tofsee | 583bcd9cc37ac2f4d3f3c1c8133b3b843e851e7fba456bd189eef7090ba549f0

General

Target

3b68da54fb8d64c5af84fceba0260579.exe
Size

10.3MB
MD5

3b68da54fb8d64c5af84fceba0260579
SHA1

accad1d4fc3dc24f172ae9530acfaaf537d7491e
SHA256

583bcd9cc37ac2f4d3f3c1c8133b3b843e851e7fba456bd189eef7090ba549f0
SHA512

b98d7ec7c19c67ddd11eda0c2b1fd903008b7535a23bc86129797a0a7bea1f0cb747cfa2e8b87c5386bbb0f50ecb93bcbddc717d875896c12bf7bbece07540ff
SSDEEP

49152:4RBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBf:

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.6

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
4488	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\qpcttlno\ImagePath = "C:\\Windows\\SysWOW64\\qpcttlno\\noqrlojb.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	3b68da54fb8d64c5af84fceba0260579.exe

Deletes itself 1 IoCs

pid	Process
4000	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
1932	noqrlojb.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1932 set thread context of 4000	1932	noqrlojb.exe	111

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1180	sc.exe
4940	sc.exe
2740	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3612	1932	WerFault.exe	107
2372	2696	WerFault.exe	90

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 380	2696	3b68da54fb8d64c5af84fceba0260579.exe	97
PID 2696 wrote to memory of 380	2696	3b68da54fb8d64c5af84fceba0260579.exe	97
PID 2696 wrote to memory of 380	2696	3b68da54fb8d64c5af84fceba0260579.exe	97
PID 2696 wrote to memory of 1480	2696	3b68da54fb8d64c5af84fceba0260579.exe	99
PID 2696 wrote to memory of 1480	2696	3b68da54fb8d64c5af84fceba0260579.exe	99
PID 2696 wrote to memory of 1480	2696	3b68da54fb8d64c5af84fceba0260579.exe	99
PID 2696 wrote to memory of 1180	2696	3b68da54fb8d64c5af84fceba0260579.exe	119
PID 2696 wrote to memory of 1180	2696	3b68da54fb8d64c5af84fceba0260579.exe	119
PID 2696 wrote to memory of 1180	2696	3b68da54fb8d64c5af84fceba0260579.exe	119
PID 2696 wrote to memory of 4940	2696	3b68da54fb8d64c5af84fceba0260579.exe	104
PID 2696 wrote to memory of 4940	2696	3b68da54fb8d64c5af84fceba0260579.exe	104
PID 2696 wrote to memory of 4940	2696	3b68da54fb8d64c5af84fceba0260579.exe	104
PID 2696 wrote to memory of 2740	2696	3b68da54fb8d64c5af84fceba0260579.exe	105
PID 2696 wrote to memory of 2740	2696	3b68da54fb8d64c5af84fceba0260579.exe	105
PID 2696 wrote to memory of 2740	2696	3b68da54fb8d64c5af84fceba0260579.exe	105
PID 2696 wrote to memory of 4488	2696	3b68da54fb8d64c5af84fceba0260579.exe	110
PID 2696 wrote to memory of 4488	2696	3b68da54fb8d64c5af84fceba0260579.exe	110
PID 2696 wrote to memory of 4488	2696	3b68da54fb8d64c5af84fceba0260579.exe	110
PID 1932 wrote to memory of 4000	1932	noqrlojb.exe	111
PID 1932 wrote to memory of 4000	1932	noqrlojb.exe	111
PID 1932 wrote to memory of 4000	1932	noqrlojb.exe	111
PID 1932 wrote to memory of 4000	1932	noqrlojb.exe	111
PID 1932 wrote to memory of 4000	1932	noqrlojb.exe	111

