tofsee | 7d18bef53b53754a23ae16ded0805921fd40ee40e507fc80460a92615fe4b04b

Analysis

max time kernel
3s
max time network
83s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 02:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01712cc25c0c3cfcfab253e2cad522cd.exe
Size

12.8MB
MD5

01712cc25c0c3cfcfab253e2cad522cd
SHA1

93696f36d9ce738af89157525cdf9aeaf4865281
SHA256

7d18bef53b53754a23ae16ded0805921fd40ee40e507fc80460a92615fe4b04b
SHA512

0ae8306a2a045300c2a0cf6eb1aa08fdc10ad7c155c6ccfa2deb1bad4330e383063bb16b5ff136466c440d0b33ee8da92a0c9c2159c38b6ef2173cf6571f0bae
SSDEEP

98304:uKlllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllB:

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
4944	netsh.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4640	sc.exe
4092	sc.exe
1292	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\01712cc25c0c3cfcfab253e2cad522cd.exe
"C:\Users\Admin\AppData\Local\Temp\01712cc25c0c3cfcfab253e2cad522cd.exe"
1⤵
PID:228
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\adxnfqkn\
  2⤵
  PID:1904
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ydnicoln.exe" C:\Windows\SysWOW64\adxnfqkn\
  2⤵
  PID:2348
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create adxnfqkn binPath= "C:\Windows\SysWOW64\adxnfqkn\ydnicoln.exe /d\"C:\Users\Admin\AppData\Local\Temp\01712cc25c0c3cfcfab253e2cad522cd.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:4640
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description adxnfqkn "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:4092
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start adxnfqkn
  2⤵
  - Launches sc.exe
  PID:1292
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:4944

C:\Windows\SysWOW64\adxnfqkn\ydnicoln.exe
C:\Windows\SysWOW64\adxnfqkn\ydnicoln.exe /d"C:\Users\Admin\AppData\Local\Temp\01712cc25c0c3cfcfab253e2cad522cd.exe"
1⤵
PID:2820
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:3148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/228-1-0x00000000038E0000-0x00000000039E0000-memory.dmp

Filesize
1024KB

Download
memory/228-4-0x0000000000400000-0x00000000036CD000-memory.dmp

Filesize
50.8MB

Download
memory/228-8-0x0000000003870000-0x0000000003883000-memory.dmp

Filesize
76KB

Download
memory/228-7-0x0000000000400000-0x00000000036CD000-memory.dmp

Filesize
50.8MB

Download
memory/228-2-0x0000000003870000-0x0000000003883000-memory.dmp

Filesize
76KB

Download
memory/2820-16-0x0000000000400000-0x00000000036CD000-memory.dmp

Filesize
50.8MB

Download
memory/2820-11-0x0000000003A20000-0x0000000003B20000-memory.dmp

Filesize
1024KB

Download
memory/2820-19-0x0000000000400000-0x00000000036CD000-memory.dmp

Filesize
50.8MB

Download
memory/3148-15-0x0000000001070000-0x0000000001085000-memory.dmp

Filesize
84KB

Download
memory/3148-17-0x0000000001070000-0x0000000001085000-memory.dmp

Filesize
84KB

Download
memory/3148-18-0x0000000001070000-0x0000000001085000-memory.dmp

Filesize
84KB

Download
memory/3148-10-0x0000000001070000-0x0000000001085000-memory.dmp

Filesize
84KB

Download
memory/3148-20-0x0000000001070000-0x0000000001085000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads