tofsee | 583bcd9cc37ac2f4d3f3c1c8133b3b843e851e7fba456bd189eef7090ba549f0

Analysis

max time kernel
150s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 20:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b68da54fb8d64c5af84fceba0260579.exe
Size

10.3MB
MD5

3b68da54fb8d64c5af84fceba0260579
SHA1

accad1d4fc3dc24f172ae9530acfaaf537d7491e
SHA256

583bcd9cc37ac2f4d3f3c1c8133b3b843e851e7fba456bd189eef7090ba549f0
SHA512

b98d7ec7c19c67ddd11eda0c2b1fd903008b7535a23bc86129797a0a7bea1f0cb747cfa2e8b87c5386bbb0f50ecb93bcbddc717d875896c12bf7bbece07540ff
SSDEEP

49152:4RBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBf:

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

43.231.4.6

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\dhraicgu = "0"	svchost.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
2844	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\dhraicgu\ImagePath = "C:\\Windows\\SysWOW64\\dhraicgu\\ysuxqpp.exe"	svchost.exe

Deletes itself 1 IoCs

pid	Process
2596	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2932	ysuxqpp.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2932 set thread context of 2596	2932	ysuxqpp.exe	41

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2768	sc.exe
2996	sc.exe
1952	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2116	2108	3b68da54fb8d64c5af84fceba0260579.exe	28
PID 2108 wrote to memory of 2116	2108	3b68da54fb8d64c5af84fceba0260579.exe	28
PID 2108 wrote to memory of 2116	2108	3b68da54fb8d64c5af84fceba0260579.exe	28
PID 2108 wrote to memory of 2116	2108	3b68da54fb8d64c5af84fceba0260579.exe	28
PID 2108 wrote to memory of 1944	2108	3b68da54fb8d64c5af84fceba0260579.exe	30
PID 2108 wrote to memory of 1944	2108	3b68da54fb8d64c5af84fceba0260579.exe	30
PID 2108 wrote to memory of 1944	2108	3b68da54fb8d64c5af84fceba0260579.exe	30
PID 2108 wrote to memory of 1944	2108	3b68da54fb8d64c5af84fceba0260579.exe	30
PID 2108 wrote to memory of 2768	2108	3b68da54fb8d64c5af84fceba0260579.exe	32
PID 2108 wrote to memory of 2768	2108	3b68da54fb8d64c5af84fceba0260579.exe	32
PID 2108 wrote to memory of 2768	2108	3b68da54fb8d64c5af84fceba0260579.exe	32
PID 2108 wrote to memory of 2768	2108	3b68da54fb8d64c5af84fceba0260579.exe	32
PID 2108 wrote to memory of 2996	2108	3b68da54fb8d64c5af84fceba0260579.exe	34
PID 2108 wrote to memory of 2996	2108	3b68da54fb8d64c5af84fceba0260579.exe	34
PID 2108 wrote to memory of 2996	2108	3b68da54fb8d64c5af84fceba0260579.exe	34
PID 2108 wrote to memory of 2996	2108	3b68da54fb8d64c5af84fceba0260579.exe	34
PID 2108 wrote to memory of 1952	2108	3b68da54fb8d64c5af84fceba0260579.exe	36
PID 2108 wrote to memory of 1952	2108	3b68da54fb8d64c5af84fceba0260579.exe	36
PID 2108 wrote to memory of 1952	2108	3b68da54fb8d64c5af84fceba0260579.exe	36
PID 2108 wrote to memory of 1952	2108	3b68da54fb8d64c5af84fceba0260579.exe	36
PID 2108 wrote to memory of 2844	2108	3b68da54fb8d64c5af84fceba0260579.exe	38
PID 2108 wrote to memory of 2844	2108	3b68da54fb8d64c5af84fceba0260579.exe	38
PID 2108 wrote to memory of 2844	2108	3b68da54fb8d64c5af84fceba0260579.exe	38
PID 2108 wrote to memory of 2844	2108	3b68da54fb8d64c5af84fceba0260579.exe	38
PID 2932 wrote to memory of 2596	2932	ysuxqpp.exe	41
PID 2932 wrote to memory of 2596	2932	ysuxqpp.exe	41
PID 2932 wrote to memory of 2596	2932	ysuxqpp.exe	41
PID 2932 wrote to memory of 2596	2932	ysuxqpp.exe	41
PID 2932 wrote to memory of 2596	2932	ysuxqpp.exe	41
PID 2932 wrote to memory of 2596	2932	ysuxqpp.exe	41

C:\Users\Admin\AppData\Local\Temp\3b68da54fb8d64c5af84fceba0260579.exe
"C:\Users\Admin\AppData\Local\Temp\3b68da54fb8d64c5af84fceba0260579.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\dhraicgu\
  2⤵
  PID:2116
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ysuxqpp.exe" C:\Windows\SysWOW64\dhraicgu\
  2⤵
  PID:1944
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create dhraicgu binPath= "C:\Windows\SysWOW64\dhraicgu\ysuxqpp.exe /d\"C:\Users\Admin\AppData\Local\Temp\3b68da54fb8d64c5af84fceba0260579.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:2768
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description dhraicgu "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2996
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start dhraicgu
  2⤵
  - Launches sc.exe
  PID:1952
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:2844

C:\Windows\SysWOW64\dhraicgu\ysuxqpp.exe
C:\Windows\SysWOW64\dhraicgu\ysuxqpp.exe /d"C:\Users\Admin\AppData\Local\Temp\3b68da54fb8d64c5af84fceba0260579.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Windows security bypass
  - Sets service image path in registry
  - Deletes itself
  PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ysuxqpp.exe

Filesize
13.5MB

MD5
acba291c734ab934e730a96f21860115

SHA1
cca126fce5786712448f8bd613ab157e0417065e

SHA256
7a98f25d0fe96e06d5b681843c682fcb10fd09ad069999727bffa8761d86edcd

SHA512
2b5aff3b0634d770b9d78ef772b50466f55450a8c9322669aff0e30339e118009484daabf1dda0f5b404cf1453a74b475cbe61528fad6144f313160e81d0c3f0

Download Submit
memory/2108-1-0x0000000000D50000-0x0000000000E50000-memory.dmp

Filesize
1024KB

Download
memory/2108-2-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download
memory/2108-4-0x0000000000400000-0x0000000000C0A000-memory.dmp

Filesize
8.0MB

Download
memory/2108-6-0x0000000000400000-0x0000000000C0A000-memory.dmp

Filesize
8.0MB

Download
memory/2108-7-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download
memory/2596-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2596-12-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2596-15-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2596-20-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2596-21-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2596-22-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2932-11-0x0000000000400000-0x0000000000C0A000-memory.dmp

Filesize
8.0MB

Download
memory/2932-10-0x0000000000D40000-0x0000000000E40000-memory.dmp

Filesize
1024KB

Download
memory/2932-17-0x0000000000400000-0x0000000000C0A000-memory.dmp

Filesize
8.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads