tofsee | fc9f3d976100c2cb339c25ec6ff62227f482a97dad0056a0ddc5b52491e98a82

General

Target

msdlm32.exe
Size

83KB
MD5

4020fbcc7c19e735fafa725bcd3ea2c5
SHA1

bec43452d9f0d61192bc3851b012cef31882ca02
SHA256

85619645a77454990bb4e730dc87ccd630a4e01f04a10595278ac5c115effac9
SHA512

7bd6570d5bc4edfdc7e8cf2880707a84ac3d61f83090b529305520d0871181f060d539c587ffb981180de84d448cebc9e0e3cc1c96cda920f69d9952ccd1622c
SSDEEP

1536:P2EsPRwdL8AlXUBWCDTsG0QGcn4Z6v/Ea6oVaodgyl744BDK:OMNlfGd0QGbZgEaTVVdgylM4BDK

Score

10^/10

tofsee discovery persistence trojan

Malware Config

Extracted

Family

tofsee

C2

185.4.227.76

188.165.132.183

rgtryhbgddtyh.biz

wertdghbyrukl.ch

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Tofsee family
tofsee

Deletes itself 1 IoCs

Processes:

cmd.exe

pid	Process
1684	cmd.exe

Executes dropped EXE 1 IoCs

Processes:

kktseqdf.exe

pid	Process
2952	kktseqdf.exe

Loads dropped DLL 2 IoCs

Processes:

msdlm32.exe

pid	Process
2316	msdlm32.exe
2316	msdlm32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

msdlm32.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSConfig = "\"C:\\Users\\Admin\\kktseqdf.exe\""	msdlm32.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

kktseqdf.exe

description	pid	Process	procid_target
PID 2952 set thread context of 2392	2952	kktseqdf.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

msdlm32.exekktseqdf.execmd.exesvchost.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdlm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kktseqdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

msdlm32.exekktseqdf.exe

description	pid	Process	procid_target
PID 2316 wrote to memory of 2952	2316	msdlm32.exe	31
PID 2316 wrote to memory of 2952	2316	msdlm32.exe	31
PID 2316 wrote to memory of 2952	2316	msdlm32.exe	31
PID 2316 wrote to memory of 2952	2316	msdlm32.exe	31
PID 2316 wrote to memory of 1684	2316	msdlm32.exe	32
PID 2316 wrote to memory of 1684	2316	msdlm32.exe	32
PID 2316 wrote to memory of 1684	2316	msdlm32.exe	32
PID 2316 wrote to memory of 1684	2316	msdlm32.exe	32
PID 2952 wrote to memory of 2392	2952	kktseqdf.exe	34
PID 2952 wrote to memory of 2392	2952	kktseqdf.exe	34
PID 2952 wrote to memory of 2392	2952	kktseqdf.exe	34
PID 2952 wrote to memory of 2392	2952	kktseqdf.exe	34
PID 2952 wrote to memory of 2392	2952	kktseqdf.exe	34
PID 2952 wrote to memory of 2392	2952	kktseqdf.exe	34

C:\Users\Admin\AppData\Local\Temp\msdlm32.exe
"C:\Users\Admin\AppData\Local\Temp\msdlm32.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Users\Admin\kktseqdf.exe
  "C:\Users\Admin\kktseqdf.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2392
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\4768.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:1684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4768.bat

Filesize
188B

MD5
82d9375c86b3598a5b266915fc1dad3a

SHA1
6dc0a520366e4284d0fc1e1cd048f2729d60d4ab

SHA256
a03bce5bf47c1f1e6baf0decc84da652c6501425b196fc4846647e58dc38090c

SHA512
f9e2ce94af3abfbf78ba65bcb5fc9568a0853069d0306b589f8e3cd4084f18c38882fdbcf0ccaa4306758874e84f28d33e97c73c285d0be5aaec2d6d1dbf3af1

Download Submit
\Users\Admin\kktseqdf.exe

Filesize
83KB

MD5
4020fbcc7c19e735fafa725bcd3ea2c5

SHA1
bec43452d9f0d61192bc3851b012cef31882ca02

SHA256
85619645a77454990bb4e730dc87ccd630a4e01f04a10595278ac5c115effac9

SHA512
7bd6570d5bc4edfdc7e8cf2880707a84ac3d61f83090b529305520d0871181f060d539c587ffb981180de84d448cebc9e0e3cc1c96cda920f69d9952ccd1622c

Download Submit
memory/2316-0-0x0000000000401000-0x0000000000405000-memory.dmp

Filesize
16KB

Download
memory/2316-1-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2316-3-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2316-19-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2316-20-0x0000000000401000-0x0000000000405000-memory.dmp

Filesize
16KB

Download
memory/2392-25-0x00000000000C0000-0x00000000000D1000-memory.dmp

Filesize
68KB

Download
memory/2392-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2392-35-0x00000000000C0000-0x00000000000D1000-memory.dmp

Filesize
68KB

Download
memory/2392-38-0x00000000000C0000-0x00000000000D1000-memory.dmp

Filesize
68KB

Download
memory/2392-39-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/2392-41-0x00000000000C0000-0x00000000000D1000-memory.dmp

Filesize
68KB

Download
memory/2392-42-0x00000000000C0000-0x00000000000D1000-memory.dmp

Filesize
68KB

Download
memory/2952-22-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2952-24-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2952-30-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2952-23-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads