tofsee | 86836973d40bcb7748cdb61f83dabf3635e463b88ece1cb1bc665c6a22af3e04

Analysis

max time kernel
135s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2023 07:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86836973d40bcb7748cdb61f83dabf3635e463b88ece1cb1bc665c6a22af3e04 自删除释放文件网络行为较多.exe
Size

12.3MB
MD5

b01bb5b6447410e5fe700ba7e2f1492e
SHA1

8c57825224d7830d9b1a131d1626c5017eb9e5ef
SHA256

86836973d40bcb7748cdb61f83dabf3635e463b88ece1cb1bc665c6a22af3e04
SHA512

9d791d2d6ec211832e3133a5fc12ad4073d5ac5dbfef4c0be9d0ec727d99a9dc3a053ea7df888dbb7b35b53c2c27b862f31daa8b0e45e9a5be8a1d38ad836a9b
SSDEEP

49152:8Lzf9OznOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO:8Xf9O

Score

10^/10

tofsee trojan

Malware Config

Extracted

Family

tofsee

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

86836973d40bcb7748cdb61f83dabf3635e463b88ece1cb1bc665c6a22af3e04 自删除释放文件网络行为较多.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	86836973d40bcb7748cdb61f83dabf3635e463b88ece1cb1bc665c6a22af3e04 自删除释放文件网络行为较多.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

86836973d40bcb7748cdb61f83dabf3635e463b88ece1cb1bc665c6a22af3e04 自删除释放文件网络行为较多.exe

description	pid	process	target process
PID 2196 wrote to memory of 648	2196	86836973d40bcb7748cdb61f83dabf3635e463b88ece1cb1bc665c6a22af3e04 自删除释放文件网络行为较多.exe	cmd.exe
PID 2196 wrote to memory of 648	2196	86836973d40bcb7748cdb61f83dabf3635e463b88ece1cb1bc665c6a22af3e04 自删除释放文件网络行为较多.exe	cmd.exe
PID 2196 wrote to memory of 648	2196	86836973d40bcb7748cdb61f83dabf3635e463b88ece1cb1bc665c6a22af3e04 自删除释放文件网络行为较多.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\86836973d40bcb7748cdb61f83dabf3635e463b88ece1cb1bc665c6a22af3e04 自删除释放文件网络行为较多.exe
"C:\Users\Admin\AppData\Local\Temp\86836973d40bcb7748cdb61f83dabf3635e463b88ece1cb1bc665c6a22af3e04 自删除释放文件网络行为较多.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2196

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7017.bat" "
2⤵
PID:648

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7017.bat
Filesize
332B

MD5
1c6de2e3ec8f7dca07858aaee64ca945

SHA1
4125a80b75de031c0434f202b5f1329016b2c7d1

SHA256
25297e68cad70c6026ba94bdda9c451d2378a2c3063f04ef4ddb4568d1fac2f2

SHA512
09dcee152d8dc5b08782f519d681ee9fa7fd8992022ca63309c53f4bb4ee71e99173c0f3e3fdbea635d5cba5974dd5942bfeab26bc6fe4b29ab8348d4901dbfa

Download Submit
memory/2196-135-0x00000000021A0000-0x00000000021B3000-memory.dmp

Filesize
76KB

Download
memory/2196-138-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download