tofsee | 75065fb333a2af48312ad3db7cd379895965031f095be5220b22b732ffd8783a

Analysis

max time kernel
147s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 04:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05d7c671aacc749256eb4bff4bf6ba15.exe
Size

10.1MB
MD5

05d7c671aacc749256eb4bff4bf6ba15
SHA1

12b5be47bc40d49fed97a0ecbc61879c6527e3f7
SHA256

75065fb333a2af48312ad3db7cd379895965031f095be5220b22b732ffd8783a
SHA512

65952f6443c5972a86f8fbc714c2641f30871ddf29a3c2fe905eeb324aa46273c74889eecdb8b64b37336313c5df4ed4f421993d47f9e5938bb06018dc6b4ac2
SSDEEP

98304:QNWUlllllllllllllllllllllllllllllllllllllllllllllllllllllllllllT:GW

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\tvcwlpqj = "0"	svchost.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
2556	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\tvcwlpqj\ImagePath = "C:\\Windows\\SysWOW64\\tvcwlpqj\\kshlywff.exe"	svchost.exe

Deletes itself 1 IoCs

pid	Process
1092	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
3044	kshlywff.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3044 set thread context of 1092	3044	kshlywff.exe	43

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1096	sc.exe
2808	sc.exe
2960	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2052	3016	05d7c671aacc749256eb4bff4bf6ba15.exe	28
PID 3016 wrote to memory of 2052	3016	05d7c671aacc749256eb4bff4bf6ba15.exe	28
PID 3016 wrote to memory of 2052	3016	05d7c671aacc749256eb4bff4bf6ba15.exe	28
PID 3016 wrote to memory of 2052	3016	05d7c671aacc749256eb4bff4bf6ba15.exe	28
PID 3016 wrote to memory of 2412	3016	05d7c671aacc749256eb4bff4bf6ba15.exe	30
PID 3016 wrote to memory of 2412	3016	05d7c671aacc749256eb4bff4bf6ba15.exe	30
PID 3016 wrote to memory of 2412	3016	05d7c671aacc749256eb4bff4bf6ba15.exe	30
PID 3016 wrote to memory of 2412	3016	05d7c671aacc749256eb4bff4bf6ba15.exe	30
PID 3016 wrote to memory of 1096	3016	05d7c671aacc749256eb4bff4bf6ba15.exe	32
PID 3016 wrote to memory of 1096	3016	05d7c671aacc749256eb4bff4bf6ba15.exe	32
PID 3016 wrote to memory of 1096	3016	05d7c671aacc749256eb4bff4bf6ba15.exe	32
PID 3016 wrote to memory of 1096	3016	05d7c671aacc749256eb4bff4bf6ba15.exe	32
PID 3016 wrote to memory of 2808	3016	05d7c671aacc749256eb4bff4bf6ba15.exe	34
PID 3016 wrote to memory of 2808	3016	05d7c671aacc749256eb4bff4bf6ba15.exe	34
PID 3016 wrote to memory of 2808	3016	05d7c671aacc749256eb4bff4bf6ba15.exe	34
PID 3016 wrote to memory of 2808	3016	05d7c671aacc749256eb4bff4bf6ba15.exe	34
PID 3016 wrote to memory of 2960	3016	05d7c671aacc749256eb4bff4bf6ba15.exe	36
PID 3016 wrote to memory of 2960	3016	05d7c671aacc749256eb4bff4bf6ba15.exe	36
PID 3016 wrote to memory of 2960	3016	05d7c671aacc749256eb4bff4bf6ba15.exe	36
PID 3016 wrote to memory of 2960	3016	05d7c671aacc749256eb4bff4bf6ba15.exe	36
PID 3016 wrote to memory of 2556	3016	05d7c671aacc749256eb4bff4bf6ba15.exe	39
PID 3016 wrote to memory of 2556	3016	05d7c671aacc749256eb4bff4bf6ba15.exe	39
PID 3016 wrote to memory of 2556	3016	05d7c671aacc749256eb4bff4bf6ba15.exe	39
PID 3016 wrote to memory of 2556	3016	05d7c671aacc749256eb4bff4bf6ba15.exe	39
PID 3044 wrote to memory of 1092	3044	kshlywff.exe	43
PID 3044 wrote to memory of 1092	3044	kshlywff.exe	43
PID 3044 wrote to memory of 1092	3044	kshlywff.exe	43
PID 3044 wrote to memory of 1092	3044	kshlywff.exe	43
PID 3044 wrote to memory of 1092	3044	kshlywff.exe	43
PID 3044 wrote to memory of 1092	3044	kshlywff.exe	43

C:\Users\Admin\AppData\Local\Temp\05d7c671aacc749256eb4bff4bf6ba15.exe
"C:\Users\Admin\AppData\Local\Temp\05d7c671aacc749256eb4bff4bf6ba15.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\tvcwlpqj\
  2⤵
  PID:2052
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\kshlywff.exe" C:\Windows\SysWOW64\tvcwlpqj\
  2⤵
  PID:2412
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create tvcwlpqj binPath= "C:\Windows\SysWOW64\tvcwlpqj\kshlywff.exe /d\"C:\Users\Admin\AppData\Local\Temp\05d7c671aacc749256eb4bff4bf6ba15.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:1096
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description tvcwlpqj "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2808
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start tvcwlpqj
  2⤵
  - Launches sc.exe
  PID:2960
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:2556

C:\Windows\SysWOW64\tvcwlpqj\kshlywff.exe
C:\Windows\SysWOW64\tvcwlpqj\kshlywff.exe /d"C:\Users\Admin\AppData\Local\Temp\05d7c671aacc749256eb4bff4bf6ba15.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Windows security bypass
  - Sets service image path in registry
  - Deletes itself
  PID:1092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\kshlywff.exe

Filesize
1.7MB

MD5
972fe42fb630e27d0b89dbee72dd8ded

SHA1
13fedf2d59e06904125e0e0b440717fc8ba19893

SHA256
f71a970c5b530d31b44a9623f2fb270084a74eacce08dfe0a4db60278bce8be7

SHA512
3146eec89e85a1344f4173ba853475b87920b6688c401ff0306a35bac9fa73f2b051aa22c61dd94ba6fa7ea59dee629c77de3e483947e4db346c861a31455c83

Download Submit
C:\Windows\SysWOW64\tvcwlpqj\kshlywff.exe

Filesize
2.1MB

MD5
76929e7b2665b1ca235909979cfc1e3a

SHA1
a3615474361e853225975939ed926e6060969a13

SHA256
7920111c1f91d6a7fb01c161250ce9533e6bd7ebf6dd15e0c11b6285ac826098

SHA512
6ae8e9cf30db630e3d1fa3dc0f79e51998b6e51e20583ec15566cd492890522ba3df409a16abbf407f22f3d2d7e938511be7ba4e309ba70a439da8fb5923bc68

Download Submit
memory/1092-20-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/1092-11-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/1092-22-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/1092-21-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/1092-14-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/1092-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3016-2-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download
memory/3016-4-0x0000000000400000-0x00000000036CD000-memory.dmp

Filesize
50.8MB

Download
memory/3016-1-0x0000000003850000-0x0000000003950000-memory.dmp

Filesize
1024KB

Download
memory/3016-7-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download
memory/3016-6-0x0000000000400000-0x00000000036CD000-memory.dmp

Filesize
50.8MB

Download
memory/3044-10-0x0000000003810000-0x0000000003910000-memory.dmp

Filesize
1024KB

Download
memory/3044-18-0x0000000000400000-0x00000000036CD000-memory.dmp

Filesize
50.8MB

Download
memory/3044-16-0x0000000000400000-0x00000000036CD000-memory.dmp

Filesize
50.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads