 wrote to memory of 5016	1824	f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe	sc.exe
PID 1824 wrote to memory of 5016	1824	f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe	sc.exe
PID 1824 wrote to memory of 876	1824	f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe	sc.exe
PID 1824 wrote to memory of 876	1824	f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe	sc.exe
PID 1824 wrote to memory of 876	1824	f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe	sc.exe
PID 1824 wrote to memory of 2748	1824	f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe	netsh.exe
PID 1824 wrote to memory of 2748	1824	f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe	netsh.exe
PID 1824 wrote to memory of 2748	1824	f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe
"C:\Users\Admin\AppData\Local\Temp\f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1824

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\sfviqwbj\
2⤵
PID:5768

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ovcfuibl.exe" C:\Windows\SysWOW64\sfviqwbj\
2⤵
PID:3384

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create sfviqwbj binPath= "C:\Windows\SysWOW64\sfviqwbj\ovcfuibl.exe /d\"C:\Users\Admin\AppData\Local\Temp\f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:2868

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description sfviqwbj "wifi internet conection"
2⤵
- Launches sc.exe
PID:5016

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start sfviqwbj
2⤵
- Launches sc.exe
PID:876

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:2748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 1284
2⤵
- Program crash
PID:4140

C:\Windows\SysWOW64\sfviqwbj\ovcfuibl.exe
C:\Windows\SysWOW64\sfviqwbj\ovcfuibl.exe /d"C:\Users\Admin\AppData\Local\Temp\f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe"
1⤵
- Executes dropped EXE
PID:3232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1824 -ip 1824
1⤵
PID:5468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ovcfuibl.exe
Filesize
12.3MB

MD5
47233bbb9b763cb03d6c45d7c4a6b4ad

SHA1
50b9a3d0d63b856a8d90388b2a9229c68b4a697c

SHA256
c35cbd078f9f0dd931db314cf1f7d68c9ec506af08f4782c409a0baedc36f1c7

SHA512
8ce4927d772c566dc028ae907d0e6dd554045b45e331e0efe027ba720130e31e7d2966359a8ace5d7b6c3d87764d5088364299a566ad29b6be83004c9e31dc7c

Download Submit
memory/1824-1-0x0000000002D90000-0x0000000002E90000-memory.dmp

Filesize
1024KB

Download
memory/1824-2-0x0000000002D60000-0x0000000002D73000-memory.dmp

Filesize
76KB

Download
memory/1824-4-0x0000000000400000-0x0000000002ABF000-memory.dmp

Filesize
38.7MB

Download
memory/1824-7-0x0000000000400000-0x0000000002ABF000-memory.dmp

Filesize
38.7MB

Download
memory/1824-8-0x0000000002D60000-0x0000000002D73000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing