tofsee | fc9f3d976100c2cb339c25ec6ff62227f482a97dad0056a0ddc5b52491e98a82

General

Target

msdlm32.exe
Size

83KB
MD5

4020fbcc7c19e735fafa725bcd3ea2c5
SHA1

bec43452d9f0d61192bc3851b012cef31882ca02
SHA256

85619645a77454990bb4e730dc87ccd630a4e01f04a10595278ac5c115effac9
SHA512

7bd6570d5bc4edfdc7e8cf2880707a84ac3d61f83090b529305520d0871181f060d539c587ffb981180de84d448cebc9e0e3cc1c96cda920f69d9952ccd1622c
SSDEEP

1536:P2EsPRwdL8AlXUBWCDTsG0QGcn4Z6v/Ea6oVaodgyl744BDK:OMNlfGd0QGbZgEaTVVdgylM4BDK

Score

10^/10

tofsee discovery persistence trojan

Malware Config

Extracted

Family

tofsee

C2

185.4.227.76

188.165.132.183

rgtryhbgddtyh.biz

wertdghbyrukl.ch

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Tofsee family
tofsee

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

msdlm32.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	msdlm32.exe

Executes dropped EXE 1 IoCs

Processes:

yyhgsert.exe

pid	Process
4692	yyhgsert.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

msdlm32.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSConfig = "\"C:\\Users\\Admin\\yyhgsert.exe\""	msdlm32.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

yyhgsert.exe

description	pid	Process	procid_target
PID 4692 set thread context of 3252	4692	yyhgsert.exe	94

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
852	3252	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

msdlm32.exeyyhgsert.execmd.exesvchost.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdlm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yyhgsert.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

msdlm32.exeyyhgsert.exe

description	pid	Process	procid_target
PID 4476 wrote to memory of 4692	4476	msdlm32.exe	89
PID 4476 wrote to memory of 4692	4476	msdlm32.exe	89
PID 4476 wrote to memory of 4692	4476	msdlm32.exe	89
PID 4476 wrote to memory of 3720	4476	msdlm32.exe	90
PID 4476 wrote to memory of 3720	4476	msdlm32.exe	90
PID 4476 wrote to memory of 3720	4476	msdlm32.exe	90
PID 4692 wrote to memory of 3252	4692	yyhgsert.exe	94
PID 4692 wrote to memory of 3252	4692	yyhgsert.exe	94
PID 4692 wrote to memory of 3252	4692	yyhgsert.exe	94
PID 4692 wrote to memory of 3252	4692	yyhgsert.exe	94
PID 4692 wrote to memory of 3252	4692	yyhgsert.exe	94

C:\Users\Admin\AppData\Local\Temp\msdlm32.exe
"C:\Users\Admin\AppData\Local\Temp\msdlm32.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Users\Admin\yyhgsert.exe
  "C:\Users\Admin\yyhgsert.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3252
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 320
      4⤵
      Program crash
      PID:852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4764.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 3252 -ip 3252
1⤵
PID:4516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4764.bat

Filesize
188B

MD5
82d9375c86b3598a5b266915fc1dad3a

SHA1
6dc0a520366e4284d0fc1e1cd048f2729d60d4ab

SHA256
a03bce5bf47c1f1e6baf0decc84da652c6501425b196fc4846647e58dc38090c

SHA512
f9e2ce94af3abfbf78ba65bcb5fc9568a0853069d0306b589f8e3cd4084f18c38882fdbcf0ccaa4306758874e84f28d33e97c73c285d0be5aaec2d6d1dbf3af1

Download Submit
C:\Users\Admin\yyhgsert.exe

Filesize
83KB

MD5
4020fbcc7c19e735fafa725bcd3ea2c5

SHA1
bec43452d9f0d61192bc3851b012cef31882ca02

SHA256
85619645a77454990bb4e730dc87ccd630a4e01f04a10595278ac5c115effac9

SHA512
7bd6570d5bc4edfdc7e8cf2880707a84ac3d61f83090b529305520d0871181f060d539c587ffb981180de84d448cebc9e0e3cc1c96cda920f69d9952ccd1622c

Download Submit
memory/3252-17-0x00000000003C0000-0x00000000003D1000-memory.dmp

Filesize
68KB

Download
memory/3252-29-0x00000000003C0000-0x00000000003D1000-memory.dmp

Filesize
68KB

Download
memory/3252-28-0x00000000003C0000-0x00000000003D1000-memory.dmp

Filesize
68KB

Download
memory/3252-27-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/3252-26-0x00000000003C0000-0x00000000003D1000-memory.dmp

Filesize
68KB

Download
memory/4476-12-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4476-11-0x0000000000401000-0x0000000000405000-memory.dmp

Filesize
16KB

Download
memory/4476-0-0x0000000000401000-0x0000000000405000-memory.dmp

Filesize
16KB

Download
memory/4476-3-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4476-1-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4692-15-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4692-16-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4692-14-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4692-19-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads