tofsee | 738ce2cb6d6cf80b7b5861931c4ecf0fedf1d8cd4f8741b0c6e422a1efd8ed13

General

Target
738ce2cb6d6cf80b7b5861931c4ecf0fedf1d8cd4f8741b0c6e422a1efd8ed13.exe
Size 14.9MB
Sample261029-xye7rset4y
SHA256 738ce2cb6d6cf80b7b5861931c4ecf0fedf1d8cd4f8741b0c6e422a1efd8ed13
MD5 47ef08eccd4596c6659ef0f44c471c06
SHA1 9dd9a04554d294b12f2a68acad9ac4588d8e4062
SHA512 b9f9fb20da64383249e8cae5dffc268de6813aefa51fe5e4595c4741246a6671f3d125a7c523d094999e6af1eba0fc1f0b01ac9bffbfde333cf09dfa36f96e0b
SSDEEP 49152:azp2frvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvn:ak
TLSH
T129F6436676D86ED9D0CA0FBC09A1C42B5DECFB34043A553096D1504F98AE78A973CBB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution tofsee persistence privilege_escalation trojan

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru
refabyd.info

Signatures

Family: Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4708	netsh.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
1432	mtfsbopj.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1432 set thread context of 5800	1432	mtfsbopj.exe	102

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4928	sc.exe
4244	sc.exe
1504	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5412	cmd.exe
2748	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mtfsbopj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	738ce2cb6d6cf80b7b5861931c4ecf0fedf1d8cd4f8741b0c6e422a1efd8ed13.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 5412	4732	738ce2cb6d6cf80b7b5861931c4ecf0fedf1d8cd4f8741b0c6e422a1efd8ed13.exe	90
PID 4732 wrote to memory of 2748	4732	738ce2cb6d6cf80b7b5861931c4ecf0fedf1d8cd4f8741b0c6e422a1efd8ed13.exe	92
PID 4732 wrote to memory of 4928	4732	738ce2cb6d6cf80b7b5861931c4ecf0fedf1d8cd4f8741b0c6e422a1efd8ed13.exe	94
PID 4732 wrote to memory of 4244	4732	738ce2cb6d6cf80b7b5861931c4ecf0fedf1d8cd4f8741b0c6e422a1efd8ed13.exe	97
PID 4732 wrote to memory of 1504	4732	738ce2cb6d6cf80b7b5861931c4ecf0fedf1d8cd4f8741b0c6e422a1efd8ed13.exe	99
PID 1432 wrote to memory of 5800	1432	mtfsbopj.exe	102
PID 1432 wrote to memory of 5800	1432	mtfsbopj.exe	102
PID 4732 wrote to memory of 4708	4732	738ce2cb6d6cf80b7b5861931c4ecf0fedf1d8cd4f8741b0c6e422a1efd8ed13.exe	103

C:\Users\Admin\AppData\Local\Temp\738ce2cb6d6cf80b7b5861931c4ecf0fedf1d8cd4f8741b0c6e422a1efd8ed13.exe
"C:\Users\Admin\AppData\Local\Temp\738ce2cb6d6cf80b7b5861931c4ecf0fedf1d8cd4f8741b0c6e422a1efd8ed13.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\stugqorh\
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5412
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\mtfsbopj.exe" C:\Windows\SysWOW64\stugqorh\
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2748
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create stugqorh binPath= "C:\Windows\SysWOW64\stugqorh\mtfsbopj.exe /d\"C:\Users\Admin\AppData\Local\Temp\738ce2cb6d6cf80b7b5861931c4ecf0fedf1d8cd4f8741b0c6e422a1efd8ed13.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4928
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description stugqorh "wifi internet conection"
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4244
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start stugqorh
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1504
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4708

C:\Windows\SysWOW64\stugqorh\mtfsbopj.exe
C:\Windows\SysWOW64\stugqorh\mtfsbopj.exe /d"C:\Users\Admin\AppData\Local\Temp\738ce2cb6d6cf80b7b5861931c4ecf0fedf1d8cd4f8741b0c6e422a1efd8ed13.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:5800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mtfsbopj.exe

Path C:\Users\Admin\AppData\Local\Temp\mtfsbopj.exe
Size 12.4MB
SHA256 a77bcd63014a0f65237e115136f43d096b72b66a0841c7b55913e2beb27e9c3e
MD5 93a54ee90c030ddb482af74889b8f00d
SHA1 573ca934e37d9d198ff682ae8ad5141931f9702f
SHA512 4aa8871f267248bb88e7b2b62a376f5bf2052d77da92b51d18616c92696be7e3aafc323b2742cc3ef16de132042a9dab54104b52446b2081324a9ab9b0f9eae9
SSDEEP 49152:Lzp2frvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrv/:Lk
TLSH
T195D6436676D86ED9D0CA0FBC09A1C42B5DECFB34043A553096D1504F98AE78A973CBB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1432-5-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/1432-9-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/4732-0-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/4732-10-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/5800-6-0x0000000000D40000-0x0000000000D89000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads