Analysis

  • max time kernel
    143s
  • max time network
    132s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    14-12-2020 14:25

General

  • Target

    433b76b50aff2852f8e7a5071594df71.exe

  • Size

    14.7MB

  • MD5

    433b76b50aff2852f8e7a5071594df71

  • SHA1

    d721a6ffb0c601d9b7209ce0cf0334d9a70b4810

  • SHA256

    289638ff4cfd284afe4780faa40c63f0c484de2eaabe35f006cbfa7f538fe891

  • SHA512

    4b99fa41f4e937f109e9b3564146c12ed63bda8e354c2078a0c5d56af9afb611673a586995fb942efe3514c9c278c972c3610488e12410816e894127fcf08f7a

Malware Config

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs
  • Creates new service(s) 1 TTPs
  • Executes dropped EXE 1 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Program crash 19 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\433b76b50aff2852f8e7a5071594df71.exe
    "C:\Users\Admin\AppData\Local\Temp\433b76b50aff2852f8e7a5071594df71.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3084
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 568
      2⤵
      • Program crash
      PID:2960
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 572
      2⤵
      • Program crash
      PID:4084
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 704
      2⤵
      • Program crash
      PID:2920
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 680
      2⤵
      • Program crash
      PID:1276
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 784
      2⤵
      • Program crash
      PID:700
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 804
      2⤵
      • Program crash
      PID:2640
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 952
      2⤵
      • Program crash
      PID:740
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\bnrsamsr\
      2⤵
        PID:2756
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 836
        2⤵
        • Program crash
        PID:4076
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 700
        2⤵
        • Program crash
        PID:2176
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\wzfzozkq.exe" C:\Windows\SysWOW64\bnrsamsr\
        2⤵
          PID:2156
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 704
          2⤵
          • Program crash
          PID:4060
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 692
          2⤵
          • Program crash
          PID:1752
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create bnrsamsr binPath= "C:\Windows\SysWOW64\bnrsamsr\wzfzozkq.exe /d\"C:\Users\Admin\AppData\Local\Temp\433b76b50aff2852f8e7a5071594df71.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:1852
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 732
            2⤵
            • Program crash
            PID:2576
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 704
            2⤵
            • Program crash
            PID:4044
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description bnrsamsr "wifi internet conection"
            2⤵
              PID:3520
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 1020
              2⤵
              • Program crash
              PID:2688
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 704
              2⤵
              • Program crash
              PID:3256
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start bnrsamsr
              2⤵
                PID:940
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 688
                2⤵
                • Program crash
                PID:2244
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 520
                2⤵
                • Program crash
                PID:3120
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:2180
              • C:\Windows\SysWOW64\bnrsamsr\wzfzozkq.exe
                C:\Windows\SysWOW64\bnrsamsr\wzfzozkq.exe /d"C:\Users\Admin\AppData\Local\Temp\433b76b50aff2852f8e7a5071594df71.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:2768
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 588
                  2⤵
                  • Program crash
                  PID:4040
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Deletes itself
                  PID:2840
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 588
                  2⤵
                  • Program crash
                  PID:3204

              Network

              MITRE ATT&CK Matrix ATT&CK v6

              Persistence

              New Service

              1
              T1050

              Modify Existing Service

              1
              T1031

              Registry Run Keys / Startup Folder

              1
              T1060

              Privilege Escalation

              New Service

              1
              T1050

              Defense Evasion

              Disabling Security Tools

              1
              T1089

              Modify Registry

              2
              T1112

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\wzfzozkq.exe
                MD5

                71364dc3f1f4fd4b258ea39541264638

                SHA1

                9a34a0a6d68d2ffbd48deacd08888176d17559ee

                SHA256

                6b6c6f21b3848190649db21e372769b6523ff1e514ee6c14cee78620f5b7392d

                SHA512

                7450a2566697435aca2b2c5622923dfa3a7a73a1ea40d73b9cda4f0ff1c543c6b658dfdc99aa1be98f73cef779ed905a23c8855d23959ac807c40b39edbc4783

              • C:\Windows\SysWOW64\bnrsamsr\wzfzozkq.exe
                MD5

                71364dc3f1f4fd4b258ea39541264638

                SHA1

                9a34a0a6d68d2ffbd48deacd08888176d17559ee

                SHA256

                6b6c6f21b3848190649db21e372769b6523ff1e514ee6c14cee78620f5b7392d

                SHA512

                7450a2566697435aca2b2c5622923dfa3a7a73a1ea40d73b9cda4f0ff1c543c6b658dfdc99aa1be98f73cef779ed905a23c8855d23959ac807c40b39edbc4783

              • memory/940-20-0x0000000000000000-mapping.dmp
              • memory/1852-18-0x0000000000000000-mapping.dmp
              • memory/2156-16-0x0000000000000000-mapping.dmp
              • memory/2180-24-0x0000000000000000-mapping.dmp
              • memory/2756-15-0x0000000000000000-mapping.dmp
              • memory/2768-23-0x00000000015C0000-0x00000000015C1000-memory.dmp
                Filesize

                4KB

              • memory/2840-26-0x0000000000A39A6B-mapping.dmp
              • memory/2840-25-0x0000000000A30000-0x0000000000A45000-memory.dmp
                Filesize

                84KB

              • memory/3084-9-0x0000000002B90000-0x0000000002B91000-memory.dmp
                Filesize

                4KB

              • memory/3084-11-0x0000000002B90000-0x0000000002B91000-memory.dmp
                Filesize

                4KB

              • memory/3084-10-0x0000000002B90000-0x0000000002B91000-memory.dmp
                Filesize

                4KB

              • memory/3084-12-0x0000000002B90000-0x0000000002B91000-memory.dmp
                Filesize

                4KB

              • memory/3084-8-0x0000000002B90000-0x0000000002B91000-memory.dmp
                Filesize

                4KB

              • memory/3084-7-0x0000000002B90000-0x0000000002B91000-memory.dmp
                Filesize

                4KB

              • memory/3084-3-0x0000000002A40000-0x0000000002A41000-memory.dmp
                Filesize

                4KB

              • memory/3084-2-0x0000000000E56000-0x0000000000E57000-memory.dmp
                Filesize

                4KB

              • memory/3084-14-0x0000000002B90000-0x0000000002B91000-memory.dmp
                Filesize

                4KB

              • memory/3084-13-0x0000000002B90000-0x0000000002B91000-memory.dmp
                Filesize

                4KB

              • memory/3520-19-0x0000000000000000-mapping.dmp