tofsee | 5495f47732928fffb0ff4da2691b2e4366c3f7b3997c5b39f951596dfedd2fc5

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/04/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-21_40250e97b15f0de795c99103a60b53c7_amadey_elex_njrat_remcos_rhadamanthys_smoke-loader_stealc.exe
Size 10.5MB
Sample260421-pyyecaav4t
SHA256 5495f47732928fffb0ff4da2691b2e4366c3f7b3997c5b39f951596dfedd2fc5
MD5 40250e97b15f0de795c99103a60b53c7
SHA1 f61a651d272aa48023641d5eb2e40104d49a4004
SHA512 bd925356a1d6d621146b4780d0d34ba65287ed67bfa1f60e6967678a7c2b675c43e45567e4cdb5780f7ddf110e028b0ab7023e134dc50889b3fb5a9ee18361be
SSDEEP 6144:mIzw8mFAdhAtKlQXRbeoVp59Sqer5+nDFoGCCCCCCCCCCCCCCCCCCCCCCCCCCCCi:BEidhAglQhyupLer5+nZo
TLSH
T148B6851541F80D57DA66BE34757F1B1FCCE9140A702EB7092094F1AEFAB9993C82A372
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution tofsee persistence privilege_escalation trojan

Malware Config

Extracted

Family

tofsee

vanaheim.cn
jotunheim.name

Signatures

Family: Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3544	netsh.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\pfwedlwh\ImagePath = "C:\\Windows\\SysWOW64\\pfwedlwh\\hwovaydv.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation	2026-04-21_40250e97b15f0de795c99103a60b53c7_amadey_elex_njrat_remcos_rhadamanthys_smoke-loader_stealc.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Deletes itself 1 IoCs

pid	Process
916	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
5108	hwovaydv.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5108 set thread context of 916	5108	hwovaydv.exe	98

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3260	sc.exe
2652	sc.exe
940	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1232	5108	WerFault.exe	97
2688	1836	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-21_40250e97b15f0de795c99103a60b53c7_amadey_elex_njrat_remcos_rhadamanthys_smoke-loader_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hwovaydv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 3332	1836	2026-04-21_40250e97b15f0de795c99103a60b53c7_amadey_elex_njrat_remcos_rhadamanthys_smoke-loader_stealc.exe	86
PID 1836 wrote to memory of 548	1836	2026-04-21_40250e97b15f0de795c99103a60b53c7_amadey_elex_njrat_remcos_rhadamanthys_smoke-loader_stealc.exe	88
PID 1836 wrote to memory of 3260	1836	2026-04-21_40250e97b15f0de795c99103a60b53c7_amadey_elex_njrat_remcos_rhadamanthys_smoke-loader_stealc.exe	90
PID 1836 wrote to memory of 2652	1836	2026-04-21_40250e97b15f0de795c99103a60b53c7_amadey_elex_njrat_remcos_rhadamanthys_smoke-loader_stealc.exe	93
PID 1836 wrote to memory of 940	1836	2026-04-21_40250e97b15f0de795c99103a60b53c7_amadey_elex_njrat_remcos_rhadamanthys_smoke-loader_stealc.exe	95
PID 5108 wrote to memory of 916	5108	hwovaydv.exe	98
PID 5108 wrote to memory of 916	5108	hwovaydv.exe	98
PID 1836 wrote to memory of 3544	1836	2026-04-21_40250e97b15f0de795c99103a60b53c7_amadey_elex_njrat_remcos_rhadamanthys_smoke-loader_stealc.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-04-21_40250e97b15f0de795c99103a60b53c7_amadey_elex_njrat_remcos_rhadamanthys_smoke-loader_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-21_40250e97b15f0de795c99103a60b53c7_amadey_elex_njrat_remcos_rhadamanthys_smoke-loader_stealc.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\pfwedlwh\
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3332
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\hwovaydv.exe" C:\Windows\SysWOW64\pfwedlwh\
  2⤵
  - System Location Discovery: System Language Discovery
  PID:548
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create pfwedlwh binPath= "C:\Windows\SysWOW64\pfwedlwh\hwovaydv.exe /d\"C:\Users\Admin\AppData\Local\Temp\2026-04-21_40250e97b15f0de795c99103a60b53c7_amadey_elex_njrat_remcos_rhadamanthys_smoke-loader_stealc.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3260
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description pfwedlwh "wifi internet conection"
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2652
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start pfwedlwh
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:940
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 1036
  2⤵
  - Program crash
  PID:2688

C:\Windows\SysWOW64\pfwedlwh\hwovaydv.exe
C:\Windows\SysWOW64\pfwedlwh\hwovaydv.exe /d"C:\Users\Admin\AppData\Local\Temp\2026-04-21_40250e97b15f0de795c99103a60b53c7_amadey_elex_njrat_remcos_rhadamanthys_smoke-loader_stealc.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5108 -s 512
  2⤵
  - Program crash
  PID:1232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5108 -ip 5108
1⤵
PID:2344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1836 -ip 1836
1⤵
PID:2096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hwovaydv.exe

Path C:\Users\Admin\AppData\Local\Temp\hwovaydv.exe
Size 13.0MB
SHA256 619a90397b3acb1fe5f40fe2d7f68f9b44963059ab2e63a85c962d2c9b44256e
MD5 d8dbf65ba2b195740e4a36cd48666291
SHA1 d6117b605dcf2b24f5125967b7925af405a57fd7
SHA512 e940f55e09081caad56f0e7ee88d32bfe5159f4a753e814a9c70bd77474dee473165d27972193e16abe76666154ed691f378113b031a9f09a7260f88be56519d
SSDEEP 6144:uIzw8mFAdhAtKlQXRbeoVp59Sqer5+nDFoGCCCCCCCCCCCCCCCCCCCCCCCCCCCCH:5EidhAglQhyupLer5+nZo
TLSH
T198D6851541F80D57DA66BE34757F1B1FCCE9140A702EB7092094F1AEFAB9993C82A372
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/916-15-0x0000000000350000-0x0000000000365000-memory.dmp

Download

memory/916-7-0x0000000000350000-0x0000000000365000-memory.dmp

Download

memory/916-8-0x0000000000350000-0x0000000000365000-memory.dmp

Download

memory/916-14-0x0000000000350000-0x0000000000365000-memory.dmp

Download

memory/916-18-0x00000000016C0000-0x00000000016D9000-memory.dmp

Download

memory/916-17-0x0000000000D40000-0x0000000000DD6000-memory.dmp

Download

memory/1836-2-0x0000000002700000-0x0000000002713000-memory.dmp

Download

memory/1836-12-0x0000000002860000-0x00000000028F6000-memory.dmp

Download

memory/1836-13-0x0000000002700000-0x0000000002713000-memory.dmp

Download

memory/1836-1-0x0000000002900000-0x0000000002A00000-memory.dmp

Download

memory/3544-16-0x0000000000F10000-0x0000000000F29000-memory.dmp

Download

memory/5108-10-0x0000000002680000-0x0000000002716000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads