tofsee | 86836973d40bcb7748cdb61f83dabf3635e463b88ece1cb1bc665c6a22af3e04

Analysis

max time kernel
30s
max time network
32s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
10-05-2023 07:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86836973d40bcb7748cdb61f83dabf3635e463b88ece1cb1bc665c6a22af3e04 自删除释放文件网络行为较多.exe
Size

12.3MB
MD5

b01bb5b6447410e5fe700ba7e2f1492e
SHA1

8c57825224d7830d9b1a131d1626c5017eb9e5ef
SHA256

86836973d40bcb7748cdb61f83dabf3635e463b88ece1cb1bc665c6a22af3e04
SHA512

9d791d2d6ec211832e3133a5fc12ad4073d5ac5dbfef4c0be9d0ec727d99a9dc3a053ea7df888dbb7b35b53c2c27b862f31daa8b0e45e9a5be8a1d38ad836a9b
SSDEEP

49152:8Lzf9OznOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO:8Xf9O

Score

10^/10

tofsee trojan

Malware Config

Extracted

Family

tofsee

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1604 cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1604	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

86836973d40bcb7748cdb61f83dabf3635e463b88ece1cb1bc665c6a22af3e04 自删除释放文件网络行为较多.exe

description	pid	process	target process
PID 1712 wrote to memory of 1604	1712	86836973d40bcb7748cdb61f83dabf3635e463b88ece1cb1bc665c6a22af3e04 自删除释放文件网络行为较多.exe	cmd.exe
PID 1712 wrote to memory of 1604	1712	86836973d40bcb7748cdb61f83dabf3635e463b88ece1cb1bc665c6a22af3e04 自删除释放文件网络行为较多.exe	cmd.exe
PID 1712 wrote to memory of 1604	1712	86836973d40bcb7748cdb61f83dabf3635e463b88ece1cb1bc665c6a22af3e04 自删除释放文件网络行为较多.exe	cmd.exe
PID 1712 wrote to memory of 1604	1712	86836973d40bcb7748cdb61f83dabf3635e463b88ece1cb1bc665c6a22af3e04 自删除释放文件网络行为较多.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\86836973d40bcb7748cdb61f83dabf3635e463b88ece1cb1bc665c6a22af3e04 自删除释放文件网络行为较多.exe
"C:\Users\Admin\AppData\Local\Temp\86836973d40bcb7748cdb61f83dabf3635e463b88ece1cb1bc665c6a22af3e04 自删除释放文件网络行为较多.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1712

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\4637.bat" "
2⤵
- Deletes itself
PID:1604

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4637.bat
Filesize
332B

MD5
1c6de2e3ec8f7dca07858aaee64ca945

SHA1
4125a80b75de031c0434f202b5f1329016b2c7d1

SHA256
25297e68cad70c6026ba94bdda9c451d2378a2c3063f04ef4ddb4568d1fac2f2

SHA512
09dcee152d8dc5b08782f519d681ee9fa7fd8992022ca63309c53f4bb4ee71e99173c0f3e3fdbea635d5cba5974dd5942bfeab26bc6fe4b29ab8348d4901dbfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\4637.bat
Filesize
332B

MD5
1c6de2e3ec8f7dca07858aaee64ca945

SHA1
4125a80b75de031c0434f202b5f1329016b2c7d1

SHA256
25297e68cad70c6026ba94bdda9c451d2378a2c3063f04ef4ddb4568d1fac2f2

SHA512
09dcee152d8dc5b08782f519d681ee9fa7fd8992022ca63309c53f4bb4ee71e99173c0f3e3fdbea635d5cba5974dd5942bfeab26bc6fe4b29ab8348d4901dbfa

Download Submit
memory/1712-63-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1712-64-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download