tofsee | f33a6fdb8508f646674ccc47eb4a28c52da2decf574e7650374046529cde8356

Analysis

max time kernel
99s
max time network
102s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
18/04/2025, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2025-04-18_cdc41eb4c916b813af6bd8be8b323c29_black-basta_elex_luca-stealer.exe
Size 14.1MB
Sample250418-phyeeavn14
SHA256 f33a6fdb8508f646674ccc47eb4a28c52da2decf574e7650374046529cde8356
MD5 cdc41eb4c916b813af6bd8be8b323c29
SHA1 48bce7e7278b62b1647766ec36b5a7569c51bf2e
SHA512 d35555b907c79ca6d9bbcad9cf1343bf65632679df8f4dab4460405f1782a6ef3ec375be8c2b5a201224cdb0e073736b01d3c3f67c87984e465950bae3af7193
SSDEEP 12288:AIRZTEoH9MjgxD3OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO4:XhEodMKc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee discovery trojan

Malware Config

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Tofsee family
tofsee

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4616	3280	WerFault.exe	78

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-18_cdc41eb4c916b813af6bd8be8b323c29_black-basta_elex_luca-stealer.exe

C:\Users\Admin\AppData\Local\Temp\2025-04-18_cdc41eb4c916b813af6bd8be8b323c29_black-basta_elex_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-18_cdc41eb4c916b813af6bd8be8b323c29_black-basta_elex_luca-stealer.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3280
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3280 -s 296
  2⤵
  - Program crash
  PID:4616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3280 -ip 3280
1⤵
PID:2132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3280-1-0x00000000006A0000-0x00000000007A0000-memory.dmp

Download

memory/3280-2-0x0000000002440000-0x0000000002453000-memory.dmp