tofsee | d75045dc8f8c594c1ff7a72d5949db5c57d0c5854451f102d7f59bcd934be622

Analysis

max time kernel
106s
max time network
131s
platform
windows11-21h2_x64
resource
win11-20250502-en
resource tags

arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
submitted
08/05/2025, 02:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2025-05-08_30f052af31bc2707545df5d0fe864640_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee.exe
Size

14.8MB
MD5

30f052af31bc2707545df5d0fe864640
SHA1

f9d392a8ddacd0a008885e9a32175a18de342e84
SHA256

d75045dc8f8c594c1ff7a72d5949db5c57d0c5854451f102d7f59bcd934be622
SHA512

4c041f4ef392c4617845cdcfaa3c9f0d52647ca482d02d9b73791e87fea4ff553e09782118e5c4af3b3f17becd84d716d0944f70d21d4b0322fe103b42834f43
SSDEEP

3072:AEvsKFt0pYpKaf6qDq+AltdnVlfbI4qfu9KBNqJXydUo8WR+gYXauauauauauauO:AEvse06KafvG+AlttV9I1GMYxydUotP

Score

10^/10

tofsee discovery trojan

Malware Config

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Tofsee family
tofsee

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2392	768	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-05-08_30f052af31bc2707545df5d0fe864640_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee.exe

C:\Users\Admin\AppData\Local\Temp\2025-05-08_30f052af31bc2707545df5d0fe864640_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2025-05-08_30f052af31bc2707545df5d0fe864640_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 768 -s 252
  2⤵
  - Program crash
  PID:2392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 768 -ip 768
1⤵
PID:2240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/768-2-0x00000000009A0000-0x00000000009B3000-memory.dmp

Filesize
76KB

Download
memory/768-1-0x00000000004E0000-0x00000000005E0000-memory.dmp

Filesize
1024KB

Download