tofsee | 653bb56b0d56694921a92ff391a5f43f60e95fe6e34286263023f3ebdd0764b9

General

Target
f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe
Size 291KB
Sample240417-qs3ybabc2s
SHA256 f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834
MD5 66ebc32e8c190f890b24ccdac2e9a428
SHA1 5c3f23e69bfe7dc42c6a25bb670357a18c8455c7
SHA512 7c7ef99016cd154d649f6fd0de6457d43a3e2e6e52735306c9be7ddaa9eb9f7d0110cfbf839eaf4b56c7c57db92ebe1653abae569a9b3d6f38c83fc2b5b13142
SSDEEP 3072:GDq1IwpTDlRRfAIiLGFJuQIjn5KK8PNUX558:wpwT3RfEJ3sZKA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

vanaheim.cn
jotunheim.name

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2748	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation	f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe

Executes dropped EXE 1 IoCs

pid	Process
3232	ovcfuibl.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5016	sc.exe
876	sc.exe
2868	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4140	1824	WerFault.exe	85

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 5768	1824	f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe	95
PID 1824 wrote to memory of 5768	1824	f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe	95
PID 1824 wrote to memory of 5768	1824	f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe	95
PID 1824 wrote to memory of 3384	1824	f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe	97
PID 1824 wrote to memory of 3384	1824	f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe	97
PID 1824 wrote to memory of 3384	1824	f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe	97
PID 1824 wrote to memory of 2868	1824	f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe	99
PID 1824 wrote to memory of 2868	1824	f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe	99
PID 1824 wrote to memory of 2868	1824	f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe	99
PID 1824 wrote to memory of 5016	1824	f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe	101
PID 1824 wrote to memory of 5016	1824	f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe	101
PID 1824 wrote to memory of 5016	1824	f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe	101
PID 1824 wrote to memory of 876	1824	f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe	103
PID 1824 wrote to memory of 876	1824	f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe	103
PID 1824 wrote to memory of 876	1824	f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe	103
PID 1824 wrote to memory of 2748	1824	f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe	106
PID 1824 wrote to memory of 2748	1824	f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe	106
PID 1824 wrote to memory of 2748	1824	f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe	106

C:\Users\Admin\AppData\Local\Temp\f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe
"C:\Users\Admin\AppData\Local\Temp\f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\sfviqwbj\
  2⤵
  PID:5768
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ovcfuibl.exe" C:\Windows\SysWOW64\sfviqwbj\
  2⤵
  PID:3384
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create sfviqwbj binPath= "C:\Windows\SysWOW64\sfviqwbj\ovcfuibl.exe /d\"C:\Users\Admin\AppData\Local\Temp\f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:2868
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description sfviqwbj "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:5016
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start sfviqwbj
  2⤵
  - Launches sc.exe
  PID:876
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:2748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 1284
  2⤵
  - Program crash
  PID:4140

C:\Windows\SysWOW64\sfviqwbj\ovcfuibl.exe
C:\Windows\SysWOW64\sfviqwbj\ovcfuibl.exe /d"C:\Users\Admin\AppData\Local\Temp\f6c76564b0268b7c3b754b05e498fcbc7e11fc1907460d12b1d55dd0d0662834.exe"
1⤵
- Executes dropped EXE
PID:3232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1824 -ip 1824
1⤵
PID:5468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ovcfuibl.exe

Path C:\Users\Admin\AppData\Local\Temp\ovcfuibl.exe
Size 12.3MB
SHA256 c35cbd078f9f0dd931db314cf1f7d68c9ec506af08f4782c409a0baedc36f1c7
MD5 47233bbb9b763cb03d6c45d7c4a6b4ad
SHA1 50b9a3d0d63b856a8d90388b2a9229c68b4a697c
SHA512 8ce4927d772c566dc028ae907d0e6dd554045b45e331e0efe027ba720130e31e7d2966359a8ace5d7b6c3d87764d5088364299a566ad29b6be83004c9e31dc7c
SSDEEP 3072:uDq1IwpTDlRRfAIiLGFJuQIjn5KK8PNUX558:IpwT3RfEJ3sZKA
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1824-1-0x0000000002D90000-0x0000000002E90000-memory.dmp

Download

memory/1824-2-0x0000000002D60000-0x0000000002D73000-memory.dmp

Download

memory/1824-4-0x0000000000400000-0x0000000002ABF000-memory.dmp

Download

memory/1824-7-0x0000000000400000-0x0000000002ABF000-memory.dmp

Download

memory/1824-8-0x0000000002D60000-0x0000000002D73000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads