Analysis
- max time kernel
5s - max time network
67s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
29/10/2022, 05:53
General
- Target file.exe
- Size 260KB
- Sample221029-gla5aadce7
- SHA256 4e3d4e3ea7c16353bf3e4ddb94da7fddcb057a0d9b878f91f957fcc43d160eb7
Score
10/10
Malware Config
Signatures
- Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
- Creates new service(s) 1 TTPs
- Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\xupnopum\2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\spjkhpfm.exe" C:\Windows\SysWOW64\xupnopum\2⤵
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create xupnopum binPath= "C:\Windows\SysWOW64\xupnopum\spjkhpfm.exe /d\"C:\Users\Admin\AppData\Local\Temp\file.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description xupnopum "wifi internet conection"2⤵
- Launches sc.exe
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
spjkhpfm.exe
memory/1884-54-0x0000000075571000-0x0000000075573000-memory.dmp
memory/1884-55-0x0000000002CDA000-0x0000000002CEF000-memory.dmp
memory/1884-56-0x00000000002C0000-0x00000000002D3000-memory.dmp
memory/1884-60-0x0000000000400000-0x0000000002C2F000-memory.dmp
memory/1884-64-0x00000000002C0000-0x00000000002D3000-memory.dmp
memory/1884-63-0x0000000002CDA000-0x0000000002CEF000-memory.dmp