tofsee | c24e9f212bf4aa4d09be65a48991d3d88a7f8c7964167b669655bae9fcf683aa

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 22:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2974e70f02767b10963e422142859413_JaffaCakes118.exe
Size 136KB
Sample240706-2k8pdaxdlb
SHA256 c24e9f212bf4aa4d09be65a48991d3d88a7f8c7964167b669655bae9fcf683aa
MD5 2974e70f02767b10963e422142859413
SHA1 10982b4f655d166b8145b14f57adae7b265a1559
SHA512 f41fb5551cfa66f2efbc29ce7be0cfffba83309f37078346bdf01db0314f072626054a2eb34d4602b596b4cb74e6f068f65825a3a9a6872b115644c8c766d90a
SSDEEP 3072:kIMXId8aU3RrYoD5XulxqnDv9405BL6zl:xMPayR0oD5muDvi02Z
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee persistence trojan

Malware Config

Extracted

Family

tofsee

94.75.255.140
rgtryhbgddtyh.biz
wertdghbyrukl.ch

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3642458265-1901903390-453309326-1000\Control Panel\International\Geo\Nation	2974e70f02767b10963e422142859413_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
456	bmrdp.exe
1688	bmrdp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3642458265-1901903390-453309326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSConfig = "\"C:\\Users\\Admin\\bmrdp.exe\" /r"	2974e70f02767b10963e422142859413_JaffaCakes118.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1152 set thread context of 1936	1152	2974e70f02767b10963e422142859413_JaffaCakes118.exe	82
PID 456 set thread context of 1688	456	bmrdp.exe	85
PID 1688 set thread context of 1580	1688	bmrdp.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3688	1580	WerFault.exe	86

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1152	2974e70f02767b10963e422142859413_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 1936	1152	2974e70f02767b10963e422142859413_JaffaCakes118.exe	82
PID 1152 wrote to memory of 1936	1152	2974e70f02767b10963e422142859413_JaffaCakes118.exe	82
PID 1152 wrote to memory of 1936	1152	2974e70f02767b10963e422142859413_JaffaCakes118.exe	82
PID 1152 wrote to memory of 1936	1152	2974e70f02767b10963e422142859413_JaffaCakes118.exe	82
PID 1152 wrote to memory of 1936	1152	2974e70f02767b10963e422142859413_JaffaCakes118.exe	82
PID 1152 wrote to memory of 1936	1152	2974e70f02767b10963e422142859413_JaffaCakes118.exe	82
PID 1152 wrote to memory of 1936	1152	2974e70f02767b10963e422142859413_JaffaCakes118.exe	82
PID 1152 wrote to memory of 1936	1152	2974e70f02767b10963e422142859413_JaffaCakes118.exe	82
PID 1936 wrote to memory of 456	1936	2974e70f02767b10963e422142859413_JaffaCakes118.exe	84
PID 1936 wrote to memory of 456	1936	2974e70f02767b10963e422142859413_JaffaCakes118.exe	84
PID 1936 wrote to memory of 456	1936	2974e70f02767b10963e422142859413_JaffaCakes118.exe	84
PID 456 wrote to memory of 1688	456	bmrdp.exe	85
PID 456 wrote to memory of 1688	456	bmrdp.exe	85
PID 456 wrote to memory of 1688	456	bmrdp.exe	85
PID 456 wrote to memory of 1688	456	bmrdp.exe	85
PID 456 wrote to memory of 1688	456	bmrdp.exe	85
PID 456 wrote to memory of 1688	456	bmrdp.exe	85
PID 456 wrote to memory of 1688	456	bmrdp.exe	85
PID 456 wrote to memory of 1688	456	bmrdp.exe	85
PID 1688 wrote to memory of 1580	1688	bmrdp.exe	86
PID 1688 wrote to memory of 1580	1688	bmrdp.exe	86
PID 1688 wrote to memory of 1580	1688	bmrdp.exe	86
PID 1688 wrote to memory of 1580	1688	bmrdp.exe	86
PID 1688 wrote to memory of 1580	1688	bmrdp.exe	86
PID 1936 wrote to memory of 4200	1936	2974e70f02767b10963e422142859413_JaffaCakes118.exe	91
PID 1936 wrote to memory of 4200	1936	2974e70f02767b10963e422142859413_JaffaCakes118.exe	91
PID 1936 wrote to memory of 4200	1936	2974e70f02767b10963e422142859413_JaffaCakes118.exe	91

C:\Users\Admin\AppData\Local\Temp\2974e70f02767b10963e422142859413_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2974e70f02767b10963e422142859413_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Users\Admin\AppData\Local\Temp\2974e70f02767b10963e422142859413_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\2974e70f02767b10963e422142859413_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Users\Admin\bmrdp.exe
    "C:\Users\Admin\bmrdp.exe" /r
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:456
  - - C:\Users\Admin\bmrdp.exe
      "C:\Users\Admin\bmrdp.exe" /r
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:1688
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        
        PID:1580
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 320
        6⤵
        Program crash
        
        PID:3688
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0552.bat" "
    3⤵
    PID:4200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1580 -ip 1580
1⤵
PID:3928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0552.bat

Path C:\Users\Admin\AppData\Local\Temp\0552.bat
Size 117B
SHA256 420fc5b5a75282216ced2c4e4d1e974c31ef3c483ca93ed559684f3d6909a2bd
MD5 0feb7f78ef7529d8b90cdcebaa44f7c1
SHA1 f0b10ab3ccd7a6065cb3a6592b18cf45fc3c0873
SHA512 61b5f294d8669039f6175d5be9df13b974692b8743083e19515b3eab97ee8ddb60dd3fdca3951f45c58f02e799d1ed8a580832dedf33ffa96097f4faf26f325d
MD5 SHA1 SHA512

Submit Download

bmrdp.exe

Path C:\Users\Admin\bmrdp.exe
Size 136KB
SHA256 c24e9f212bf4aa4d09be65a48991d3d88a7f8c7964167b669655bae9fcf683aa
MD5 2974e70f02767b10963e422142859413
SHA1 10982b4f655d166b8145b14f57adae7b265a1559
SHA512 f41fb5551cfa66f2efbc29ce7be0cfffba83309f37078346bdf01db0314f072626054a2eb34d4602b596b4cb74e6f068f65825a3a9a6872b115644c8c766d90a
SSDEEP 3072:kIMXId8aU3RrYoD5XulxqnDv9405BL6zl:xMPayR0oD5muDvi02Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/456-17-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/456-12-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/1152-4-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/1152-0-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/1580-33-0x00000000026A0000-0x00000000026A1000-memory.dmp

Download

memory/1580-34-0x0000000000510000-0x0000000000520000-memory.dmp

Download

memory/1580-35-0x0000000000510000-0x0000000000520000-memory.dmp

Download

memory/1580-19-0x0000000000510000-0x0000000000520000-memory.dmp

Download

memory/1580-24-0x0000000000510000-0x0000000000520000-memory.dmp

Download

memory/1580-32-0x0000000000510000-0x0000000000520000-memory.dmp

Download

memory/1688-18-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/1936-5-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/1936-29-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/1936-7-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/1936-2-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/1936-1-0x0000000000400000-0x0000000000410000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads