tofsee | b4dd0c183d3d1773fa1c7d8bea616c7f1dfb88a976d3cf830e51a603d8ae2357

Analysis

max time kernel
146s
max time network
146s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 21:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ca8c8d37aaf196e64823ea50c99f31b.exe
Size

13.0MB
MD5

3ca8c8d37aaf196e64823ea50c99f31b
SHA1

77e4c78731986023345c93aae45916607be812b8
SHA256

b4dd0c183d3d1773fa1c7d8bea616c7f1dfb88a976d3cf830e51a603d8ae2357
SHA512

1ba499d0e8f3c253f4a5f16e7770150154f71809636e7967c74cc2caf1072da459c41aae6379f8e8d0d6e65f62daada99242e561fab2c25a6fa376bcb4c64709
SSDEEP

6144:IxbQq7asTdx16ifogWuQK4ZpG3XQ4L0hlDF5r:8ashxM05WewpmAljr

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

defeatwax.ru

refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\jifjooph = "0"	svchost.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
2764	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\jifjooph\ImagePath = "C:\\Windows\\SysWOW64\\jifjooph\\erndlsnx.exe"	svchost.exe

Deletes itself 1 IoCs

pid	Process
2732	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2272	erndlsnx.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2272 set thread context of 2732	2272	erndlsnx.exe	41

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2748	sc.exe
2612	sc.exe
2180	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2548	2240	3ca8c8d37aaf196e64823ea50c99f31b.exe	29
PID 2240 wrote to memory of 2548	2240	3ca8c8d37aaf196e64823ea50c99f31b.exe	29
PID 2240 wrote to memory of 2548	2240	3ca8c8d37aaf196e64823ea50c99f31b.exe	29
PID 2240 wrote to memory of 2548	2240	3ca8c8d37aaf196e64823ea50c99f31b.exe	29
PID 2240 wrote to memory of 3068	2240	3ca8c8d37aaf196e64823ea50c99f31b.exe	31
PID 2240 wrote to memory of 3068	2240	3ca8c8d37aaf196e64823ea50c99f31b.exe	31
PID 2240 wrote to memory of 3068	2240	3ca8c8d37aaf196e64823ea50c99f31b.exe	31
PID 2240 wrote to memory of 3068	2240	3ca8c8d37aaf196e64823ea50c99f31b.exe	31
PID 2240 wrote to memory of 2180	2240	3ca8c8d37aaf196e64823ea50c99f31b.exe	33
PID 2240 wrote to memory of 2180	2240	3ca8c8d37aaf196e64823ea50c99f31b.exe	33
PID 2240 wrote to memory of 2180	2240	3ca8c8d37aaf196e64823ea50c99f31b.exe	33
PID 2240 wrote to memory of 2180	2240	3ca8c8d37aaf196e64823ea50c99f31b.exe	33
PID 2240 wrote to memory of 2748	2240	3ca8c8d37aaf196e64823ea50c99f31b.exe	35
PID 2240 wrote to memory of 2748	2240	3ca8c8d37aaf196e64823ea50c99f31b.exe	35
PID 2240 wrote to memory of 2748	2240	3ca8c8d37aaf196e64823ea50c99f31b.exe	35
PID 2240 wrote to memory of 2748	2240	3ca8c8d37aaf196e64823ea50c99f31b.exe	35
PID 2240 wrote to memory of 2612	2240	3ca8c8d37aaf196e64823ea50c99f31b.exe	38
PID 2240 wrote to memory of 2612	2240	3ca8c8d37aaf196e64823ea50c99f31b.exe	38
PID 2240 wrote to memory of 2612	2240	3ca8c8d37aaf196e64823ea50c99f31b.exe	38
PID 2240 wrote to memory of 2612	2240	3ca8c8d37aaf196e64823ea50c99f31b.exe	38
PID 2240 wrote to memory of 2764	2240	3ca8c8d37aaf196e64823ea50c99f31b.exe	40
PID 2240 wrote to memory of 2764	2240	3ca8c8d37aaf196e64823ea50c99f31b.exe	40
PID 2240 wrote to memory of 2764	2240	3ca8c8d37aaf196e64823ea50c99f31b.exe	40
PID 2240 wrote to memory of 2764	2240	3ca8c8d37aaf196e64823ea50c99f31b.exe	40
PID 2272 wrote to memory of 2732	2272	erndlsnx.exe	41
PID 2272 wrote to memory of 2732	2272	erndlsnx.exe	41
PID 2272 wrote to memory of 2732	2272	erndlsnx.exe	41
PID 2272 wrote to memory of 2732	2272	erndlsnx.exe	41
PID 2272 wrote to memory of 2732	2272	erndlsnx.exe	41
PID 2272 wrote to memory of 2732	2272	erndlsnx.exe	41

C:\Users\Admin\AppData\Local\Temp\3ca8c8d37aaf196e64823ea50c99f31b.exe
"C:\Users\Admin\AppData\Local\Temp\3ca8c8d37aaf196e64823ea50c99f31b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\jifjooph\
  2⤵
  PID:2548
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\erndlsnx.exe" C:\Windows\SysWOW64\jifjooph\
  2⤵
  PID:3068
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create jifjooph binPath= "C:\Windows\SysWOW64\jifjooph\erndlsnx.exe /d\"C:\Users\Admin\AppData\Local\Temp\3ca8c8d37aaf196e64823ea50c99f31b.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:2180
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description jifjooph "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2748
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start jifjooph
  2⤵
  - Launches sc.exe
  PID:2612
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:2764

C:\Windows\SysWOW64\jifjooph\erndlsnx.exe
C:\Windows\SysWOW64\jifjooph\erndlsnx.exe /d"C:\Users\Admin\AppData\Local\Temp\3ca8c8d37aaf196e64823ea50c99f31b.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Windows security bypass
  - Sets service image path in registry
  - Deletes itself
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\erndlsnx.exe

Filesize
93KB

MD5
fe5b1ccd1e0c1f3b9be934e71bb821d6

SHA1
8a420935b8241efa637f10643d1ae62b742f70ed

SHA256
5b7a28c253c833bf87f2698361ddd113c087717556cfc57f18a637a4b1fd8a14

SHA512
a3bbd0056bc2043eb355673d8aa87e9e47d622612a84e34a2d916f816e12649aa5d62574c42a607e3adab3c47218c953f69a86f39294a08d8daeff3ca51a3e4e

Download Submit
memory/2240-2-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download
memory/2240-1-0x00000000005A0000-0x00000000006A0000-memory.dmp

Filesize
1024KB

Download
memory/2240-9-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download
memory/2240-8-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2240-3-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2272-16-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2272-10-0x0000000000290000-0x0000000000390000-memory.dmp

Filesize
1024KB

Download
memory/2272-12-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2732-20-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2732-19-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2732-15-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2732-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2732-21-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2732-11-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2732-22-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads