tofsee | 6f398436671f162e6674ddaa035640a7c913cd7aae3b6c33673a94fe9b937c1d

General

Target

6f398436671f162e6674ddaa035640a7c913cd7aae3b6c33673a94fe9b937c1d.exe
Size

11.0MB
MD5

8ece3688f9d0bbcaf5c1d427b248d3aa
SHA1

6de52e16bfae27cd9ae1165f06de75dff5ff6a75
SHA256

6f398436671f162e6674ddaa035640a7c913cd7aae3b6c33673a94fe9b937c1d
SHA512

8d74bda26ed73fa2d37d12fedd41f8ad86dcfa166fcb85d2b604fde5697ea48afa67ae5039c4092b6e99fd76aa458b43a609ff4628e0f0b7257afc4611baabf9

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

New Service
T1050
Executes dropped EXE 1 IoCs

Processes:

gacztpze.exe

pid process

796 gacztpze.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

2432 netsh.exe

pid	process
796	gacztpze.exe

pid	process
2432	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\teixopwr\ImagePath = "C:\\Windows\\SysWOW64\\teixopwr\\gacztpze.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

6f398436671f162e6674ddaa035640a7c913cd7aae3b6c33673a94fe9b937c1d.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	6f398436671f162e6674ddaa035640a7c913cd7aae3b6c33673a94fe9b937c1d.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

gacztpze.exe

description pid process target process

PID 796 set thread context of 3912 796 gacztpze.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

4408 sc.exe
4836 sc.exe
4780 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 796 set thread context of 3912	796	gacztpze.exe	svchost.exe

pid	process
4408	sc.exe
4836	sc.exe
4780	sc.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

6f398436671f162e6674ddaa035640a7c913cd7aae3b6c33673a94fe9b937c1d.exegacztpze.exe

description	pid	process	target process
PID 3112 wrote to memory of 4952	3112	6f398436671f162e6674ddaa035640a7c913cd7aae3b6c33673a94fe9b937c1d.exe	cmd.exe
PID 3112 wrote to memory of 4952	3112	6f398436671f162e6674ddaa035640a7c913cd7aae3b6c33673a94fe9b937c1d.exe	cmd.exe
PID 3112 wrote to memory of 4952	3112	6f398436671f162e6674ddaa035640a7c913cd7aae3b6c33673a94fe9b937c1d.exe	cmd.exe
PID 3112 wrote to memory of 1480	3112	6f398436671f162e6674ddaa035640a7c913cd7aae3b6c33673a94fe9b937c1d.exe	cmd.exe
PID 3112 wrote to memory of 1480	3112	6f398436671f162e6674ddaa035640a7c913cd7aae3b6c33673a94fe9b937c1d.exe	cmd.exe
PID 3112 wrote to memory of 1480	3112	6f398436671f162e6674ddaa035640a7c913cd7aae3b6c33673a94fe9b937c1d.exe	cmd.exe
PID 3112 wrote to memory of 4408	3112	6f398436671f162e6674ddaa035640a7c913cd7aae3b6c33673a94fe9b937c1d.exe	sc.exe
PID 3112 wrote to memory of 4408	3112	6f398436671f162e6674ddaa035640a7c913cd7aae3b6c33673a94fe9b937c1d.exe	sc.exe
PID 3112 wrote to memory of 4408	3112	6f398436671f162e6674ddaa035640a7c913cd7aae3b6c33673a94fe9b937c1d.exe	sc.exe
PID 3112 wrote to memory of 4836	3112	6f398436671f162e6674ddaa035640a7c913cd7aae3b6c33673a94fe9b937c1d.exe	sc.exe
PID 3112 wrote to memory of 4836	3112	6f398436671f162e6674ddaa035640a7c913cd7aae3b6c33673a94fe9b937c1d.exe	sc.exe
PID 3112 wrote to memory of 4836	3112	6f398436671f162e6674ddaa035640a7c913cd7aae3b6c33673a94fe9b937c1d.exe	sc.exe
PID 3112 wrote to memory of 4780	3112	6f398436671f162e6674ddaa035640a7c913cd7aae3b6c33673a94fe9b937c1d.exe	sc.exe
PID 3112 wrote to memory of 4780	3112	6f398436671f162e6674ddaa035640a7c913cd7aae3b6c33673a94fe9b937c1d.exe	sc.exe
PID 3112 wrote to memory of 4780	3112	6f398436671f162e6674ddaa035640a7c913cd7aae3b6c33673a94fe9b937c1d.exe	sc.exe
PID 3112 wrote to memory of 2432	3112	6f398436671f162e6674ddaa035640a7c913cd7aae3b6c33673a94fe9b937c1d.exe	netsh.exe
PID 3112 wrote to memory of 2432	3112	6f398436671f162e6674ddaa035640a7c913cd7aae3b6c33673a94fe9b937c1d.exe	netsh.exe
PID 3112 wrote to memory of 2432	3112	6f398436671f162e6674ddaa035640a7c913cd7aae3b6c33673a94fe9b937c1d.exe	netsh.exe
PID 796 wrote to memory of 3912	796	gacztpze.exe	svchost.exe
PID 796 wrote to memory of 3912	796	gacztpze.exe	svchost.exe
PID 796 wrote to memory of 3912	796	gacztpze.exe	svchost.exe
PID 796 wrote to memory of 3912	796	gacztpze.exe	svchost.exe
PID 796 wrote to memory of 3912	796	gacztpze.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\6f398436671f162e6674ddaa035640a7c913cd7aae3b6c33673a94fe9b937c1d.exe
"C:\Users\Admin\AppData\Local\Temp\6f398436671f162e6674ddaa035640a7c913cd7aae3b6c33673a94fe9b937c1d.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3112

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\teixopwr\
2⤵
PID:4952

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\gacztpze.exe" C:\Windows\SysWOW64\teixopwr\
2⤵
PID:1480

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create teixopwr binPath= "C:\Windows\SysWOW64\teixopwr\gacztpze.exe /d\"C:\Users\Admin\AppData\Local\Temp\6f398436671f162e6674ddaa035640a7c913cd7aae3b6c33673a94fe9b937c1d.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:4408

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description teixopwr "wifi internet conection"
2⤵
- Launches sc.exe
PID:4836

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start teixopwr
2⤵
- Launches sc.exe
PID:4780

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:2432

C:\Windows\SysWOW64\teixopwr\gacztpze.exe
C:\Windows\SysWOW64\teixopwr\gacztpze.exe /d"C:\Users\Admin\AppData\Local\Temp\6f398436671f162e6674ddaa035640a7c913cd7aae3b6c33673a94fe9b937c1d.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:796

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Sets service image path in registry
PID:3912

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

New Service

1

T1050

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

New Service

1

T1050

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gacztpze.exe
Filesize
12.6MB

MD5
82061bb46df6132447701946011468df

SHA1
4439cbaa9347e8e6027bd63a5ad76dcd69231c4e

SHA256
3c61d83adc1857076d3c09e757e9ceec8d82bea091612b4dee0d7c495fc6ee77

SHA512
475500b1169ddd32d09ac24b0fefb954b60885506a68824bee1e86a5d1832d88bd33d2b045ce30cafe9645ab9b0b6966169e47e5a679d46fa03e254b3d24a0c3

Download Submit
C:\Windows\SysWOW64\teixopwr\gacztpze.exe
Filesize
12.6MB

MD5
82061bb46df6132447701946011468df

SHA1
4439cbaa9347e8e6027bd63a5ad76dcd69231c4e

SHA256
3c61d83adc1857076d3c09e757e9ceec8d82bea091612b4dee0d7c495fc6ee77

SHA512
475500b1169ddd32d09ac24b0fefb954b60885506a68824bee1e86a5d1832d88bd33d2b045ce30cafe9645ab9b0b6966169e47e5a679d46fa03e254b3d24a0c3

Download Submit
memory/796-145-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/796-142-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1480-133-0x0000000000000000-mapping.dmp

Download
memory/2432-138-0x0000000000000000-mapping.dmp

Download
memory/3112-130-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3112-139-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3112-131-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3912-143-0x0000000000000000-mapping.dmp

Download
memory/3912-144-0x0000000000110000-0x0000000000125000-memory.dmp

Filesize
84KB

Download
memory/3912-147-0x0000000000110000-0x0000000000125000-memory.dmp

Filesize
84KB

Download
memory/3912-148-0x0000000000110000-0x0000000000125000-memory.dmp

Filesize
84KB

Download
memory/3912-149-0x0000000000110000-0x0000000000125000-memory.dmp

Filesize
84KB

Download
memory/4408-135-0x0000000000000000-mapping.dmp

Download
memory/4780-137-0x0000000000000000-mapping.dmp

Download
memory/4836-136-0x0000000000000000-mapping.dmp

Download
memory/4952-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads