tofsee | 2f5e67e49830e1dd0ca7de24e7cc02541246a74d7adeab3e5eae0c85c9f17860

General

Target

eb8a612690e24c3f087515f9a46a9fb0_JaffaCakes118.exe
Size

109KB
MD5

eb8a612690e24c3f087515f9a46a9fb0
SHA1

21d872dda244b67de9edc4942f7295d69616fa78
SHA256

2f5e67e49830e1dd0ca7de24e7cc02541246a74d7adeab3e5eae0c85c9f17860
SHA512

08d50e17ed8685d27a17161f57a7b6a77df31fd7d63fa09cdeb32a8e581da9df15302477e954024d3a0f67af4ab864bed18d891b65ccdc298233a7f183b27253
SSDEEP

1536:kok+6RyYuguJ+BsxKlb0Tz7OO2GHWy4TmQsd1B8HdezI0mF2jbxWGq6:kojey0uJTxKZUOOhICXU+hS2jbxWGq

Score

10^/10

tofsee discovery persistence trojan

Malware Config

Extracted

Family

tofsee

C2

91.218.38.211

188.130.237.71

185.25.48.10

188.165.132.183

rgtryhbgddtyh.biz

wertdghbyrukl.ch

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Tofsee family
tofsee

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	eb8a612690e24c3f087515f9a46a9fb0_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2416	ldogbnnk.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSConfig = "\"C:\\Users\\Admin\\ldogbnnk.exe\""	eb8a612690e24c3f087515f9a46a9fb0_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2416 set thread context of 4672	2416	ldogbnnk.exe	84

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3612	4672	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ldogbnnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eb8a612690e24c3f087515f9a46a9fb0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 2416	4652	eb8a612690e24c3f087515f9a46a9fb0_JaffaCakes118.exe	83
PID 4652 wrote to memory of 2416	4652	eb8a612690e24c3f087515f9a46a9fb0_JaffaCakes118.exe	83
PID 4652 wrote to memory of 2416	4652	eb8a612690e24c3f087515f9a46a9fb0_JaffaCakes118.exe	83
PID 2416 wrote to memory of 4672	2416	ldogbnnk.exe	84
PID 2416 wrote to memory of 4672	2416	ldogbnnk.exe	84
PID 2416 wrote to memory of 4672	2416	ldogbnnk.exe	84
PID 2416 wrote to memory of 4672	2416	ldogbnnk.exe	84
PID 2416 wrote to memory of 4672	2416	ldogbnnk.exe	84
PID 4652 wrote to memory of 2472	4652	eb8a612690e24c3f087515f9a46a9fb0_JaffaCakes118.exe	88
PID 4652 wrote to memory of 2472	4652	eb8a612690e24c3f087515f9a46a9fb0_JaffaCakes118.exe	88
PID 4652 wrote to memory of 2472	4652	eb8a612690e24c3f087515f9a46a9fb0_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\eb8a612690e24c3f087515f9a46a9fb0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eb8a612690e24c3f087515f9a46a9fb0_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Users\Admin\ldogbnnk.exe
  "C:\Users\Admin\ldogbnnk.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4672
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 356
      4⤵
      Program crash
      PID:3612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4635.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4672 -ip 4672
1⤵
PID:4152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4635.bat

Filesize
266B

MD5
dc173fbae0f61c5cb507ebfcd243901b

SHA1
a9d94ffe80331bbc6c77effa7c2b271837a0cc82

SHA256
d4b334aa4b9cd3c93a6b0495bdff690e997344460640d312ba131a326e7d8420

SHA512
5efd4e245b19a02b9c71e4affff97f5922b1fc43bc05f76cb33102c480c2211d5a3f015c4f3bbf2caa8e34fc9efd087cf9f782cac4a9fe307fe4b843fb60f84f

Download Submit
C:\Users\Admin\ldogbnnk.exe

Filesize
30.3MB

MD5
835856f3bf4de31e443973f1a7ba1382

SHA1
133d37990778c6790639d0c7fe0e71373a512578

SHA256
61e22051fe5fb40bb220c4a35b27c7ad37b1e4488c41039eaa644487b59e105f

SHA512
a437ea37252b4683a12ec4eb8038f3a981919d7179a0b35202f28d75f0bbb10f77b3b15f9a4c0f6714fe6be1553a8690f812ce62372002fffa19c4899b4f7d0a

Download Submit
memory/2416-10-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2416-8-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2416-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4652-0-0x00000000005A0000-0x00000000005B2000-memory.dmp

Filesize
72KB

Download
memory/4652-21-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4652-23-0x00000000005A0000-0x00000000005B2000-memory.dmp

Filesize
72KB

Download
memory/4652-1-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4672-17-0x0000000000A60000-0x0000000000A72000-memory.dmp

Filesize
72KB

Download
memory/4672-14-0x0000000000A60000-0x0000000000A72000-memory.dmp

Filesize
72KB

Download
memory/4672-9-0x0000000000A60000-0x0000000000A72000-memory.dmp

Filesize
72KB

Download
memory/4672-26-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Filesize
4KB

Download
memory/4672-27-0x0000000000A60000-0x0000000000A72000-memory.dmp

Filesize
72KB

Download
memory/4672-28-0x0000000000A60000-0x0000000000A72000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads