tofsee | cbcec0d3e8f866366c001b3e6a67b418cd4292a5e69cba7047a653a67bbf31c5

Analysis

max time kernel
101s
max time network
109s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
28/04/2025, 00:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
250428-ajksdaxps5.bin.exe
Size 14.5MB
Sample250428-anc84avwev
SHA256 cbcec0d3e8f866366c001b3e6a67b418cd4292a5e69cba7047a653a67bbf31c5
MD5 83de57a5e6d79599fe8a69cca5bb812f
SHA1 d151134767ef9f387e041787afcf523eee96ded8
SHA512 0758db5a55f5bfb3a54b70e491b40bc7f96d8fce39585e4d3d6c97041f00bcde330629cdc21f35c7aea5ef12590b460ba6d0ac0642a39c28901e5d3974bf35a3
SSDEEP 49152:vW9zybybybybybybybybybybybybybybybybybybybybybybybybybybybybyby2:+9a
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee discovery trojan

Malware Config

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Tofsee family
tofsee

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4812	2500	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	250428-ajksdaxps5.bin.exe

C:\Users\Admin\AppData\Local\Temp\250428-ajksdaxps5.bin.exe
"C:\Users\Admin\AppData\Local\Temp\250428-ajksdaxps5.bin.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2500
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 244
  2⤵
  - Program crash
  PID:4812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2500 -ip 2500
1⤵
PID:4600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2500-1-0x0000000000610000-0x0000000000710000-memory.dmp

Download

memory/2500-2-0x0000000000590000-0x00000000005A3000-memory.dmp