tofsee | 3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1

General

Target

3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe
Size

114KB
MD5

a01320aeca43cc1846139e6db2caffd4
SHA1

df9ac1de1f02265fe1a88206e2ef5ec70c60890f
SHA256

3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1
SHA512

26ad00b80514b40130e4ce6574688864a54371261040a3ddaf2ea1b9b6548cf64b14f3020e21583bee9f4f39f3ab45a5742f613d2a152e33c51f43467f7d3cf6

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\xggiydyu = "0"	svchost.exe

Creates new service(s) 1 TTPs
persistence

New Service
T1050
Executes dropped EXE 1 IoCs

Processes:

kgagmogx.exe

pid process

864 kgagmogx.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1216 netsh.exe

pid	process
864	kgagmogx.exe

pid	process
1216	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\xggiydyu\ImagePath = "C:\\Windows\\SysWOW64\\xggiydyu\\kgagmogx.exe"	svchost.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

1672 svchost.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

kgagmogx.exe

description pid process target process

PID 864 set thread context of 1672 864 kgagmogx.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

920 sc.exe
1808 sc.exe
1096 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1672	svchost.exe

description	pid	process	target process
PID 864 set thread context of 1672	864	kgagmogx.exe	svchost.exe

pid	process
920	sc.exe
1808	sc.exe
1096	sc.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exekgagmogx.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	kgagmogx.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exekgagmogx.exe

description	pid	process	target process
PID 1352 wrote to memory of 976	1352	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	cmd.exe
PID 1352 wrote to memory of 976	1352	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	cmd.exe
PID 1352 wrote to memory of 976	1352	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	cmd.exe
PID 1352 wrote to memory of 976	1352	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	cmd.exe
PID 1352 wrote to memory of 1452	1352	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	cmd.exe
PID 1352 wrote to memory of 1452	1352	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	cmd.exe
PID 1352 wrote to memory of 1452	1352	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	cmd.exe
PID 1352 wrote to memory of 1452	1352	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	cmd.exe
PID 1352 wrote to memory of 1808	1352	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	sc.exe
PID 1352 wrote to memory of 1808	1352	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	sc.exe
PID 1352 wrote to memory of 1808	1352	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	sc.exe
PID 1352 wrote to memory of 1808	1352	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	sc.exe
PID 1352 wrote to memory of 1096	1352	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	sc.exe
PID 1352 wrote to memory of 1096	1352	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	sc.exe
PID 1352 wrote to memory of 1096	1352	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	sc.exe
PID 1352 wrote to memory of 1096	1352	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	sc.exe
PID 1352 wrote to memory of 920	1352	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	sc.exe
PID 1352 wrote to memory of 920	1352	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	sc.exe
PID 1352 wrote to memory of 920	1352	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	sc.exe
PID 1352 wrote to memory of 920	1352	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	sc.exe
PID 1352 wrote to memory of 1216	1352	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	netsh.exe
PID 1352 wrote to memory of 1216	1352	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	netsh.exe
PID 1352 wrote to memory of 1216	1352	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	netsh.exe
PID 1352 wrote to memory of 1216	1352	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	netsh.exe
PID 864 wrote to memory of 1672	864	kgagmogx.exe	svchost.exe
PID 864 wrote to memory of 1672	864	kgagmogx.exe	svchost.exe
PID 864 wrote to memory of 1672	864	kgagmogx.exe	svchost.exe
PID 864 wrote to memory of 1672	864	kgagmogx.exe	svchost.exe
PID 864 wrote to memory of 1672	864	kgagmogx.exe	svchost.exe
PID 864 wrote to memory of 1672	864	kgagmogx.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe
"C:\Users\Admin\AppData\Local\Temp\3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe"
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:1352

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\xggiydyu\
2⤵
PID:976

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\kgagmogx.exe" C:\Windows\SysWOW64\xggiydyu\
2⤵
PID:1452

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create xggiydyu binPath= "C:\Windows\SysWOW64\xggiydyu\kgagmogx.exe /d\"C:\Users\Admin\AppData\Local\Temp\3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:1808

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description xggiydyu "wifi internet conection"
2⤵
- Launches sc.exe
PID:1096

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start xggiydyu
2⤵
- Launches sc.exe
PID:920

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:1216

C:\Windows\SysWOW64\xggiydyu\kgagmogx.exe
C:\Windows\SysWOW64\xggiydyu\kgagmogx.exe /d"C:\Users\Admin\AppData\Local\Temp\3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:864

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
PID:1672

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

New Service

1

T1050

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

New Service

1

T1050

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\kgagmogx.exe
Filesize
12.6MB

MD5
a392c7cd4c9b74886424f05dd690c07a

SHA1
7c52d3e1dc390cc1087029a0a6fc8e1542d6fde9

SHA256
31c38b94227022cf140930f279a34d036c79a28887253063fc0ee6a46d7633a2

SHA512
c2bf52f88e8d2635695a38fd48cb2e8244d4405bd88597ec1c7f61190221683fce2a26fd313b5fb45e29a32de967e73c04b00f4a02377b329c037f8deeaaecbd

Download Submit
C:\Windows\SysWOW64\xggiydyu\kgagmogx.exe
Filesize
12.6MB

MD5
a392c7cd4c9b74886424f05dd690c07a

SHA1
7c52d3e1dc390cc1087029a0a6fc8e1542d6fde9

SHA256
31c38b94227022cf140930f279a34d036c79a28887253063fc0ee6a46d7633a2

SHA512
c2bf52f88e8d2635695a38fd48cb2e8244d4405bd88597ec1c7f61190221683fce2a26fd313b5fb45e29a32de967e73c04b00f4a02377b329c037f8deeaaecbd

Download Submit
memory/864-64-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/920-61-0x0000000000000000-mapping.dmp

Download
memory/976-56-0x0000000000000000-mapping.dmp

Download
memory/1096-60-0x0000000000000000-mapping.dmp

Download
memory/1216-62-0x0000000000000000-mapping.dmp

Download
memory/1352-54-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1352-55-0x0000000076241000-0x0000000076243000-memory.dmp

Filesize
8KB

Download
memory/1452-57-0x0000000000000000-mapping.dmp

Download
memory/1672-66-0x00000000000D0000-0x00000000000E5000-memory.dmp

Filesize
84KB

Download
memory/1672-68-0x00000000000D0000-0x00000000000E5000-memory.dmp

Filesize
84KB

Download
memory/1672-69-0x00000000000D9A6B-mapping.dmp

Download
memory/1672-72-0x00000000000D0000-0x00000000000E5000-memory.dmp

Filesize
84KB

Download
memory/1672-73-0x00000000000D0000-0x00000000000E5000-memory.dmp

Filesize
84KB

Download
memory/1672-75-0x00000000000D0000-0x00000000000E5000-memory.dmp

Filesize
84KB

Download
memory/1808-59-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads