Analysis

  • max time kernel
    159s
  • max time network
    164s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    26-06-2022 01:13

General

  • Target

    36dd37703b6b84eb31184299be5935fd79e46b4c7b9a3f7c2bbdd73a9bedb701.exe

  • Size

    108KB

  • MD5

    3a7c9b7345930efda1b033b5ffd6888c

  • SHA1

    cce9d9ece4bbf8666894d3d52ba3bcf243140a12

  • SHA256

    36dd37703b6b84eb31184299be5935fd79e46b4c7b9a3f7c2bbdd73a9bedb701

  • SHA512

    8b76eba6a981f493b1afac3a39d62f2c91eb1919dcb439f9d9b6aa86bce20e8c66c7a91f33d0f64244cde8c974a5cffe70384320db388b71d268f9e3938d0d9a

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Creates new service(s) 1 TTPs
  • Executes dropped EXE 1 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\36dd37703b6b84eb31184299be5935fd79e46b4c7b9a3f7c2bbdd73a9bedb701.exe
    "C:\Users\Admin\AppData\Local\Temp\36dd37703b6b84eb31184299be5935fd79e46b4c7b9a3f7c2bbdd73a9bedb701.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4316
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\wkiytcup\
      2⤵
        PID:4560
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\lfheyuej.exe" C:\Windows\SysWOW64\wkiytcup\
        2⤵
          PID:4992
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create wkiytcup binPath= "C:\Windows\SysWOW64\wkiytcup\lfheyuej.exe /d\"C:\Users\Admin\AppData\Local\Temp\36dd37703b6b84eb31184299be5935fd79e46b4c7b9a3f7c2bbdd73a9bedb701.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:2700
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description wkiytcup "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:1940
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start wkiytcup
          2⤵
          • Launches sc.exe
          PID:912
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:4352
      • C:\Windows\SysWOW64\wkiytcup\lfheyuej.exe
        C:\Windows\SysWOW64\wkiytcup\lfheyuej.exe /d"C:\Users\Admin\AppData\Local\Temp\36dd37703b6b84eb31184299be5935fd79e46b4c7b9a3f7c2bbdd73a9bedb701.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3708
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          2⤵
          • Sets service image path in registry
          PID:1104

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Persistence

      New Service

      1
      T1050

      Modify Existing Service

      1
      T1031

      Registry Run Keys / Startup Folder

      1
      T1060

      Privilege Escalation

      New Service

      1
      T1050

      Defense Evasion

      Modify Registry

      1
      T1112

      Discovery

      Query Registry

      1
      T1012

      System Information Discovery

      2
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\lfheyuej.exe
        Filesize

        13.7MB

        MD5

        e844bc10c5002fe161bafa021b799532

        SHA1

        962f1c76a4bbbaf44dc9ce64a5c374b7b2a6bfb9

        SHA256

        fd946a82c997cd900c675a5eb8579bd5f2a3adc146b96fbcb665ef610ae8c240

        SHA512

        13a708fcf589f005555d9d8fdc74d51839ee0586836026eed9341093666fa3f6db576fdb744b1d15f30a6da74c5536acc382e784197952f55967a3c75e79333f

      • C:\Windows\SysWOW64\wkiytcup\lfheyuej.exe
        Filesize

        13.7MB

        MD5

        e844bc10c5002fe161bafa021b799532

        SHA1

        962f1c76a4bbbaf44dc9ce64a5c374b7b2a6bfb9

        SHA256

        fd946a82c997cd900c675a5eb8579bd5f2a3adc146b96fbcb665ef610ae8c240

        SHA512

        13a708fcf589f005555d9d8fdc74d51839ee0586836026eed9341093666fa3f6db576fdb744b1d15f30a6da74c5536acc382e784197952f55967a3c75e79333f

      • memory/912-138-0x0000000000000000-mapping.dmp
      • memory/1104-146-0x0000000000AF0000-0x0000000000B05000-memory.dmp
        Filesize

        84KB

      • memory/1104-144-0x0000000000000000-mapping.dmp
      • memory/1104-151-0x0000000000AF0000-0x0000000000B05000-memory.dmp
        Filesize

        84KB

      • memory/1104-150-0x0000000000AF0000-0x0000000000B05000-memory.dmp
        Filesize

        84KB

      • memory/1104-149-0x0000000000AF0000-0x0000000000B05000-memory.dmp
        Filesize

        84KB

      • memory/1940-137-0x0000000000000000-mapping.dmp
      • memory/2700-136-0x0000000000000000-mapping.dmp
      • memory/3708-147-0x0000000000400000-0x000000000041E000-memory.dmp
        Filesize

        120KB

      • memory/3708-142-0x0000000000400000-0x000000000041E000-memory.dmp
        Filesize

        120KB

      • memory/3708-145-0x0000000000400000-0x000000000041E000-memory.dmp
        Filesize

        120KB

      • memory/4316-131-0x0000000000400000-0x000000000041E000-memory.dmp
        Filesize

        120KB

      • memory/4316-140-0x0000000000400000-0x000000000041E000-memory.dmp
        Filesize

        120KB

      • memory/4316-130-0x0000000000400000-0x000000000041E000-memory.dmp
        Filesize

        120KB

      • memory/4316-132-0x0000000000400000-0x000000000041E000-memory.dmp
        Filesize

        120KB

      • memory/4352-139-0x0000000000000000-mapping.dmp
      • memory/4560-133-0x0000000000000000-mapping.dmp
      • memory/4992-134-0x0000000000000000-mapping.dmp