C:\Users\Admin\AppData\Local\Temp\3b68da54fb8d64c5af84fceba0260579.exe
"C:\Users\Admin\AppData\Local\Temp\3b68da54fb8d64c5af84fceba0260579.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\qpcttlno\
  2⤵
  PID:380
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\noqrlojb.exe" C:\Windows\SysWOW64\qpcttlno\
  2⤵
  PID:1480
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create qpcttlno binPath= "C:\Windows\SysWOW64\qpcttlno\noqrlojb.exe /d\"C:\Users\Admin\AppData\Local\Temp\3b68da54fb8d64c5af84fceba0260579.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:1180
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description qpcttlno "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:4940
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start qpcttlno
  2⤵
  - Launches sc.exe
  PID:2740
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:4488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 1036
  2⤵
  - Program crash
  PID:2372

C:\Windows\SysWOW64\qpcttlno\noqrlojb.exe
C:\Windows\SysWOW64\qpcttlno\noqrlojb.exe /d"C:\Users\Admin\AppData\Local\Temp\3b68da54fb8d64c5af84fceba0260579.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  PID:4000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 528
  2⤵
  - Program crash
  PID:3612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1932 -ip 1932
1⤵
PID:4712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2696 -ip 2696
1⤵
PID:4784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:1180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\noqrlojb.exe

Filesize
1.2MB

MD5
4648a81817b0200dab4ca66912454789

SHA1
1a788c977d99be4096e945d9bc2c96f9946caee5

SHA256
5480b701ad409e59b772b561f444420b7d47c77c1621a0a397b4838b32e3aeef

SHA512
77c54300879533c2cfc087989aa6ddcd16441926f9abe958f96ab186391374719c38817916dd94346c59f5c2a579090226cd53926ab4f23c7282698f4aeb29da

Download Submit
C:\Windows\SysWOW64\qpcttlno\noqrlojb.exe

Filesize
543KB

MD5
29232fa1a489d120089a98ab8a214cad

SHA1
dabab03e0636c376670642e4e20ab19186a2bb90

SHA256
c7e419c5cd1846420ea1df43f5de32fa079793e523a979798d3ce0ce06f30c4f

SHA512
1887cecf1243aaa75b88235cf4469a30efcf7e3aded70af66ae5e3e37082b9138d778057481103197284d79d7fc58500f516fd57aa88d87cb785e11630734d95

Download Submit
memory/1932-11-0x0000000000400000-0x0000000000C0A000-memory.dmp

Filesize
8.0MB

Download
memory/1932-9-0x0000000000E50000-0x0000000000F50000-memory.dmp

Filesize
1024KB

Download
memory/1932-18-0x0000000000400000-0x0000000000C0A000-memory.dmp

Filesize
8.0MB

Download
memory/1932-13-0x0000000000400000-0x0000000000C0A000-memory.dmp

Filesize
8.0MB

Download
memory/1932-10-0x00000000014E0000-0x00000000014F3000-memory.dmp

Filesize
76KB

Download
memory/2696-12-0x0000000000400000-0x0000000000C0A000-memory.dmp

Filesize
8.0MB

Download
memory/2696-1-0x0000000000F30000-0x0000000001030000-memory.dmp

Filesize
1024KB

Download
memory/2696-5-0x0000000000400000-0x0000000000C0A000-memory.dmp

Filesize
8.0MB

Download
memory/2696-2-0x0000000000EC0000-0x0000000000ED3000-memory.dmp

Filesize
76KB

Download
memory/2696-3-0x0000000000400000-0x0000000000C0A000-memory.dmp

Filesize
8.0MB

Download
memory/4000-14-0x0000000001210000-0x0000000001225000-memory.dmp

Filesize
84KB

Download
memory/4000-17-0x0000000001210000-0x0000000001225000-memory.dmp

Filesize
84KB

Download
memory/4000-20-0x0000000001210000-0x0000000001225000-memory.dmp

Filesize
84KB

Download
memory/4000-21-0x0000000001210000-0x0000000001225000-memory.dmp

Filesize
84KB

Download
memory/4000-22-0x0000000001210000-0x0000000001225000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads