tofsee | 75065fb333a2af48312ad3db7cd379895965031f095be5220b22b732ffd8783a

Analysis

max time kernel
3s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 04:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05d7c671aacc749256eb4bff4bf6ba15.exe
Size

10.1MB
MD5

05d7c671aacc749256eb4bff4bf6ba15
SHA1

12b5be47bc40d49fed97a0ecbc61879c6527e3f7
SHA256

75065fb333a2af48312ad3db7cd379895965031f095be5220b22b732ffd8783a
SHA512

65952f6443c5972a86f8fbc714c2641f30871ddf29a3c2fe905eeb324aa46273c74889eecdb8b64b37336313c5df4ed4f421993d47f9e5938bb06018dc6b4ac2
SSDEEP

98304:QNWUlllllllllllllllllllllllllllllllllllllllllllllllllllllllllllT:GW

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
4776	netsh.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4808	sc.exe
336	sc.exe
1460	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\05d7c671aacc749256eb4bff4bf6ba15.exe
"C:\Users\Admin\AppData\Local\Temp\05d7c671aacc749256eb4bff4bf6ba15.exe"
1⤵
PID:1712
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\wbxuzudv\
  2⤵
  PID:4444
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\qynrecll.exe" C:\Windows\SysWOW64\wbxuzudv\
  2⤵
  PID:2872
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create wbxuzudv binPath= "C:\Windows\SysWOW64\wbxuzudv\qynrecll.exe /d\"C:\Users\Admin\AppData\Local\Temp\05d7c671aacc749256eb4bff4bf6ba15.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:4808
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description wbxuzudv "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:336
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start wbxuzudv
  2⤵
  - Launches sc.exe
  PID:1460
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:4776

C:\Windows\SysWOW64\wbxuzudv\qynrecll.exe
C:\Windows\SysWOW64\wbxuzudv\qynrecll.exe /d"C:\Users\Admin\AppData\Local\Temp\05d7c671aacc749256eb4bff4bf6ba15.exe"
1⤵
PID:2392
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:3608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\wbxuzudv\qynrecll.exe

Filesize
93KB

MD5
1e94284c7003656c8ff129cc0e3ee1db

SHA1
8d1c6d349f00973abdfed8b664392e2ea3d12e6d

SHA256
4c27b78d50d3c9f9ac5ee0b66824719677cf2168acacf224ae3800a7cec6ef43

SHA512
5c56e0fa0cc1ba70b357350aa6d354525c8bcb3d7c9948177a29bf6c3c0c67767f3e3b2adb888c557f171d9d6a50021db171bc432073e9c9c897282714c8bf22

Download Submit
memory/1712-7-0x0000000000400000-0x00000000036CD000-memory.dmp

Filesize
50.8MB

Download
memory/1712-4-0x0000000000400000-0x00000000036CD000-memory.dmp

Filesize
50.8MB

Download
memory/1712-1-0x0000000003920000-0x0000000003A20000-memory.dmp

Filesize
1024KB

Download
memory/1712-8-0x0000000005410000-0x0000000005423000-memory.dmp

Filesize
76KB

Download
memory/1712-2-0x0000000005410000-0x0000000005423000-memory.dmp

Filesize
76KB

Download
memory/2392-10-0x0000000003930000-0x0000000003A30000-memory.dmp

Filesize
1024KB

Download
memory/2392-15-0x0000000000400000-0x00000000036CD000-memory.dmp

Filesize
50.8MB

Download
memory/2392-16-0x0000000000400000-0x00000000036CD000-memory.dmp

Filesize
50.8MB

Download
memory/3608-11-0x0000000000F60000-0x0000000000F75000-memory.dmp

Filesize
84KB

Download
memory/3608-14-0x0000000000F60000-0x0000000000F75000-memory.dmp

Filesize
84KB

Download
memory/3608-17-0x0000000000F60000-0x0000000000F75000-memory.dmp

Filesize
84KB

Download
memory/3608-18-0x0000000000F60000-0x0000000000F75000-memory.dmp

Filesize
84KB

Download
memory/3608-19-0x0000000000F60000-0x0000000000F75000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads