tofsee | 5cc29d4752c32a15d1c93abd02fe1cbcc525684f4fb9f10e3ad517f67b06fc80

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-en-20211208
submitted
27/12/2021, 07:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dab279cd4fb7c4ca8549c80d1fc0eaf2.exe
Size 327KB
Sample211227-jpan2aahdn
SHA256 5cc29d4752c32a15d1c93abd02fe1cbcc525684f4fb9f10e3ad517f67b06fc80
MD5 dab279cd4fb7c4ca8549c80d1fc0eaf2
SHA1 59c5f15531f0c2c1b956e26c29973c9eb2de0c20
SHA512 a6aa6a80f26a7bf4b04b9c9d35920dcc9562339cb9c54d9726c57d38702b07c090fa3f93597b69ecb8d680bcde1f62b8c87ca9ec680efacd8912df45007d6d08
MD5 SHA1 SHA512

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

parubey.info
patmushta.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Creates new service(s) 1 TTPs
persistence

New Service
T1050

Executes dropped EXE 1 IoCs

pid	Process
652	edwuqlyy.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Deletes itself 1 IoCs

pid	Process
1320	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 652 set thread context of 1320	652	edwuqlyy.exe	40

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 648	1880	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	27
PID 1880 wrote to memory of 648	1880	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	27
PID 1880 wrote to memory of 648	1880	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	27
PID 1880 wrote to memory of 648	1880	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	27
PID 1880 wrote to memory of 272	1880	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	29
PID 1880 wrote to memory of 272	1880	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	29
PID 1880 wrote to memory of 272	1880	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	29
PID 1880 wrote to memory of 272	1880	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	29
PID 1880 wrote to memory of 560	1880	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	31
PID 1880 wrote to memory of 560	1880	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	31
PID 1880 wrote to memory of 560	1880	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	31
PID 1880 wrote to memory of 560	1880	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	31
PID 1880 wrote to memory of 788	1880	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	33
PID 1880 wrote to memory of 788	1880	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	33
PID 1880 wrote to memory of 788	1880	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	33
PID 1880 wrote to memory of 788	1880	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	33
PID 1880 wrote to memory of 812	1880	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	35
PID 1880 wrote to memory of 812	1880	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	35
PID 1880 wrote to memory of 812	1880	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	35
PID 1880 wrote to memory of 812	1880	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	35
PID 1880 wrote to memory of 1200	1880	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	37
PID 1880 wrote to memory of 1200	1880	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	37
PID 1880 wrote to memory of 1200	1880	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	37
PID 1880 wrote to memory of 1200	1880	dab279cd4fb7c4ca8549c80d1fc0eaf2.exe	37
PID 652 wrote to memory of 1320	652	edwuqlyy.exe	40
PID 652 wrote to memory of 1320	652	edwuqlyy.exe	40
PID 652 wrote to memory of 1320	652	edwuqlyy.exe	40
PID 652 wrote to memory of 1320	652	edwuqlyy.exe	40
PID 652 wrote to memory of 1320	652	edwuqlyy.exe	40
PID 652 wrote to memory of 1320	652	edwuqlyy.exe	40

C:\Users\Admin\AppData\Local\Temp\dab279cd4fb7c4ca8549c80d1fc0eaf2.exe
"C:\Users\Admin\AppData\Local\Temp\dab279cd4fb7c4ca8549c80d1fc0eaf2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\fbeccyzu\
  2⤵
  PID:648
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\edwuqlyy.exe" C:\Windows\SysWOW64\fbeccyzu\
  2⤵
  PID:272
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create fbeccyzu binPath= "C:\Windows\SysWOW64\fbeccyzu\edwuqlyy.exe /d\"C:\Users\Admin\AppData\Local\Temp\dab279cd4fb7c4ca8549c80d1fc0eaf2.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  PID:560
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description fbeccyzu "wifi internet conection"
  2⤵
  PID:788
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start fbeccyzu
  2⤵
  PID:812
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  PID:1200

C:\Windows\SysWOW64\fbeccyzu\edwuqlyy.exe
C:\Windows\SysWOW64\fbeccyzu\edwuqlyy.exe /d"C:\Users\Admin\AppData\Local\Temp\dab279cd4fb7c4ca8549c80d1fc0eaf2.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:652
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Deletes itself
  PID:1320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

New Service

T1050

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

New Service

T1050

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/652-72-0x0000000000400000-0x00000000004D2000-memory.dmp

Download

memory/652-65-0x00000000002A8000-0x00000000002B9000-memory.dmp

Download

memory/1320-67-0x0000000000080000-0x0000000000095000-memory.dmp

Download

memory/1320-68-0x0000000000080000-0x0000000000095000-memory.dmp

Download

memory/1880-53-0x0000000000598000-0x00000000005A9000-memory.dmp

Download

memory/1880-56-0x0000000000020000-0x0000000000033000-memory.dmp

Download

memory/1880-57-0x0000000000400000-0x00000000004D2000-memory.dmp

Download

memory/1880-54-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads