tofsee | 88a7ec735e3cbe569b3e28087a92d646e08532291e13217834815edf89235054

General

Target

2025-02-09_e0cd9fbbcbe2481f1d959855e52aab59_mafia.exe
Size

13.7MB
MD5

e0cd9fbbcbe2481f1d959855e52aab59
SHA1

ab6f1732b26b63547eeeb506651705d022bea5d5
SHA256

88a7ec735e3cbe569b3e28087a92d646e08532291e13217834815edf89235054
SHA512

e14f4b503991387d3601597b66842c1aed700b1128845a84ac9a22ac7dbc889da33fd2fc7e889845f25039adb3c397d4775662a84a0bd300e79c4a70d54cdad6
SSDEEP

393216:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX7:r

Score

10^/10

tofsee defense_evasion discovery execution persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Tofsee family
tofsee
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2596	netsh.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2904	sc.exe
2684	sc.exe
2852	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-02-09_e0cd9fbbcbe2481f1d959855e52aab59_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2632	2100	2025-02-09_e0cd9fbbcbe2481f1d959855e52aab59_mafia.exe	28
PID 2100 wrote to memory of 2632	2100	2025-02-09_e0cd9fbbcbe2481f1d959855e52aab59_mafia.exe	28
PID 2100 wrote to memory of 2632	2100	2025-02-09_e0cd9fbbcbe2481f1d959855e52aab59_mafia.exe	28
PID 2100 wrote to memory of 2632	2100	2025-02-09_e0cd9fbbcbe2481f1d959855e52aab59_mafia.exe	28

C:\Users\Admin\AppData\Local\Temp\2025-02-09_e0cd9fbbcbe2481f1d959855e52aab59_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2025-02-09_e0cd9fbbcbe2481f1d959855e52aab59_mafia.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\kvyramac\
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2632
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\mvpumlgc.exe" C:\Windows\SysWOW64\kvyramac\
  2⤵
  PID:2756
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create kvyramac binPath= "C:\Windows\SysWOW64\kvyramac\mvpumlgc.exe /d\"C:\Users\Admin\AppData\Local\Temp\2025-02-09_e0cd9fbbcbe2481f1d959855e52aab59_mafia.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:2904
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description kvyramac "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2684
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start kvyramac
  2⤵
  - Launches sc.exe
  PID:2852
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:2596

C:\Windows\SysWOW64\kvyramac\mvpumlgc.exe
C:\Windows\SysWOW64\kvyramac\mvpumlgc.exe /d"C:\Users\Admin\AppData\Local\Temp\2025-02-09_e0cd9fbbcbe2481f1d959855e52aab59_mafia.exe"
1⤵
PID:2856
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\mvpumlgc.exe

Filesize
3.4MB

MD5
84f23b977f3cee6069b07deb7721ed69

SHA1
2d1f999bd539c79dc79015bdcec3b5e0f166594a

SHA256
3ff56b11470d3740a79e2dbe37c5ba80b57c8933b07a0dfd2d67a66fd4064168

SHA512
1c7210f9e37bcd9db3af3681652f4fa476dfb50308a4e563329e9346b864a14761abddeef0cd40667f7e80e9357c7841b0328a2be71b597474f4a02ffbf258d4

Download Submit
C:\Windows\SysWOW64\kvyramac\mvpumlgc.exe

Filesize
3.2MB

MD5
610e83a0c8510cbf5b317f9ed8bd23e0

SHA1
67f3fa070e1b0bb3093d56a669e4fecc233337ba

SHA256
82dbd3db1e2217d013ab460edad4c9e5d0fe09b8fffa5d2308b25d237e29141f

SHA512
3cc2d2a682499e26b34507ab753ad473b9f3f69f94dd681e72ced10da8d64b3520330a82cef11a854a9182f01979a89f7032f4473db90948d816a266a19dc50b

Download Submit
memory/2100-17-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2100-1-0x0000000000290000-0x0000000000390000-memory.dmp

Filesize
1024KB

Download
memory/2100-2-0x0000000000020000-0x0000000000033000-memory.dmp

Filesize
76KB

Download
memory/2100-3-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2100-16-0x0000000000290000-0x0000000000390000-memory.dmp

Filesize
1024KB

Download
memory/2100-15-0x0000000000020000-0x0000000000033000-memory.dmp

Filesize
76KB

Download
memory/2100-14-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2696-8-0x0000000000100000-0x0000000000115000-memory.dmp

Filesize
84KB

Download
memory/2696-11-0x0000000000100000-0x0000000000115000-memory.dmp

Filesize
84KB

Download
memory/2696-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2696-19-0x0000000000100000-0x0000000000115000-memory.dmp

Filesize
84KB

Download
memory/2696-18-0x0000000000100000-0x0000000000115000-memory.dmp

Filesize
84KB

Download
memory/2856-13-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads