tofsee | 64ebbff5b114f374a5ea408f1970dad3b57de201a00eab43eacf0c6637984698

Analysis

max time kernel
149s
max time network
185s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 06:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5864ab38a798ad82f56c489fc9250508.exe
Size

10.8MB
MD5

5864ab38a798ad82f56c489fc9250508
SHA1

36654bbcd99a23208bd05849094cce2660d49b85
SHA256

64ebbff5b114f374a5ea408f1970dad3b57de201a00eab43eacf0c6637984698
SHA512

9aaa11aee25e1a4cb06c2ee32970c33476f27ad1729e76404d252a8453d8de870eec90dc00fafe7b35646467be31a3e0a4686b4a2c93dcc938d1d3a80ba479a4
SSDEEP

49152:wRBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB/:

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

43.231.4.6

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\tqygftmg = "0"	svchost.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
2912	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\tqygftmg\ImagePath = "C:\\Windows\\SysWOW64\\tqygftmg\\dmbwihoy.exe"	svchost.exe

Deletes itself 1 IoCs

pid	Process
2712	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2944	dmbwihoy.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2944 set thread context of 2712	2944	dmbwihoy.exe	43

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2576	sc.exe
2228	sc.exe
2480	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2908	2968	5864ab38a798ad82f56c489fc9250508.exe	30
PID 2968 wrote to memory of 2908	2968	5864ab38a798ad82f56c489fc9250508.exe	30
PID 2968 wrote to memory of 2908	2968	5864ab38a798ad82f56c489fc9250508.exe	30
PID 2968 wrote to memory of 2908	2968	5864ab38a798ad82f56c489fc9250508.exe	30
PID 2968 wrote to memory of 2588	2968	5864ab38a798ad82f56c489fc9250508.exe	32
PID 2968 wrote to memory of 2588	2968	5864ab38a798ad82f56c489fc9250508.exe	32
PID 2968 wrote to memory of 2588	2968	5864ab38a798ad82f56c489fc9250508.exe	32
PID 2968 wrote to memory of 2588	2968	5864ab38a798ad82f56c489fc9250508.exe	32
PID 2968 wrote to memory of 2576	2968	5864ab38a798ad82f56c489fc9250508.exe	35
PID 2968 wrote to memory of 2576	2968	5864ab38a798ad82f56c489fc9250508.exe	35
PID 2968 wrote to memory of 2576	2968	5864ab38a798ad82f56c489fc9250508.exe	35
PID 2968 wrote to memory of 2576	2968	5864ab38a798ad82f56c489fc9250508.exe	35
PID 2968 wrote to memory of 2228	2968	5864ab38a798ad82f56c489fc9250508.exe	36
PID 2968 wrote to memory of 2228	2968	5864ab38a798ad82f56c489fc9250508.exe	36
PID 2968 wrote to memory of 2228	2968	5864ab38a798ad82f56c489fc9250508.exe	36
PID 2968 wrote to memory of 2228	2968	5864ab38a798ad82f56c489fc9250508.exe	36
PID 2968 wrote to memory of 2480	2968	5864ab38a798ad82f56c489fc9250508.exe	38
PID 2968 wrote to memory of 2480	2968	5864ab38a798ad82f56c489fc9250508.exe	38
PID 2968 wrote to memory of 2480	2968	5864ab38a798ad82f56c489fc9250508.exe	38
PID 2968 wrote to memory of 2480	2968	5864ab38a798ad82f56c489fc9250508.exe	38
PID 2968 wrote to memory of 2912	2968	5864ab38a798ad82f56c489fc9250508.exe	40
PID 2968 wrote to memory of 2912	2968	5864ab38a798ad82f56c489fc9250508.exe	40
PID 2968 wrote to memory of 2912	2968	5864ab38a798ad82f56c489fc9250508.exe	40
PID 2968 wrote to memory of 2912	2968	5864ab38a798ad82f56c489fc9250508.exe	40
PID 2944 wrote to memory of 2712	2944	dmbwihoy.exe	43
PID 2944 wrote to memory of 2712	2944	dmbwihoy.exe	43
PID 2944 wrote to memory of 2712	2944	dmbwihoy.exe	43
PID 2944 wrote to memory of 2712	2944	dmbwihoy.exe	43
PID 2944 wrote to memory of 2712	2944	dmbwihoy.exe	43
PID 2944 wrote to memory of 2712	2944	dmbwihoy.exe	43

C:\Users\Admin\AppData\Local\Temp\5864ab38a798ad82f56c489fc9250508.exe
"C:\Users\Admin\AppData\Local\Temp\5864ab38a798ad82f56c489fc9250508.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\tqygftmg\
  2⤵
  PID:2908
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\dmbwihoy.exe" C:\Windows\SysWOW64\tqygftmg\
  2⤵
  PID:2588
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create tqygftmg binPath= "C:\Windows\SysWOW64\tqygftmg\dmbwihoy.exe /d\"C:\Users\Admin\AppData\Local\Temp\5864ab38a798ad82f56c489fc9250508.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:2576
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description tqygftmg "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2228
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start tqygftmg
  2⤵
  - Launches sc.exe
  PID:2480
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:2912

C:\Windows\SysWOW64\tqygftmg\dmbwihoy.exe
C:\Windows\SysWOW64\tqygftmg\dmbwihoy.exe /d"C:\Users\Admin\AppData\Local\Temp\5864ab38a798ad82f56c489fc9250508.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Windows security bypass
  - Sets service image path in registry
  - Deletes itself
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dmbwihoy.exe

Filesize
425KB

MD5
b13f88d12c42b3b47d446cecc6919bb1

SHA1
f277c5dd4b2d03d6c0b7b7171447f511d11d60c3

SHA256
00bc93bb303800bda75b2cdbb69b18a7b48c075e3e93ede76b8c222f7f073790

SHA512
9d4e61c55102fd75798d1dcfbf9727337f99b40a7fb780fd4fe3cf48ddb42dc6ce176a60b18041d7d752b16fa0c206e0b36b8a34add0f19cc88bc7547b2b38e4

Download Submit
C:\Windows\SysWOW64\tqygftmg\dmbwihoy.exe

Filesize
213KB

MD5
7edb3c1f908239f5ba29227de8047961

SHA1
b0159499ddf3f6487d21f5682eba666500cf3f55

SHA256
ec82ff175a703cea197f1826a78f4759543d98577e2928ced5ee08c0e16b735f

SHA512
8bc1a6c1b6f41029eb0694454bffbc0ee0c488077d407ec47f7abbfea2fe363e4bd08204ab00a8d613adb00dd607c8dab4a285c279ab47e9ff5785d22011b8b7

Download Submit
memory/2712-21-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2712-22-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2712-24-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2712-13-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2712-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2712-23-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2712-17-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2944-19-0x0000000000400000-0x0000000000C0A000-memory.dmp

Filesize
8.0MB

Download
memory/2944-12-0x0000000000CD0000-0x0000000000DD0000-memory.dmp

Filesize
1024KB

Download
memory/2944-14-0x0000000000400000-0x0000000000C0A000-memory.dmp

Filesize
8.0MB

Download
memory/2968-4-0x0000000000400000-0x0000000000C0A000-memory.dmp

Filesize
8.0MB

Download
memory/2968-3-0x0000000000400000-0x0000000000C0A000-memory.dmp

Filesize
8.0MB

Download
memory/2968-1-0x0000000001070000-0x0000000001170000-memory.dmp

Filesize
1024KB

Download
memory/2968-9-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download
memory/2968-8-0x0000000000400000-0x0000000000C0A000-memory.dmp

Filesize
8.0MB

Download
memory/2968-7-0x0000000000400000-0x0000000000C0A000-memory.dmp

Filesize
8.0MB

Download
memory/2968-2-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads