tofsee | c73068d1911e20cac7b4fb5b76f70fa51b3ef71fc89a342ab52e2496d2ae34f9

General

Target

11958bc7744b76dc86b2c1e8420b2ca5_JaffaCakes118.exe
Size

161KB
MD5

11958bc7744b76dc86b2c1e8420b2ca5
SHA1

1fc72a14dc47ba815ca3598bf8a61197bb3efa02
SHA256

c73068d1911e20cac7b4fb5b76f70fa51b3ef71fc89a342ab52e2496d2ae34f9
SHA512

b8175d2470857e58c06a9d07ee966b265d6932843bd258d82a86de0e01042b9ba061e67e17c6645302ca977b3480026b4f98696e320127924b684e8dfcfd72d1
SSDEEP

3072:mB937ksA4e6Ons5t3CUH1a86KUwA+bzPW6LjuIdYHTHOdXQ:mn37ks8nOtVT1mUjeDORQ

Score

10^/10

tofsee discovery persistence trojan upx

Malware Config

Extracted

Family

tofsee

C2

208.131.138.216

188.165.132.183

rgtryhbgddtyh.biz

wertdghbyrukl.ch

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Deletes itself 1 IoCs

pid	Process
2604	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2728	qdakrkyd.exe

Loads dropped DLL 2 IoCs

pid	Process
2984	11958bc7744b76dc86b2c1e8420b2ca5_JaffaCakes118.exe
2984	11958bc7744b76dc86b2c1e8420b2ca5_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSConfig = "\"C:\\Users\\Admin\\qdakrkyd.exe\""	11958bc7744b76dc86b2c1e8420b2ca5_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2728 set thread context of 2752	2728	qdakrkyd.exe	33

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2984-0-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/2984-1-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/2984-2-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/2984-3-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/files/0x0008000000012117-14.dat	upx
behavioral1/memory/2728-19-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/2728-27-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/2728-31-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/2728-30-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/2728-33-0x0000000000400000-0x0000000000455000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11958bc7744b76dc86b2c1e8420b2ca5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qdakrkyd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2984	11958bc7744b76dc86b2c1e8420b2ca5_JaffaCakes118.exe
2728	qdakrkyd.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2728	2984	11958bc7744b76dc86b2c1e8420b2ca5_JaffaCakes118.exe	30
PID 2984 wrote to memory of 2728	2984	11958bc7744b76dc86b2c1e8420b2ca5_JaffaCakes118.exe	30
PID 2984 wrote to memory of 2728	2984	11958bc7744b76dc86b2c1e8420b2ca5_JaffaCakes118.exe	30
PID 2984 wrote to memory of 2728	2984	11958bc7744b76dc86b2c1e8420b2ca5_JaffaCakes118.exe	30
PID 2984 wrote to memory of 2604	2984	11958bc7744b76dc86b2c1e8420b2ca5_JaffaCakes118.exe	31
PID 2984 wrote to memory of 2604	2984	11958bc7744b76dc86b2c1e8420b2ca5_JaffaCakes118.exe	31
PID 2984 wrote to memory of 2604	2984	11958bc7744b76dc86b2c1e8420b2ca5_JaffaCakes118.exe	31
PID 2984 wrote to memory of 2604	2984	11958bc7744b76dc86b2c1e8420b2ca5_JaffaCakes118.exe	31
PID 2728 wrote to memory of 2752	2728	qdakrkyd.exe	33
PID 2728 wrote to memory of 2752	2728	qdakrkyd.exe	33
PID 2728 wrote to memory of 2752	2728	qdakrkyd.exe	33
PID 2728 wrote to memory of 2752	2728	qdakrkyd.exe	33
PID 2728 wrote to memory of 2752	2728	qdakrkyd.exe	33
PID 2728 wrote to memory of 2752	2728	qdakrkyd.exe	33

C:\Users\Admin\AppData\Local\Temp\11958bc7744b76dc86b2c1e8420b2ca5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\11958bc7744b76dc86b2c1e8420b2ca5_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Users\Admin\qdakrkyd.exe
  "C:\Users\Admin\qdakrkyd.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2752
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\6611.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6611.bat

Filesize
266B

MD5
46dd8c392910e2781ae617c6cc390e0a

SHA1
eb0c53c0fdb63e0d2a7f0e0a514d7b8f05dc986f

SHA256
56bd1952807adc0f8e9df56c0360706d34a92bbcef9a61ed5136e0fab3c4a68e

SHA512
e3ba561102f681272491ab60a8345ca5e80e8a7b7f0d5d54f43473c1973d3266ce8002f227961da796f4ce5f9560a5a81471a21e10ec2d1dbc8eb034b1e99ad5

Download Submit
C:\Users\Admin\qdakrkyd.exe

Filesize
161KB

MD5
11958bc7744b76dc86b2c1e8420b2ca5

SHA1
1fc72a14dc47ba815ca3598bf8a61197bb3efa02

SHA256
c73068d1911e20cac7b4fb5b76f70fa51b3ef71fc89a342ab52e2496d2ae34f9

SHA512
b8175d2470857e58c06a9d07ee966b265d6932843bd258d82a86de0e01042b9ba061e67e17c6645302ca977b3480026b4f98696e320127924b684e8dfcfd72d1

Download Submit
memory/2728-33-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2728-34-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2728-41-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2728-45-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2728-30-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2728-31-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2728-27-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2728-19-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2752-36-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2752-50-0x0000000000080000-0x0000000000091000-memory.dmp

Filesize
68KB

Download
memory/2752-51-0x0000000000080000-0x0000000000091000-memory.dmp

Filesize
68KB

Download
memory/2752-48-0x0000000000080000-0x0000000000091000-memory.dmp

Filesize
68KB

Download
memory/2752-35-0x0000000000080000-0x0000000000091000-memory.dmp

Filesize
68KB

Download
memory/2752-38-0x0000000000080000-0x0000000000091000-memory.dmp

Filesize
68KB

Download
memory/2984-29-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2984-5-0x0000000000407000-0x0000000000408000-memory.dmp

Filesize
4KB

Download
memory/2984-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2984-7-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2984-8-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2984-4-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/2984-3-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2984-16-0x0000000002460000-0x00000000024B5000-memory.dmp

Filesize
340KB

Download
memory/2984-2-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2984-1-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2984-17-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads