tofsee | 912d8df602e91edd42811bf1f20582e5ba112564708c7b0c6c287cc293bc1b24

General

Target

0becc5527aba7dc1a746846fc3a2b62f2e46568819b2259d4474eb16e96b9be4.exe
Size

258KB
MD5

c604511f8c117ca36984e8aa66ac0a71
SHA1

7ce156eb70e31fbdf62c3d7e60e6eefff7b21c7d
SHA256

0becc5527aba7dc1a746846fc3a2b62f2e46568819b2259d4474eb16e96b9be4
SHA512

031ffc652bd29c52b8ea733fa6a9e37c9908798d4121d0452c2e0207d17086f43451c273b686ef4c086fc859fe6cf906e403bd09008b11cfc2498ec338ae3441
SSDEEP

3072:xkh5eI/cSz90u2DEJClClQoyLwETsrw/eEOobr6e7AXa2jyQfEBw0coqY7IQPJUD:xkh+BEQ0SBTRVOobrPXYES0cWEQRER

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

vanaheim.cn

jotunheim.name

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

2512 netsh.exe
Executes dropped EXE 1 IoCs

Processes:

rlqojmjl.exe

pid process

2404 rlqojmjl.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

2536 sc.exe
2660 sc.exe
2576 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2512	netsh.exe

pid	process
2404	rlqojmjl.exe

pid	process
2536	sc.exe
2660	sc.exe
2576	sc.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

0becc5527aba7dc1a746846fc3a2b62f2e46568819b2259d4474eb16e96b9be4.exerlqojmjl.exe

description	pid	process	target process
PID 2172 wrote to memory of 2300	2172	0becc5527aba7dc1a746846fc3a2b62f2e46568819b2259d4474eb16e96b9be4.exe	cmd.exe
PID 2172 wrote to memory of 2300	2172	0becc5527aba7dc1a746846fc3a2b62f2e46568819b2259d4474eb16e96b9be4.exe	cmd.exe
PID 2172 wrote to memory of 2300	2172	0becc5527aba7dc1a746846fc3a2b62f2e46568819b2259d4474eb16e96b9be4.exe	cmd.exe
PID 2172 wrote to memory of 2300	2172	0becc5527aba7dc1a746846fc3a2b62f2e46568819b2259d4474eb16e96b9be4.exe	cmd.exe
PID 2172 wrote to memory of 2900	2172	0becc5527aba7dc1a746846fc3a2b62f2e46568819b2259d4474eb16e96b9be4.exe	cmd.exe
PID 2172 wrote to memory of 2900	2172	0becc5527aba7dc1a746846fc3a2b62f2e46568819b2259d4474eb16e96b9be4.exe	cmd.exe
PID 2172 wrote to memory of 2900	2172	0becc5527aba7dc1a746846fc3a2b62f2e46568819b2259d4474eb16e96b9be4.exe	cmd.exe
PID 2172 wrote to memory of 2900	2172	0becc5527aba7dc1a746846fc3a2b62f2e46568819b2259d4474eb16e96b9be4.exe	cmd.exe
PID 2172 wrote to memory of 2536	2172	0becc5527aba7dc1a746846fc3a2b62f2e46568819b2259d4474eb16e96b9be4.exe	sc.exe
PID 2172 wrote to memory of 2536	2172	0becc5527aba7dc1a746846fc3a2b62f2e46568819b2259d4474eb16e96b9be4.exe	sc.exe
PID 2172 wrote to memory of 2536	2172	0becc5527aba7dc1a746846fc3a2b62f2e46568819b2259d4474eb16e96b9be4.exe	sc.exe
PID 2172 wrote to memory of 2536	2172	0becc5527aba7dc1a746846fc3a2b62f2e46568819b2259d4474eb16e96b9be4.exe	sc.exe
PID 2172 wrote to memory of 2660	2172	0becc5527aba7dc1a746846fc3a2b62f2e46568819b2259d4474eb16e96b9be4.exe	sc.exe
PID 2172 wrote to memory of 2660	2172	0becc5527aba7dc1a746846fc3a2b62f2e46568819b2259d4474eb16e96b9be4.exe	sc.exe
PID 2172 wrote to memory of 2660	2172	0becc5527aba7dc1a746846fc3a2b62f2e46568819b2259d4474eb16e96b9be4.exe	sc.exe
PID 2172 wrote to memory of 2660	2172	0becc5527aba7dc1a746846fc3a2b62f2e46568819b2259d4474eb16e96b9be4.exe	sc.exe
PID 2172 wrote to memory of 2576	2172	0becc5527aba7dc1a746846fc3a2b62f2e46568819b2259d4474eb16e96b9be4.exe	sc.exe
PID 2172 wrote to memory of 2576	2172	0becc5527aba7dc1a746846fc3a2b62f2e46568819b2259d4474eb16e96b9be4.exe	sc.exe
PID 2172 wrote to memory of 2576	2172	0becc5527aba7dc1a746846fc3a2b62f2e46568819b2259d4474eb16e96b9be4.exe	sc.exe
PID 2172 wrote to memory of 2576	2172	0becc5527aba7dc1a746846fc3a2b62f2e46568819b2259d4474eb16e96b9be4.exe	sc.exe
PID 2172 wrote to memory of 2512	2172	0becc5527aba7dc1a746846fc3a2b62f2e46568819b2259d4474eb16e96b9be4.exe	netsh.exe
PID 2172 wrote to memory of 2512	2172	0becc5527aba7dc1a746846fc3a2b62f2e46568819b2259d4474eb16e96b9be4.exe	netsh.exe
PID 2172 wrote to memory of 2512	2172	0becc5527aba7dc1a746846fc3a2b62f2e46568819b2259d4474eb16e96b9be4.exe	netsh.exe
PID 2172 wrote to memory of 2512	2172	0becc5527aba7dc1a746846fc3a2b62f2e46568819b2259d4474eb16e96b9be4.exe	netsh.exe
PID 2404 wrote to memory of 2452	2404	rlqojmjl.exe	svchost.exe
PID 2404 wrote to memory of 2452	2404	rlqojmjl.exe	svchost.exe
PID 2404 wrote to memory of 2452	2404	rlqojmjl.exe	svchost.exe
PID 2404 wrote to memory of 2452	2404	rlqojmjl.exe	svchost.exe
PID 2404 wrote to memory of 2452	2404	rlqojmjl.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\0becc5527aba7dc1a746846fc3a2b62f2e46568819b2259d4474eb16e96b9be4.exe
"C:\Users\Admin\AppData\Local\Temp\0becc5527aba7dc1a746846fc3a2b62f2e46568819b2259d4474eb16e96b9be4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2172

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\tukqhnri\
2⤵
PID:2300

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\rlqojmjl.exe" C:\Windows\SysWOW64\tukqhnri\
2⤵
PID:2900

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create tukqhnri binPath= "C:\Windows\SysWOW64\tukqhnri\rlqojmjl.exe /d\"C:\Users\Admin\AppData\Local\Temp\0becc5527aba7dc1a746846fc3a2b62f2e46568819b2259d4474eb16e96b9be4.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:2536

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description tukqhnri "wifi internet conection"
2⤵
- Launches sc.exe
PID:2660

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start tukqhnri
2⤵
- Launches sc.exe
PID:2576

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:2512

C:\Windows\SysWOW64\tukqhnri\rlqojmjl.exe
C:\Windows\SysWOW64\tukqhnri\rlqojmjl.exe /d"C:\Users\Admin\AppData\Local\Temp\0becc5527aba7dc1a746846fc3a2b62f2e46568819b2259d4474eb16e96b9be4.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
PID:2452

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rlqojmjl.exe
Filesize
10.9MB

MD5
0f8255dc2f1b6f8f97630bee18d24b57

SHA1
38dedd537645863fd9d7535c9f22721fdc4720fc

SHA256
e8accfce2dcd99a1148f3b9c766eeed05e201676c75251443ff51a028a2d805e

SHA512
126aa0b3e60f6cb5a6b1788e5972f8c4fdc712ca0a88c31bce3f0fa5e1c0b49310420647949b4035d261852fa016a3a54bc913af0aecab85bebb1d9518ff5de7

Download Submit
memory/2172-9-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download
memory/2172-3-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2172-2-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download
memory/2172-7-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2172-8-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/2172-1-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/2404-11-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/2404-12-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2404-16-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2404-18-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/2452-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2452-13-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing