tofsee | 52a0608d226a649ccb30988a282089b8fd97e3542dce93bfcac50846f2e318fc

General

Target

52a0608d226a649ccb30988a282089b8fd97e3542dce93bfcac50846f2e318fc.exe
Size

10.6MB
MD5

c17c2659957ae4094d32ae28df21361d
SHA1

0e51169e7914e136270f9af8b0a6afa62f81a7b1
SHA256

52a0608d226a649ccb30988a282089b8fd97e3542dce93bfcac50846f2e318fc
SHA512

1af79bfb17b659287108f772e14ea2444301ba3e7f069c72d3bd97b3940c445d03ed0ef49e7d13f52c159dc22e6802543363c3facb7b76e469e77a2214653271

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

New Service
T1050
Executes dropped EXE 1 IoCs

Processes:

gphgpbfw.exe

pid process

4864 gphgpbfw.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

4216 netsh.exe

pid	process
4864	gphgpbfw.exe

pid	process
4216	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\hlepsocu\ImagePath = "C:\\Windows\\SysWOW64\\hlepsocu\\gphgpbfw.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

52a0608d226a649ccb30988a282089b8fd97e3542dce93bfcac50846f2e318fc.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	52a0608d226a649ccb30988a282089b8fd97e3542dce93bfcac50846f2e318fc.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

gphgpbfw.exe

description pid process target process

PID 4864 set thread context of 3500 4864 gphgpbfw.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

4972 sc.exe
4152 sc.exe
4796 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 4864 set thread context of 3500	4864	gphgpbfw.exe	svchost.exe

pid	process
4972	sc.exe
4152	sc.exe
4796	sc.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

52a0608d226a649ccb30988a282089b8fd97e3542dce93bfcac50846f2e318fc.exegphgpbfw.exe

description	pid	process	target process
PID 4080 wrote to memory of 4768	4080	52a0608d226a649ccb30988a282089b8fd97e3542dce93bfcac50846f2e318fc.exe	cmd.exe
PID 4080 wrote to memory of 4768	4080	52a0608d226a649ccb30988a282089b8fd97e3542dce93bfcac50846f2e318fc.exe	cmd.exe
PID 4080 wrote to memory of 4768	4080	52a0608d226a649ccb30988a282089b8fd97e3542dce93bfcac50846f2e318fc.exe	cmd.exe
PID 4080 wrote to memory of 4732	4080	52a0608d226a649ccb30988a282089b8fd97e3542dce93bfcac50846f2e318fc.exe	cmd.exe
PID 4080 wrote to memory of 4732	4080	52a0608d226a649ccb30988a282089b8fd97e3542dce93bfcac50846f2e318fc.exe	cmd.exe
PID 4080 wrote to memory of 4732	4080	52a0608d226a649ccb30988a282089b8fd97e3542dce93bfcac50846f2e318fc.exe	cmd.exe
PID 4080 wrote to memory of 4972	4080	52a0608d226a649ccb30988a282089b8fd97e3542dce93bfcac50846f2e318fc.exe	sc.exe
PID 4080 wrote to memory of 4972	4080	52a0608d226a649ccb30988a282089b8fd97e3542dce93bfcac50846f2e318fc.exe	sc.exe
PID 4080 wrote to memory of 4972	4080	52a0608d226a649ccb30988a282089b8fd97e3542dce93bfcac50846f2e318fc.exe	sc.exe
PID 4080 wrote to memory of 4152	4080	52a0608d226a649ccb30988a282089b8fd97e3542dce93bfcac50846f2e318fc.exe	sc.exe
PID 4080 wrote to memory of 4152	4080	52a0608d226a649ccb30988a282089b8fd97e3542dce93bfcac50846f2e318fc.exe	sc.exe
PID 4080 wrote to memory of 4152	4080	52a0608d226a649ccb30988a282089b8fd97e3542dce93bfcac50846f2e318fc.exe	sc.exe
PID 4080 wrote to memory of 4796	4080	52a0608d226a649ccb30988a282089b8fd97e3542dce93bfcac50846f2e318fc.exe	sc.exe
PID 4080 wrote to memory of 4796	4080	52a0608d226a649ccb30988a282089b8fd97e3542dce93bfcac50846f2e318fc.exe	sc.exe
PID 4080 wrote to memory of 4796	4080	52a0608d226a649ccb30988a282089b8fd97e3542dce93bfcac50846f2e318fc.exe	sc.exe
PID 4080 wrote to memory of 4216	4080	52a0608d226a649ccb30988a282089b8fd97e3542dce93bfcac50846f2e318fc.exe	netsh.exe
PID 4080 wrote to memory of 4216	4080	52a0608d226a649ccb30988a282089b8fd97e3542dce93bfcac50846f2e318fc.exe	netsh.exe
PID 4080 wrote to memory of 4216	4080	52a0608d226a649ccb30988a282089b8fd97e3542dce93bfcac50846f2e318fc.exe	netsh.exe
PID 4864 wrote to memory of 3500	4864	gphgpbfw.exe	svchost.exe
PID 4864 wrote to memory of 3500	4864	gphgpbfw.exe	svchost.exe
PID 4864 wrote to memory of 3500	4864	gphgpbfw.exe	svchost.exe
PID 4864 wrote to memory of 3500	4864	gphgpbfw.exe	svchost.exe
PID 4864 wrote to memory of 3500	4864	gphgpbfw.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\52a0608d226a649ccb30988a282089b8fd97e3542dce93bfcac50846f2e318fc.exe
"C:\Users\Admin\AppData\Local\Temp\52a0608d226a649ccb30988a282089b8fd97e3542dce93bfcac50846f2e318fc.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4080

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\hlepsocu\
2⤵
PID:4768

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\gphgpbfw.exe" C:\Windows\SysWOW64\hlepsocu\
2⤵
PID:4732

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create hlepsocu binPath= "C:\Windows\SysWOW64\hlepsocu\gphgpbfw.exe /d\"C:\Users\Admin\AppData\Local\Temp\52a0608d226a649ccb30988a282089b8fd97e3542dce93bfcac50846f2e318fc.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:4972

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description hlepsocu "wifi internet conection"
2⤵
- Launches sc.exe
PID:4152

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start hlepsocu
2⤵
- Launches sc.exe
PID:4796

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:4216

C:\Windows\SysWOW64\hlepsocu\gphgpbfw.exe
C:\Windows\SysWOW64\hlepsocu\gphgpbfw.exe /d"C:\Users\Admin\AppData\Local\Temp\52a0608d226a649ccb30988a282089b8fd97e3542dce93bfcac50846f2e318fc.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4864

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Sets service image path in registry
PID:3500

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

New Service

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

New Service

1

T1050

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gphgpbfw.exe
Filesize
12.2MB

MD5
cc88b9bcca3910a60a9f8ee569330da3

SHA1
e31340e59de3eab037de7659264e25f015ef6f9a

SHA256
e24c300dd361c0c724e6a9823e0c76a9f5ab357489c8372b3c69f33aa52f3d2a

SHA512
2d2579ff37fe5f1af147b43f929b53ad3ad11daa6f3e376acca12ae107fcaedb60152a6face61a2ee57ec66a0e7d970a7afb8d256265bff3545222b8a1c2a910

Download Submit
C:\Windows\SysWOW64\hlepsocu\gphgpbfw.exe
Filesize
12.2MB

MD5
cc88b9bcca3910a60a9f8ee569330da3

SHA1
e31340e59de3eab037de7659264e25f015ef6f9a

SHA256
e24c300dd361c0c724e6a9823e0c76a9f5ab357489c8372b3c69f33aa52f3d2a

SHA512
2d2579ff37fe5f1af147b43f929b53ad3ad11daa6f3e376acca12ae107fcaedb60152a6face61a2ee57ec66a0e7d970a7afb8d256265bff3545222b8a1c2a910

Download Submit
memory/3500-144-0x00000000004B0000-0x00000000004C5000-memory.dmp

Filesize
84KB

Download
memory/3500-143-0x0000000000000000-mapping.dmp

Download
memory/3500-149-0x00000000004B0000-0x00000000004C5000-memory.dmp

Filesize
84KB

Download
memory/3500-148-0x00000000004B0000-0x00000000004C5000-memory.dmp

Filesize
84KB

Download
memory/4080-130-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4080-139-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4080-131-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4152-136-0x0000000000000000-mapping.dmp

Download
memory/4216-138-0x0000000000000000-mapping.dmp

Download
memory/4732-133-0x0000000000000000-mapping.dmp

Download
memory/4768-132-0x0000000000000000-mapping.dmp

Download
memory/4796-137-0x0000000000000000-mapping.dmp

Download
memory/4864-142-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4864-146-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4972-135-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads