tofsee | 1cf5999bc1adcb1a58c7a8369efe850b97bb4a76c837756e9de950bf7790617e

General

Target

1cf5999bc1adcb1a58c7a8369efe850b97bb4a76c837756e9de950bf7790617e.exe
Size

99KB
MD5

1fd5cc1d4e9cd89756af71a2c633d7e1
SHA1

b3575cedf98cad9a62691531fa7136acd70c160e
SHA256

1cf5999bc1adcb1a58c7a8369efe850b97bb4a76c837756e9de950bf7790617e
SHA512

b639c81f4b4c8cb035b35bfbbb7a830046e8a2734653d25aaf90997a2e3b84b049ace52cf153a462deb8ac7bad4c3fb9455ec0c69304bae18620a1c969d85c61

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

New Service
T1050
Executes dropped EXE 1 IoCs

Processes:

zqjmtgsr.exe

pid process

1536 zqjmtgsr.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

2968 netsh.exe

pid	process
1536	zqjmtgsr.exe

pid	process
2968	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\uasgcqar\ImagePath = "C:\\Windows\\SysWOW64\\uasgcqar\\zqjmtgsr.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1cf5999bc1adcb1a58c7a8369efe850b97bb4a76c837756e9de950bf7790617e.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	1cf5999bc1adcb1a58c7a8369efe850b97bb4a76c837756e9de950bf7790617e.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

zqjmtgsr.exe

description pid process target process

PID 1536 set thread context of 4212 1536 zqjmtgsr.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

692 sc.exe
4940 sc.exe
4300 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 1536 set thread context of 4212	1536	zqjmtgsr.exe	svchost.exe

pid	process
692	sc.exe
4940	sc.exe
4300	sc.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

1cf5999bc1adcb1a58c7a8369efe850b97bb4a76c837756e9de950bf7790617e.exezqjmtgsr.exe

description	pid	process	target process
PID 2068 wrote to memory of 4152	2068	1cf5999bc1adcb1a58c7a8369efe850b97bb4a76c837756e9de950bf7790617e.exe	cmd.exe
PID 2068 wrote to memory of 4152	2068	1cf5999bc1adcb1a58c7a8369efe850b97bb4a76c837756e9de950bf7790617e.exe	cmd.exe
PID 2068 wrote to memory of 4152	2068	1cf5999bc1adcb1a58c7a8369efe850b97bb4a76c837756e9de950bf7790617e.exe	cmd.exe
PID 2068 wrote to memory of 676	2068	1cf5999bc1adcb1a58c7a8369efe850b97bb4a76c837756e9de950bf7790617e.exe	cmd.exe
PID 2068 wrote to memory of 676	2068	1cf5999bc1adcb1a58c7a8369efe850b97bb4a76c837756e9de950bf7790617e.exe	cmd.exe
PID 2068 wrote to memory of 676	2068	1cf5999bc1adcb1a58c7a8369efe850b97bb4a76c837756e9de950bf7790617e.exe	cmd.exe
PID 2068 wrote to memory of 4300	2068	1cf5999bc1adcb1a58c7a8369efe850b97bb4a76c837756e9de950bf7790617e.exe	sc.exe
PID 2068 wrote to memory of 4300	2068	1cf5999bc1adcb1a58c7a8369efe850b97bb4a76c837756e9de950bf7790617e.exe	sc.exe
PID 2068 wrote to memory of 4300	2068	1cf5999bc1adcb1a58c7a8369efe850b97bb4a76c837756e9de950bf7790617e.exe	sc.exe
PID 2068 wrote to memory of 692	2068	1cf5999bc1adcb1a58c7a8369efe850b97bb4a76c837756e9de950bf7790617e.exe	sc.exe
PID 2068 wrote to memory of 692	2068	1cf5999bc1adcb1a58c7a8369efe850b97bb4a76c837756e9de950bf7790617e.exe	sc.exe
PID 2068 wrote to memory of 692	2068	1cf5999bc1adcb1a58c7a8369efe850b97bb4a76c837756e9de950bf7790617e.exe	sc.exe
PID 2068 wrote to memory of 4940	2068	1cf5999bc1adcb1a58c7a8369efe850b97bb4a76c837756e9de950bf7790617e.exe	sc.exe
PID 2068 wrote to memory of 4940	2068	1cf5999bc1adcb1a58c7a8369efe850b97bb4a76c837756e9de950bf7790617e.exe	sc.exe
PID 2068 wrote to memory of 4940	2068	1cf5999bc1adcb1a58c7a8369efe850b97bb4a76c837756e9de950bf7790617e.exe	sc.exe
PID 2068 wrote to memory of 2968	2068	1cf5999bc1adcb1a58c7a8369efe850b97bb4a76c837756e9de950bf7790617e.exe	netsh.exe
PID 2068 wrote to memory of 2968	2068	1cf5999bc1adcb1a58c7a8369efe850b97bb4a76c837756e9de950bf7790617e.exe	netsh.exe
PID 2068 wrote to memory of 2968	2068	1cf5999bc1adcb1a58c7a8369efe850b97bb4a76c837756e9de950bf7790617e.exe	netsh.exe
PID 1536 wrote to memory of 4212	1536	zqjmtgsr.exe	svchost.exe
PID 1536 wrote to memory of 4212	1536	zqjmtgsr.exe	svchost.exe
PID 1536 wrote to memory of 4212	1536	zqjmtgsr.exe	svchost.exe
PID 1536 wrote to memory of 4212	1536	zqjmtgsr.exe	svchost.exe
PID 1536 wrote to memory of 4212	1536	zqjmtgsr.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\1cf5999bc1adcb1a58c7a8369efe850b97bb4a76c837756e9de950bf7790617e.exe
"C:\Users\Admin\AppData\Local\Temp\1cf5999bc1adcb1a58c7a8369efe850b97bb4a76c837756e9de950bf7790617e.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2068

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\uasgcqar\
2⤵
PID:4152

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\zqjmtgsr.exe" C:\Windows\SysWOW64\uasgcqar\
2⤵
PID:676

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create uasgcqar binPath= "C:\Windows\SysWOW64\uasgcqar\zqjmtgsr.exe /d\"C:\Users\Admin\AppData\Local\Temp\1cf5999bc1adcb1a58c7a8369efe850b97bb4a76c837756e9de950bf7790617e.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:4300

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description uasgcqar "wifi internet conection"
2⤵
- Launches sc.exe
PID:692

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start uasgcqar
2⤵
- Launches sc.exe
PID:4940

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:2968

C:\Windows\SysWOW64\uasgcqar\zqjmtgsr.exe
C:\Windows\SysWOW64\uasgcqar\zqjmtgsr.exe /d"C:\Users\Admin\AppData\Local\Temp\1cf5999bc1adcb1a58c7a8369efe850b97bb4a76c837756e9de950bf7790617e.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1536

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Sets service image path in registry
PID:4212

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

New Service

1

T1050

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

New Service

1

T1050

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\zqjmtgsr.exe
Filesize
12.4MB

MD5
e47349252497b88ae9b3b3eb69e2bf31

SHA1
e2c750cc5736454e16724c9f03992b67eda8df26

SHA256
cc9ab02940aa86d2b7bd913f83a6501f1f9e63b63e0c6deaff19b75a87125764

SHA512
b79fab37a5851cbd373daccef65edbfead924d3311301da24dbf691004a15b3ec81e8bc2dc8d0af9eb92a329b0d0989384c635df185dd08e53d8a0b943fc5c1e

Download Submit
C:\Windows\SysWOW64\uasgcqar\zqjmtgsr.exe
Filesize
12.4MB

MD5
e47349252497b88ae9b3b3eb69e2bf31

SHA1
e2c750cc5736454e16724c9f03992b67eda8df26

SHA256
cc9ab02940aa86d2b7bd913f83a6501f1f9e63b63e0c6deaff19b75a87125764

SHA512
b79fab37a5851cbd373daccef65edbfead924d3311301da24dbf691004a15b3ec81e8bc2dc8d0af9eb92a329b0d0989384c635df185dd08e53d8a0b943fc5c1e

Download Submit
memory/676-133-0x0000000000000000-mapping.dmp

Download
memory/692-136-0x0000000000000000-mapping.dmp

Download
memory/1536-141-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1536-140-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2068-130-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2068-131-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2968-138-0x0000000000000000-mapping.dmp

Download
memory/4152-132-0x0000000000000000-mapping.dmp

Download
memory/4212-142-0x0000000000000000-mapping.dmp

Download
memory/4212-143-0x0000000000E10000-0x0000000000E25000-memory.dmp

Filesize
84KB

Download
memory/4212-146-0x0000000000E10000-0x0000000000E25000-memory.dmp

Filesize
84KB

Download
memory/4212-147-0x0000000000E10000-0x0000000000E25000-memory.dmp

Filesize
84KB

Download
memory/4300-135-0x0000000000000000-mapping.dmp

Download
memory/4940-137-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads