tofsee | 072ff816b2373bd6ab07298e3653d98c84b6a897ef17fc8002873edd9dff7e2e

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 11:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69ea6c1bae15f0e9a51c6d7645b92119.exe
Size

13.0MB
MD5

69ea6c1bae15f0e9a51c6d7645b92119
SHA1

889d92a7c1728764aaa5d54cc134a113647f16b4
SHA256

072ff816b2373bd6ab07298e3653d98c84b6a897ef17fc8002873edd9dff7e2e
SHA512

51688cea0e7b75febda3617850401ae1813603fc543d96c67adb7ea08c5f470192dd25086ab8a30087dc32356171b6c8e5d48c3aaaefc80402826e33a376505c
SSDEEP

24576:bgdy5yNM4444444444444444444444444444444444444444444444444444444g:

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

defeatwax.ru

refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\lklquizg = "0"	svchost.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
3020	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\lklquizg\ImagePath = "C:\\Windows\\SysWOW64\\lklquizg\\bsslbabp.exe"	svchost.exe

Deletes itself 1 IoCs

pid	Process
2092	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
3008	bsslbabp.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3008 set thread context of 2092	3008	bsslbabp.exe	41

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2792	sc.exe
2840	sc.exe
2748	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2052	2504	69ea6c1bae15f0e9a51c6d7645b92119.exe	29
PID 2504 wrote to memory of 2052	2504	69ea6c1bae15f0e9a51c6d7645b92119.exe	29
PID 2504 wrote to memory of 2052	2504	69ea6c1bae15f0e9a51c6d7645b92119.exe	29
PID 2504 wrote to memory of 2052	2504	69ea6c1bae15f0e9a51c6d7645b92119.exe	29
PID 2504 wrote to memory of 1152	2504	69ea6c1bae15f0e9a51c6d7645b92119.exe	31
PID 2504 wrote to memory of 1152	2504	69ea6c1bae15f0e9a51c6d7645b92119.exe	31
PID 2504 wrote to memory of 1152	2504	69ea6c1bae15f0e9a51c6d7645b92119.exe	31
PID 2504 wrote to memory of 1152	2504	69ea6c1bae15f0e9a51c6d7645b92119.exe	31
PID 2504 wrote to memory of 2792	2504	69ea6c1bae15f0e9a51c6d7645b92119.exe	32
PID 2504 wrote to memory of 2792	2504	69ea6c1bae15f0e9a51c6d7645b92119.exe	32
PID 2504 wrote to memory of 2792	2504	69ea6c1bae15f0e9a51c6d7645b92119.exe	32
PID 2504 wrote to memory of 2792	2504	69ea6c1bae15f0e9a51c6d7645b92119.exe	32
PID 2504 wrote to memory of 2840	2504	69ea6c1bae15f0e9a51c6d7645b92119.exe	35
PID 2504 wrote to memory of 2840	2504	69ea6c1bae15f0e9a51c6d7645b92119.exe	35
PID 2504 wrote to memory of 2840	2504	69ea6c1bae15f0e9a51c6d7645b92119.exe	35
PID 2504 wrote to memory of 2840	2504	69ea6c1bae15f0e9a51c6d7645b92119.exe	35
PID 2504 wrote to memory of 2748	2504	69ea6c1bae15f0e9a51c6d7645b92119.exe	36
PID 2504 wrote to memory of 2748	2504	69ea6c1bae15f0e9a51c6d7645b92119.exe	36
PID 2504 wrote to memory of 2748	2504	69ea6c1bae15f0e9a51c6d7645b92119.exe	36
PID 2504 wrote to memory of 2748	2504	69ea6c1bae15f0e9a51c6d7645b92119.exe	36
PID 2504 wrote to memory of 3020	2504	69ea6c1bae15f0e9a51c6d7645b92119.exe	38
PID 2504 wrote to memory of 3020	2504	69ea6c1bae15f0e9a51c6d7645b92119.exe	38
PID 2504 wrote to memory of 3020	2504	69ea6c1bae15f0e9a51c6d7645b92119.exe	38
PID 2504 wrote to memory of 3020	2504	69ea6c1bae15f0e9a51c6d7645b92119.exe	38
PID 3008 wrote to memory of 2092	3008	bsslbabp.exe	41
PID 3008 wrote to memory of 2092	3008	bsslbabp.exe	41
PID 3008 wrote to memory of 2092	3008	bsslbabp.exe	41
PID 3008 wrote to memory of 2092	3008	bsslbabp.exe	41
PID 3008 wrote to memory of 2092	3008	bsslbabp.exe	41
PID 3008 wrote to memory of 2092	3008	bsslbabp.exe	41

C:\Users\Admin\AppData\Local\Temp\69ea6c1bae15f0e9a51c6d7645b92119.exe
"C:\Users\Admin\AppData\Local\Temp\69ea6c1bae15f0e9a51c6d7645b92119.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\lklquizg\
  2⤵
  PID:2052
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\bsslbabp.exe" C:\Windows\SysWOW64\lklquizg\
  2⤵
  PID:1152
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create lklquizg binPath= "C:\Windows\SysWOW64\lklquizg\bsslbabp.exe /d\"C:\Users\Admin\AppData\Local\Temp\69ea6c1bae15f0e9a51c6d7645b92119.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:2792
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description lklquizg "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2840
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start lklquizg
  2⤵
  - Launches sc.exe
  PID:2748
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:3020

C:\Windows\SysWOW64\lklquizg\bsslbabp.exe
C:\Windows\SysWOW64\lklquizg\bsslbabp.exe /d"C:\Users\Admin\AppData\Local\Temp\69ea6c1bae15f0e9a51c6d7645b92119.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Windows security bypass
  - Sets service image path in registry
  - Deletes itself
  PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bsslbabp.exe

Filesize
109KB

MD5
12ee8003e00eeb3800b419b450813df6

SHA1
049263222f65a41fec3c102244f89f209e8fcc5d

SHA256
88016f6415ba28c306cf5b6a2b6c53254e25656b47fbe7ffa950cd1ecdfac7eb

SHA512
85bd420343e0d7c7f3fad4076b6a8bc95eb898f35ac928b3b19d6b617eee6eeb84913167ac3704c93b07b453b837262c1008179a63898a6093a59b11a678f88b

Download Submit
C:\Windows\SysWOW64\lklquizg\bsslbabp.exe

Filesize
92KB

MD5
a4273a844567c2f7a0215b2e38a6c93c

SHA1
f74b8afeb481839e28dd04a94062d63ed80f2a73

SHA256
9844c1de319604504b59c17beba72e1054598019ebf188b3b2eeaf802fda2a0b

SHA512
2b69459b32d23c4c09a7f8eb497d68503e4b4b4b0bce89949fc3a0f3e7dc35b0a489a3f5e8c9ef4e057cb6cea999774fe897cae2520d57282832353221d46a4d

Download Submit
memory/2092-15-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2092-20-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2092-22-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2092-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2092-19-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2092-11-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2092-21-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2504-1-0x0000000000230000-0x0000000000330000-memory.dmp

Filesize
1024KB

Download
memory/2504-4-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2504-2-0x00000000003A0000-0x00000000003B3000-memory.dmp

Filesize
76KB

Download
memory/2504-6-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2504-8-0x00000000003A0000-0x00000000003B3000-memory.dmp

Filesize
76KB

Download
memory/3008-17-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/3008-13-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/3008-10-0x00000000004E0000-0x00000000005E0000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads