tofsee | 730b0ec46c18879d42ef4540c682c56d6adce71dc125ecc84b9053156f0ea3ec | Triage™

Analysis

max time kernel
149s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 17:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_cc790a36f08c49b385ac9be3e843fb9f_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 14.6MB
Sample260805-v1237scg79
SHA256 730b0ec46c18879d42ef4540c682c56d6adce71dc125ecc84b9053156f0ea3ec
MD5 cc790a36f08c49b385ac9be3e843fb9f
SHA1 af5a9d7ada21157d393930651a55f39459dd05ca
SHA512 dd1f011e4d31abe9e694c8c02fdcfb30bfe40b35983b7cbd06937025afa248c97af17be87da228630e044e57081c1f1eb52ad3811a33545424191a1fb02ac26d
SSDEEP 98304:IuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuT:
TLSH
T145F6CA53A3F17D44EA268B729F2FA6EC771DF6508E8A7768211A9F1F01B1076C263710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution tofsee persistence privilege_escalation trojan

Malware Config

Extracted

Family

tofsee

C2

vanaheim.cn
jotunheim.name

Signatures

Family: Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

Disable or Modify System Firewall

pid	Process
4452	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	2026-08-05_cc790a36f08c49b385ac9be3e843fb9f_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
1988	mbtafdia.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2804	sc.exe
744	sc.exe
552	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

pid	Process
2644	cmd.exe
1748	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2152	1468	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_cc790a36f08c49b385ac9be3e843fb9f_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 2644	1468	2026-08-05_cc790a36f08c49b385ac9be3e843fb9f_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	102
PID 1468 wrote to memory of 1748	1468	2026-08-05_cc790a36f08c49b385ac9be3e843fb9f_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	104
PID 1468 wrote to memory of 744	1468	2026-08-05_cc790a36f08c49b385ac9be3e843fb9f_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	106
PID 1468 wrote to memory of 552	1468	2026-08-05_cc790a36f08c49b385ac9be3e843fb9f_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	108
PID 1468 wrote to memory of 2804	1468	2026-08-05_cc790a36f08c49b385ac9be3e843fb9f_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	111
PID 1468 wrote to memory of 4452	1468	2026-08-05_cc790a36f08c49b385ac9be3e843fb9f_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-08-05_cc790a36f08c49b385ac9be3e843fb9f_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_cc790a36f08c49b385ac9be3e843fb9f_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\hayixqvz\
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2644
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\mbtafdia.exe" C:\Windows\SysWOW64\hayixqvz\
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1748
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create hayixqvz binPath= "C:\Windows\SysWOW64\hayixqvz\mbtafdia.exe /d\"C:\Users\Admin\AppData\Local\Temp\2026-08-05_cc790a36f08c49b385ac9be3e843fb9f_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:744
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description hayixqvz "wifi internet conection"
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:552
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start hayixqvz
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2804
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4452
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 600
  2⤵
  - Program crash
  PID:2152

C:\Windows\SysWOW64\hayixqvz\mbtafdia.exe
C:\Windows\SysWOW64\hayixqvz\mbtafdia.exe /d"C:\Users\Admin\AppData\Local\Temp\2026-08-05_cc790a36f08c49b385ac9be3e843fb9f_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Executes dropped EXE
PID:1988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1468 -ip 1468
1⤵
PID:4316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Windows Command Shell

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Replay Monitor

Loading Replay Monitor...

Downloads

mbtafdia.exe

Path C:\Users\Admin\AppData\Local\Temp\mbtafdia.exe
Size 14.7MB
SHA256 b2ab0c37fd04df3c1b974bb15d4a47e9f76eccec7a265eb0fecf1bb126a5c570
MD5 68739670fe8b5b9ba82bd2bd744d917b
SHA1 21d4cb9886cc5a3ecb8470f07ea38bd570ee6091
SHA512 1c3bc6c4a51a89f7c94a526da36f975dbb4a5b4b16ee6b0bf3d26b245a959670638e68675d41ac4f06e2a9246f5d1b2dea95752f23c984f7700c988665f8ad4c
SSDEEP 98304:Uuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuq:
TLSH
T174F6CA53A3F17D44EA268B729F2FA6EC771DF6508E8A7768211A9F1F01B1076C263710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1468-1-0x0000000002DE0000-0x0000000002EE0000-memory.dmp

Download

memory/1468-2-0x00000000001C0000-0x00000000001D3000-memory.dmp

Download

memory/1468-5-0x0000000000400000-0x0000000002AC1000-memory.dmp

Download

memory/1468-8-0x00000000001C0000-0x00000000001D3000-memory.dmp

Download

memory/1468-7-0x0000000000400000-0x0000000002AC1000-memory.dmp

Download