tofsee | edc33c685f68473b04437e57c35ffe2d36dfc1b97650967a3539881c9a965674

Analysis

max time kernel
144s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 06:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09f341b43df77122f98f43c77c8cc745.exe
Size

12.5MB
MD5

09f341b43df77122f98f43c77c8cc745
SHA1

51c8e35f4a04fd5cf79be86747da71cd8724eb08
SHA256

edc33c685f68473b04437e57c35ffe2d36dfc1b97650967a3539881c9a965674
SHA512

521850f7cff134b4f1c0e1d021cf3440b6d70727fd219b05f02fc531f39c77490be47fc7ed5279d213a6193f591011cbca68f3dd367e268cfb398cd79263d499
SSDEEP

6144:92BxZXDssssssssssssssssssssssssssssssssssssssssssssssssssssssss8:94V

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\itfcjcdy = "0"	svchost.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
2620	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\itfcjcdy\ImagePath = "C:\\Windows\\SysWOW64\\itfcjcdy\\yuouacul.exe"	svchost.exe

Deletes itself 1 IoCs

pid	Process
2596	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2728	yuouacul.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2728 set thread context of 2596	2728	yuouacul.exe	41

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2752	sc.exe
2800	sc.exe
2816	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 356 wrote to memory of 2640	356	09f341b43df77122f98f43c77c8cc745.exe	21
PID 356 wrote to memory of 2640	356	09f341b43df77122f98f43c77c8cc745.exe	21
PID 356 wrote to memory of 2640	356	09f341b43df77122f98f43c77c8cc745.exe	21
PID 356 wrote to memory of 2640	356	09f341b43df77122f98f43c77c8cc745.exe	21
PID 356 wrote to memory of 2484	356	09f341b43df77122f98f43c77c8cc745.exe	31
PID 356 wrote to memory of 2484	356	09f341b43df77122f98f43c77c8cc745.exe	31
PID 356 wrote to memory of 2484	356	09f341b43df77122f98f43c77c8cc745.exe	31
PID 356 wrote to memory of 2484	356	09f341b43df77122f98f43c77c8cc745.exe	31
PID 356 wrote to memory of 2752	356	09f341b43df77122f98f43c77c8cc745.exe	33
PID 356 wrote to memory of 2752	356	09f341b43df77122f98f43c77c8cc745.exe	33
PID 356 wrote to memory of 2752	356	09f341b43df77122f98f43c77c8cc745.exe	33
PID 356 wrote to memory of 2752	356	09f341b43df77122f98f43c77c8cc745.exe	33
PID 356 wrote to memory of 2800	356	09f341b43df77122f98f43c77c8cc745.exe	35
PID 356 wrote to memory of 2800	356	09f341b43df77122f98f43c77c8cc745.exe	35
PID 356 wrote to memory of 2800	356	09f341b43df77122f98f43c77c8cc745.exe	35
PID 356 wrote to memory of 2800	356	09f341b43df77122f98f43c77c8cc745.exe	35
PID 356 wrote to memory of 2816	356	09f341b43df77122f98f43c77c8cc745.exe	37
PID 356 wrote to memory of 2816	356	09f341b43df77122f98f43c77c8cc745.exe	37
PID 356 wrote to memory of 2816	356	09f341b43df77122f98f43c77c8cc745.exe	37
PID 356 wrote to memory of 2816	356	09f341b43df77122f98f43c77c8cc745.exe	37
PID 2728 wrote to memory of 2596	2728	yuouacul.exe	41
PID 2728 wrote to memory of 2596	2728	yuouacul.exe	41
PID 2728 wrote to memory of 2596	2728	yuouacul.exe	41
PID 2728 wrote to memory of 2596	2728	yuouacul.exe	41
PID 2728 wrote to memory of 2596	2728	yuouacul.exe	41
PID 2728 wrote to memory of 2596	2728	yuouacul.exe	41
PID 356 wrote to memory of 2620	356	09f341b43df77122f98f43c77c8cc745.exe	40
PID 356 wrote to memory of 2620	356	09f341b43df77122f98f43c77c8cc745.exe	40
PID 356 wrote to memory of 2620	356	09f341b43df77122f98f43c77c8cc745.exe	40
PID 356 wrote to memory of 2620	356	09f341b43df77122f98f43c77c8cc745.exe	40

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\itfcjcdy\
1⤵
PID:2640

C:\Users\Admin\AppData\Local\Temp\09f341b43df77122f98f43c77c8cc745.exe
"C:\Users\Admin\AppData\Local\Temp\09f341b43df77122f98f43c77c8cc745.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:356
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\yuouacul.exe" C:\Windows\SysWOW64\itfcjcdy\
  2⤵
  PID:2484
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create itfcjcdy binPath= "C:\Windows\SysWOW64\itfcjcdy\yuouacul.exe /d\"C:\Users\Admin\AppData\Local\Temp\09f341b43df77122f98f43c77c8cc745.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:2752
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description itfcjcdy "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2800
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start itfcjcdy
  2⤵
  - Launches sc.exe
  PID:2816
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:2620

C:\Windows\SysWOW64\itfcjcdy\yuouacul.exe
C:\Windows\SysWOW64\itfcjcdy\yuouacul.exe /d"C:\Users\Admin\AppData\Local\Temp\09f341b43df77122f98f43c77c8cc745.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Windows security bypass
  - Sets service image path in registry
  - Deletes itself
  PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\yuouacul.exe

Filesize
1.1MB

MD5
3a55287047db9b2900bf1c94f9479bf4

SHA1
01078254c2acc92ff1cc5b765f02e752a63adbb9

SHA256
af0b7781f6450a69465ac829ac21ed934a57fa24fe68eb50d68e4161531731d5

SHA512
0ea4c3c570c68500878b350667ddb534d069aa2c2f6f732fe1cd23ce396eab8f24e1dd64f6de38bf15aecbc3e01e7a2aeed95b1cdd654a061af5c91e7084448f

Download Submit
C:\Windows\SysWOW64\itfcjcdy\yuouacul.exe

Filesize
1.4MB

MD5
2103fac1e8f4b241ecb4b78f5e7e64de

SHA1
aad247f04e5a7956b1bd52d95552a2803f074b1b

SHA256
e0a253ec7a62f57a3bb35be35f3dfdecbe3a505816d43017e29a3e735dd6b166

SHA512
67da3a12873a676e6d0e11111aeff623a765813296f6c2a76d9c2411c4d7d0faa7eab4bda189ad6a8b585076e5612fecb3e7e01c9dde193748576bbbb8270bc3

Download Submit
memory/356-15-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/356-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/356-2-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/356-1-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2596-14-0x00000000000D0000-0x00000000000E5000-memory.dmp

Filesize
84KB

Download
memory/2596-10-0x00000000000D0000-0x00000000000E5000-memory.dmp

Filesize
84KB

Download
memory/2596-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2596-7-0x00000000000D0000-0x00000000000E5000-memory.dmp

Filesize
84KB

Download
memory/2596-16-0x00000000000D0000-0x00000000000E5000-memory.dmp

Filesize
84KB

Download
memory/2596-17-0x00000000000D0000-0x00000000000E5000-memory.dmp

Filesize
84KB

Download
memory/2596-18-0x00000000000D0000-0x00000000000E5000-memory.dmp

Filesize
84KB

Download
memory/2728-12-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads