tofsee | d05cd710559cb6a23a84f44bfe88b91582862c7d70134cf71807ae0c49964993

General

Target

supvobl.exe
Size

12.5MB
MD5

be286c784044379ca9a6ca6e7211a29f
SHA1

bf8010a0e4b7ae88095bd9ee303707f4c0da549e
SHA256

d05cd710559cb6a23a84f44bfe88b91582862c7d70134cf71807ae0c49964993
SHA512

862e1beffa2cd58cd606a9edf2be79a03ca4a93f2edd6528e91eed2f68ad889e2e76dd43f164cd8f7eb02567504cbcf9581f730177f841a3e5a0298b48674b13
SSDEEP

24576:P7hE7hE7hE7hE7hE7hE7hE7hE7hE7hE7hE7hE7hE7hE7hE7hE7hE7hE7hE7hE7hg:

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\ibvrcqqe = "0"	svchost.exe

Creates new service(s) 1 TTPs
persistence

New Service
T1050
Executes dropped EXE 1 IoCs

Processes:

ojnfvgig.exe

pid process

1876 ojnfvgig.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

552 netsh.exe

pid	process
1876	ojnfvgig.exe

pid	process
552	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ibvrcqqe\ImagePath = "C:\\Windows\\SysWOW64\\ibvrcqqe\\ojnfvgig.exe"	svchost.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

892 svchost.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

ojnfvgig.exe

description pid process target process

PID 1876 set thread context of 892 1876 ojnfvgig.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

1068 sc.exe
1120 sc.exe
1756 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
892	svchost.exe

description	pid	process	target process
PID 1876 set thread context of 892	1876	ojnfvgig.exe	svchost.exe

pid	process
1068	sc.exe
1120	sc.exe
1756	sc.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

supvobl.exeojnfvgig.exe

description	pid	process	target process
PID 1160 wrote to memory of 940	1160	supvobl.exe	cmd.exe
PID 1160 wrote to memory of 940	1160	supvobl.exe	cmd.exe
PID 1160 wrote to memory of 940	1160	supvobl.exe	cmd.exe
PID 1160 wrote to memory of 940	1160	supvobl.exe	cmd.exe
PID 1160 wrote to memory of 760	1160	supvobl.exe	cmd.exe
PID 1160 wrote to memory of 760	1160	supvobl.exe	cmd.exe
PID 1160 wrote to memory of 760	1160	supvobl.exe	cmd.exe
PID 1160 wrote to memory of 760	1160	supvobl.exe	cmd.exe
PID 1160 wrote to memory of 1068	1160	supvobl.exe	sc.exe
PID 1160 wrote to memory of 1068	1160	supvobl.exe	sc.exe
PID 1160 wrote to memory of 1068	1160	supvobl.exe	sc.exe
PID 1160 wrote to memory of 1068	1160	supvobl.exe	sc.exe
PID 1160 wrote to memory of 1120	1160	supvobl.exe	sc.exe
PID 1160 wrote to memory of 1120	1160	supvobl.exe	sc.exe
PID 1160 wrote to memory of 1120	1160	supvobl.exe	sc.exe
PID 1160 wrote to memory of 1120	1160	supvobl.exe	sc.exe
PID 1160 wrote to memory of 1756	1160	supvobl.exe	sc.exe
PID 1160 wrote to memory of 1756	1160	supvobl.exe	sc.exe
PID 1160 wrote to memory of 1756	1160	supvobl.exe	sc.exe
PID 1160 wrote to memory of 1756	1160	supvobl.exe	sc.exe
PID 1876 wrote to memory of 892	1876	ojnfvgig.exe	svchost.exe
PID 1876 wrote to memory of 892	1876	ojnfvgig.exe	svchost.exe
PID 1876 wrote to memory of 892	1876	ojnfvgig.exe	svchost.exe
PID 1876 wrote to memory of 892	1876	ojnfvgig.exe	svchost.exe
PID 1876 wrote to memory of 892	1876	ojnfvgig.exe	svchost.exe
PID 1876 wrote to memory of 892	1876	ojnfvgig.exe	svchost.exe
PID 1160 wrote to memory of 552	1160	supvobl.exe	netsh.exe
PID 1160 wrote to memory of 552	1160	supvobl.exe	netsh.exe
PID 1160 wrote to memory of 552	1160	supvobl.exe	netsh.exe
PID 1160 wrote to memory of 552	1160	supvobl.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\supvobl.exe
"C:\Users\Admin\AppData\Local\Temp\supvobl.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ibvrcqqe\
  2⤵
  PID:940
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ojnfvgig.exe" C:\Windows\SysWOW64\ibvrcqqe\
  2⤵
  PID:760
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create ibvrcqqe binPath= "C:\Windows\SysWOW64\ibvrcqqe\ojnfvgig.exe /d\"C:\Users\Admin\AppData\Local\Temp\supvobl.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:1068
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description ibvrcqqe "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:1120
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start ibvrcqqe
  2⤵
  - Launches sc.exe
  PID:1756
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:552

C:\Windows\SysWOW64\ibvrcqqe\ojnfvgig.exe
C:\Windows\SysWOW64\ibvrcqqe\ojnfvgig.exe /d"C:\Users\Admin\AppData\Local\Temp\supvobl.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Windows security bypass
  - Sets service image path in registry
  - Deletes itself
  PID:892

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

New Service

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

New Service

1

T1050

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ojnfvgig.exe

Filesize
12.8MB

MD5
de00e5b33e4b8feae7e444bdc21fff92

SHA1
2b1ff1fee0b67fde1e70bf9145291e8de24516b3

SHA256
bd1977c4b8fbd857a0ea6f0ae7a31a0cb2eed2d3e7303ec36eb5077e92ba1186

SHA512
d18d9f6700df5193bd9466f3635969d816c4b5182f096096de55f6c2ec4ed273e2ec795e56c10915410b4c72817ba2c8efcad0dbe47ccfed12d8d78d0b8d68e9

Download Submit
C:\Windows\SysWOW64\ibvrcqqe\ojnfvgig.exe

Filesize
12.8MB

MD5
de00e5b33e4b8feae7e444bdc21fff92

SHA1
2b1ff1fee0b67fde1e70bf9145291e8de24516b3

SHA256
bd1977c4b8fbd857a0ea6f0ae7a31a0cb2eed2d3e7303ec36eb5077e92ba1186

SHA512
d18d9f6700df5193bd9466f3635969d816c4b5182f096096de55f6c2ec4ed273e2ec795e56c10915410b4c72817ba2c8efcad0dbe47ccfed12d8d78d0b8d68e9

Download Submit
memory/552-75-0x0000000000000000-mapping.dmp

Download
memory/760-59-0x0000000000000000-mapping.dmp

Download
memory/892-66-0x00000000000D0000-0x00000000000E5000-memory.dmp

Filesize
84KB

Download
memory/892-80-0x00000000000D0000-0x00000000000E5000-memory.dmp

Filesize
84KB

Download
memory/892-77-0x00000000000D0000-0x00000000000E5000-memory.dmp

Filesize
84KB

Download
memory/892-69-0x00000000000D9A6B-mapping.dmp

Download
memory/892-68-0x00000000000D0000-0x00000000000E5000-memory.dmp

Filesize
84KB

Download
memory/940-55-0x0000000000000000-mapping.dmp

Download
memory/1068-61-0x0000000000000000-mapping.dmp

Download
memory/1120-62-0x0000000000000000-mapping.dmp

Download
memory/1160-57-0x0000000000020000-0x0000000000033000-memory.dmp

Filesize
76KB

Download
memory/1160-58-0x0000000000400000-0x0000000002DEE000-memory.dmp

Filesize
41.9MB

Download
memory/1160-76-0x0000000002F0A000-0x0000000002F17000-memory.dmp

Filesize
52KB

Download
memory/1160-56-0x0000000002F0A000-0x0000000002F17000-memory.dmp

Filesize
52KB

Download
memory/1160-79-0x0000000000400000-0x0000000002DEE000-memory.dmp

Filesize
41.9MB

Download
memory/1160-54-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download
memory/1756-63-0x0000000000000000-mapping.dmp

Download
memory/1876-71-0x0000000002EEA000-0x0000000002EF7000-memory.dmp

Filesize
52KB

Download
memory/1876-74-0x0000000000400000-0x0000000002DEE000-memory.dmp

Filesize
41.9MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads