tofsee | 3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1

General

Target

3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe
Size

114KB
MD5

a01320aeca43cc1846139e6db2caffd4
SHA1

df9ac1de1f02265fe1a88206e2ef5ec70c60890f
SHA256

3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1
SHA512

26ad00b80514b40130e4ce6574688864a54371261040a3ddaf2ea1b9b6548cf64b14f3020e21583bee9f4f39f3ab45a5742f613d2a152e33c51f43467f7d3cf6

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

New Service
T1050
Executes dropped EXE 1 IoCs

Processes:

gstniefc.exe

pid process

3732 gstniefc.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

2968 netsh.exe

pid	process
3732	gstniefc.exe

pid	process
2968	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\kdevipjb\ImagePath = "C:\\Windows\\SysWOW64\\kdevipjb\\gstniefc.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

gstniefc.exe

description pid process target process

PID 3732 set thread context of 4252 3732 gstniefc.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

3464 sc.exe
1480 sc.exe
4804 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 3732 set thread context of 4252	3732	gstniefc.exe	svchost.exe

pid	process
3464	sc.exe
1480	sc.exe
4804	sc.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exegstniefc.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	gstniefc.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exegstniefc.exe

description	pid	process	target process
PID 4948 wrote to memory of 4072	4948	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	cmd.exe
PID 4948 wrote to memory of 4072	4948	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	cmd.exe
PID 4948 wrote to memory of 4072	4948	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	cmd.exe
PID 4948 wrote to memory of 2060	4948	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	cmd.exe
PID 4948 wrote to memory of 2060	4948	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	cmd.exe
PID 4948 wrote to memory of 2060	4948	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	cmd.exe
PID 4948 wrote to memory of 4804	4948	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	sc.exe
PID 4948 wrote to memory of 4804	4948	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	sc.exe
PID 4948 wrote to memory of 4804	4948	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	sc.exe
PID 4948 wrote to memory of 3464	4948	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	sc.exe
PID 4948 wrote to memory of 3464	4948	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	sc.exe
PID 4948 wrote to memory of 3464	4948	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	sc.exe
PID 4948 wrote to memory of 1480	4948	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	sc.exe
PID 4948 wrote to memory of 1480	4948	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	sc.exe
PID 4948 wrote to memory of 1480	4948	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	sc.exe
PID 4948 wrote to memory of 2968	4948	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	netsh.exe
PID 4948 wrote to memory of 2968	4948	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	netsh.exe
PID 4948 wrote to memory of 2968	4948	3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe	netsh.exe
PID 3732 wrote to memory of 4252	3732	gstniefc.exe	svchost.exe
PID 3732 wrote to memory of 4252	3732	gstniefc.exe	svchost.exe
PID 3732 wrote to memory of 4252	3732	gstniefc.exe	svchost.exe
PID 3732 wrote to memory of 4252	3732	gstniefc.exe	svchost.exe
PID 3732 wrote to memory of 4252	3732	gstniefc.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe
"C:\Users\Admin\AppData\Local\Temp\3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe"
1⤵
- Checks computer location settings
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:4948

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\kdevipjb\
2⤵
PID:4072

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\gstniefc.exe" C:\Windows\SysWOW64\kdevipjb\
2⤵
PID:2060

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create kdevipjb binPath= "C:\Windows\SysWOW64\kdevipjb\gstniefc.exe /d\"C:\Users\Admin\AppData\Local\Temp\3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:4804

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description kdevipjb "wifi internet conection"
2⤵
- Launches sc.exe
PID:3464

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start kdevipjb
2⤵
- Launches sc.exe
PID:1480

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:2968

C:\Windows\SysWOW64\kdevipjb\gstniefc.exe
C:\Windows\SysWOW64\kdevipjb\gstniefc.exe /d"C:\Users\Admin\AppData\Local\Temp\3c9223d92c40760077983ab7eeb7509d92ec5400ef0c26151021dda113ce27d1.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:3732

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Sets service image path in registry
PID:4252

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

New Service

1

T1050

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

New Service

1

T1050

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gstniefc.exe
Filesize
11.7MB

MD5
1e4e76e58b4b9cff23eea43783a735ca

SHA1
0dc115e81844cc3a900471e5093c08304dd2cd26

SHA256
09334fb4147a99240b1dc0f2d9f257d6c581c0167b4098aa9ec81572bf2b97b9

SHA512
3d1fc3ad90077800df3ac9df914527aafb73d919b4ce92730b8a0aaff2261b817b22cda532cc7456332c1dd8724b444a8eef450745c678c71f097e70c481c97f

Download Submit
C:\Windows\SysWOW64\kdevipjb\gstniefc.exe
Filesize
11.7MB

MD5
1e4e76e58b4b9cff23eea43783a735ca

SHA1
0dc115e81844cc3a900471e5093c08304dd2cd26

SHA256
09334fb4147a99240b1dc0f2d9f257d6c581c0167b4098aa9ec81572bf2b97b9

SHA512
3d1fc3ad90077800df3ac9df914527aafb73d919b4ce92730b8a0aaff2261b817b22cda532cc7456332c1dd8724b444a8eef450745c678c71f097e70c481c97f

Download Submit
memory/1480-136-0x0000000000000000-mapping.dmp

Download
memory/2060-132-0x0000000000000000-mapping.dmp

Download
memory/2968-137-0x0000000000000000-mapping.dmp

Download
memory/3464-135-0x0000000000000000-mapping.dmp

Download
memory/3732-139-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4072-131-0x0000000000000000-mapping.dmp

Download
memory/4252-140-0x0000000000000000-mapping.dmp

Download
memory/4252-141-0x0000000000C00000-0x0000000000C15000-memory.dmp

Filesize
84KB

Download
memory/4252-143-0x0000000000C00000-0x0000000000C15000-memory.dmp

Filesize
84KB

Download
memory/4252-144-0x0000000000C00000-0x0000000000C15000-memory.dmp

Filesize
84KB

Download
memory/4252-145-0x0000000000C00000-0x0000000000C15000-memory.dmp

Filesize
84KB

Download
memory/4804-134-0x0000000000000000-mapping.dmp

Download
memory/4948-130-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads