Analysis

  • max time kernel
    163s
  • max time network
    187s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 02:59

General

  • Target

    01712cc25c0c3cfcfab253e2cad522cd.exe

  • Size

    12.8MB

  • MD5

    01712cc25c0c3cfcfab253e2cad522cd

  • SHA1

    93696f36d9ce738af89157525cdf9aeaf4865281

  • SHA256

    7d18bef53b53754a23ae16ded0805921fd40ee40e507fc80460a92615fe4b04b

  • SHA512

    0ae8306a2a045300c2a0cf6eb1aa08fdc10ad7c155c6ccfa2deb1bad4330e383063bb16b5ff136466c440d0b33ee8da92a0c9c2159c38b6ef2173cf6571f0bae

  • SSDEEP

    98304:uKlllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllB:

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs 1 IoCs
  • Creates new service(s) 1 TTPs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\01712cc25c0c3cfcfab253e2cad522cd.exe
    "C:\Users\Admin\AppData\Local\Temp\01712cc25c0c3cfcfab253e2cad522cd.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2776
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\xwafdrh\
      2⤵
        PID:2728
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\zmyvobgq.exe" C:\Windows\SysWOW64\xwafdrh\
        2⤵
          PID:2744
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create xwafdrh binPath= "C:\Windows\SysWOW64\xwafdrh\zmyvobgq.exe /d\"C:\Users\Admin\AppData\Local\Temp\01712cc25c0c3cfcfab253e2cad522cd.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:2340
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description xwafdrh "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:2612
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start xwafdrh
          2⤵
          • Launches sc.exe
          PID:1632
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:2652
      • C:\Windows\SysWOW64\xwafdrh\zmyvobgq.exe
        C:\Windows\SysWOW64\xwafdrh\zmyvobgq.exe /d"C:\Users\Admin\AppData\Local\Temp\01712cc25c0c3cfcfab253e2cad522cd.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1136
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          2⤵
          • Windows security bypass
          • Sets service image path in registry
          • Deletes itself
          PID:1956

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\zmyvobgq.exe

        Filesize

        3.2MB

        MD5

        635388218c70de096d42ae6dabf45c2e

        SHA1

        50f21b64d77baaff21aafa33ea782e417a589754

        SHA256

        49d80f9cbf4bb8eaf0b56e9e7452003b837c2aaed19548eeaf3dc182a82d9b37

        SHA512

        906b6406f9e72bb6d376f8cf53350987edb9306ae2d8f22b36b2eb476eec83306647a69242620d0c863d3df300bef6926a53362bb22bdaa312190a599880fcfb

      • C:\Windows\SysWOW64\xwafdrh\zmyvobgq.exe

        Filesize

        85KB

        MD5

        804f84f7e53df168f3a5dcc9246bf8d0

        SHA1

        1906246645e225bce0f110926c4a7ca068408733

        SHA256

        fae02582bd26f9bc98971850a52ad04809dc8dd4f2261250b470f94c712cce15

        SHA512

        58c21b8ed40be761c5cb8cdb9528d96fadaa64968854fcf0453b22561b9012f225816b7867417aa12ab8c506eaeb61d4b21c438ede22de8cecb8040a3cafb59c

      • memory/1136-10-0x00000000038A0000-0x00000000039A0000-memory.dmp

        Filesize

        1024KB

      • memory/1136-22-0x0000000000400000-0x00000000036CD000-memory.dmp

        Filesize

        50.8MB

      • memory/1136-16-0x0000000000400000-0x00000000036CD000-memory.dmp

        Filesize

        50.8MB

      • memory/1136-19-0x0000000000400000-0x00000000036CD000-memory.dmp

        Filesize

        50.8MB

      • memory/1956-18-0x0000000000090000-0x00000000000A5000-memory.dmp

        Filesize

        84KB

      • memory/1956-11-0x0000000000090000-0x00000000000A5000-memory.dmp

        Filesize

        84KB

      • memory/1956-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/1956-14-0x0000000000090000-0x00000000000A5000-memory.dmp

        Filesize

        84KB

      • memory/1956-21-0x0000000000090000-0x00000000000A5000-memory.dmp

        Filesize

        84KB

      • memory/1956-20-0x0000000000090000-0x00000000000A5000-memory.dmp

        Filesize

        84KB

      • memory/1956-23-0x0000000000090000-0x00000000000A5000-memory.dmp

        Filesize

        84KB

      • memory/2776-7-0x0000000000400000-0x00000000036CD000-memory.dmp

        Filesize

        50.8MB

      • memory/2776-4-0x0000000000400000-0x00000000036CD000-memory.dmp

        Filesize

        50.8MB

      • memory/2776-2-0x00000000001B0000-0x00000000001C3000-memory.dmp

        Filesize

        76KB

      • memory/2776-1-0x00000000002F0000-0x00000000003F0000-memory.dmp

        Filesize

        1024KB