tofsee | dcf8056404bffc002e0d258c4dacfc0233fa0121ee1f8e4744fc547c90c98426

General

Target

755b1b45c26d282f094d504074bbdf897f6460968db67dd7d88a4702e03ef7f9.exe
Size

203KB
MD5

d88f7c78b3be6c96c33b80a8e1bb85de
SHA1

ce07fb26b0ec69cdf563f98560aa4f7f298e6e8d
SHA256

755b1b45c26d282f094d504074bbdf897f6460968db67dd7d88a4702e03ef7f9
SHA512

1c396a26da383d01ddc317bc4c565c5825b0e452bcf262ac849cd720acb6cb7abcc08e895041e59246dd7686e72424990728745716815a5879bce30769e3e898
SSDEEP

3072:Ef3B/ALaZdXUNc8iirJiM21K7uSbrF068c0E0rBNWRDxlH+cmH:Ef32clVO598c0EHxQco

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

vanaheim.cn

jotunheim.name

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

2220 netsh.exe
Executes dropped EXE 1 IoCs

Processes:

kistvrua.exe

pid process

2580 kistvrua.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

kistvrua.exe

description pid process target process

PID 2580 set thread context of 1724 2580 kistvrua.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

2976 sc.exe
2652 sc.exe
2640 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2220	netsh.exe

pid	process
2580	kistvrua.exe

description	pid	process	target process
PID 2580 set thread context of 1724	2580	kistvrua.exe	svchost.exe

pid	process
2976	sc.exe
2652	sc.exe
2640	sc.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

755b1b45c26d282f094d504074bbdf897f6460968db67dd7d88a4702e03ef7f9.exekistvrua.exe

description	pid	process	target process
PID 1984 wrote to memory of 1292	1984	755b1b45c26d282f094d504074bbdf897f6460968db67dd7d88a4702e03ef7f9.exe	cmd.exe
PID 1984 wrote to memory of 1292	1984	755b1b45c26d282f094d504074bbdf897f6460968db67dd7d88a4702e03ef7f9.exe	cmd.exe
PID 1984 wrote to memory of 1292	1984	755b1b45c26d282f094d504074bbdf897f6460968db67dd7d88a4702e03ef7f9.exe	cmd.exe
PID 1984 wrote to memory of 1292	1984	755b1b45c26d282f094d504074bbdf897f6460968db67dd7d88a4702e03ef7f9.exe	cmd.exe
PID 1984 wrote to memory of 2544	1984	755b1b45c26d282f094d504074bbdf897f6460968db67dd7d88a4702e03ef7f9.exe	cmd.exe
PID 1984 wrote to memory of 2544	1984	755b1b45c26d282f094d504074bbdf897f6460968db67dd7d88a4702e03ef7f9.exe	cmd.exe
PID 1984 wrote to memory of 2544	1984	755b1b45c26d282f094d504074bbdf897f6460968db67dd7d88a4702e03ef7f9.exe	cmd.exe
PID 1984 wrote to memory of 2544	1984	755b1b45c26d282f094d504074bbdf897f6460968db67dd7d88a4702e03ef7f9.exe	cmd.exe
PID 1984 wrote to memory of 2976	1984	755b1b45c26d282f094d504074bbdf897f6460968db67dd7d88a4702e03ef7f9.exe	sc.exe
PID 1984 wrote to memory of 2976	1984	755b1b45c26d282f094d504074bbdf897f6460968db67dd7d88a4702e03ef7f9.exe	sc.exe
PID 1984 wrote to memory of 2976	1984	755b1b45c26d282f094d504074bbdf897f6460968db67dd7d88a4702e03ef7f9.exe	sc.exe
PID 1984 wrote to memory of 2976	1984	755b1b45c26d282f094d504074bbdf897f6460968db67dd7d88a4702e03ef7f9.exe	sc.exe
PID 1984 wrote to memory of 2652	1984	755b1b45c26d282f094d504074bbdf897f6460968db67dd7d88a4702e03ef7f9.exe	sc.exe
PID 1984 wrote to memory of 2652	1984	755b1b45c26d282f094d504074bbdf897f6460968db67dd7d88a4702e03ef7f9.exe	sc.exe
PID 1984 wrote to memory of 2652	1984	755b1b45c26d282f094d504074bbdf897f6460968db67dd7d88a4702e03ef7f9.exe	sc.exe
PID 1984 wrote to memory of 2652	1984	755b1b45c26d282f094d504074bbdf897f6460968db67dd7d88a4702e03ef7f9.exe	sc.exe
PID 1984 wrote to memory of 2640	1984	755b1b45c26d282f094d504074bbdf897f6460968db67dd7d88a4702e03ef7f9.exe	sc.exe
PID 1984 wrote to memory of 2640	1984	755b1b45c26d282f094d504074bbdf897f6460968db67dd7d88a4702e03ef7f9.exe	sc.exe
PID 1984 wrote to memory of 2640	1984	755b1b45c26d282f094d504074bbdf897f6460968db67dd7d88a4702e03ef7f9.exe	sc.exe
PID 1984 wrote to memory of 2640	1984	755b1b45c26d282f094d504074bbdf897f6460968db67dd7d88a4702e03ef7f9.exe	sc.exe
PID 2580 wrote to memory of 1724	2580	kistvrua.exe	svchost.exe
PID 2580 wrote to memory of 1724	2580	kistvrua.exe	svchost.exe
PID 2580 wrote to memory of 1724	2580	kistvrua.exe	svchost.exe
PID 2580 wrote to memory of 1724	2580	kistvrua.exe	svchost.exe
PID 2580 wrote to memory of 1724	2580	kistvrua.exe	svchost.exe
PID 2580 wrote to memory of 1724	2580	kistvrua.exe	svchost.exe
PID 1984 wrote to memory of 2220	1984	755b1b45c26d282f094d504074bbdf897f6460968db67dd7d88a4702e03ef7f9.exe	netsh.exe
PID 1984 wrote to memory of 2220	1984	755b1b45c26d282f094d504074bbdf897f6460968db67dd7d88a4702e03ef7f9.exe	netsh.exe
PID 1984 wrote to memory of 2220	1984	755b1b45c26d282f094d504074bbdf897f6460968db67dd7d88a4702e03ef7f9.exe	netsh.exe
PID 1984 wrote to memory of 2220	1984	755b1b45c26d282f094d504074bbdf897f6460968db67dd7d88a4702e03ef7f9.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\755b1b45c26d282f094d504074bbdf897f6460968db67dd7d88a4702e03ef7f9.exe
"C:\Users\Admin\AppData\Local\Temp\755b1b45c26d282f094d504074bbdf897f6460968db67dd7d88a4702e03ef7f9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1984

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\tdsesimi\
2⤵
PID:1292

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\kistvrua.exe" C:\Windows\SysWOW64\tdsesimi\
2⤵
PID:2544

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create tdsesimi binPath= "C:\Windows\SysWOW64\tdsesimi\kistvrua.exe /d\"C:\Users\Admin\AppData\Local\Temp\755b1b45c26d282f094d504074bbdf897f6460968db67dd7d88a4702e03ef7f9.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:2976

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description tdsesimi "wifi internet conection"
2⤵
- Launches sc.exe
PID:2652

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start tdsesimi
2⤵
- Launches sc.exe
PID:2640

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:2220

C:\Windows\SysWOW64\tdsesimi\kistvrua.exe
C:\Windows\SysWOW64\tdsesimi\kistvrua.exe /d"C:\Users\Admin\AppData\Local\Temp\755b1b45c26d282f094d504074bbdf897f6460968db67dd7d88a4702e03ef7f9.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2580

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
PID:1724

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\kistvrua.exe
Filesize
11.8MB

MD5
be252bfc44c5dd7ad6a973b3eb06819a

SHA1
72ddcf1c3236d0188d42f850ba4fddcc372506b1

SHA256
32a98589e3a7da413816eb7c54dd62e890ea510d330f0e5ab6655537e5e42247

SHA512
fee8608c2f8f6852acb275bcba8acaa1e4958e46b26b5adf35bdf3451111da9a68869f540f754521fdbb6fc4dde9d5e01040f1ebddeb3d8620c748cc8397f104

Download Submit
memory/1724-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1724-10-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/1724-13-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/1984-2-0x00000000002B0000-0x00000000002C3000-memory.dmp

Filesize
76KB

Download
memory/1984-4-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1984-1-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/1984-15-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2580-8-0x0000000000230000-0x0000000000330000-memory.dmp

Filesize
1024KB

Download
memory/2580-9-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2580-16-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download

Analysis

Sharing