tofsee | 589b440546de5c009e919895ec19b01f3d5961229af8ce1038ed48deb8990839

Analysis

max time kernel
165s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 21:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
048103a4210a2f0e08ed83b61a333560.exe
Size 13.4MB
Sample231229-1dn6qahch8
SHA256 589b440546de5c009e919895ec19b01f3d5961229af8ce1038ed48deb8990839
MD5 048103a4210a2f0e08ed83b61a333560
SHA1 15f6fa5d63b290d5e664a1b27cc4ce4c0c92a371
SHA512 e5244f9a56ecf0f311897fe29aa1cd51fbb88b58bcfa30c3b263cea8e93741c065062545794e0659e36570eaaec17db6a394788352191c03acc6a9d889fdfd4a
SSDEEP 24576:dtF49KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKL:dtF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

43.231.4.7
lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
1708	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vlqwldvr\ImagePath = "C:\\Windows\\SysWOW64\\vlqwldvr\\pgomwrym.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	048103a4210a2f0e08ed83b61a333560.exe

Deletes itself 1 IoCs

pid	Process
620	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
4612	pgomwrym.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4612 set thread context of 620	4612	pgomwrym.exe	105

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4616	sc.exe
1356	sc.exe
4384	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2980	1964	WerFault.exe	86
3572	4612	WerFault.exe	99

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 1796	1964	048103a4210a2f0e08ed83b61a333560.exe	89
PID 1964 wrote to memory of 1796	1964	048103a4210a2f0e08ed83b61a333560.exe	89
PID 1964 wrote to memory of 1796	1964	048103a4210a2f0e08ed83b61a333560.exe	89
PID 1964 wrote to memory of 3648	1964	048103a4210a2f0e08ed83b61a333560.exe	91
PID 1964 wrote to memory of 3648	1964	048103a4210a2f0e08ed83b61a333560.exe	91
PID 1964 wrote to memory of 3648	1964	048103a4210a2f0e08ed83b61a333560.exe	91
PID 1964 wrote to memory of 4616	1964	048103a4210a2f0e08ed83b61a333560.exe	93
PID 1964 wrote to memory of 4616	1964	048103a4210a2f0e08ed83b61a333560.exe	93
PID 1964 wrote to memory of 4616	1964	048103a4210a2f0e08ed83b61a333560.exe	93
PID 1964 wrote to memory of 1356	1964	048103a4210a2f0e08ed83b61a333560.exe	95
PID 1964 wrote to memory of 1356	1964	048103a4210a2f0e08ed83b61a333560.exe	95
PID 1964 wrote to memory of 1356	1964	048103a4210a2f0e08ed83b61a333560.exe	95
PID 1964 wrote to memory of 4384	1964	048103a4210a2f0e08ed83b61a333560.exe	97
PID 1964 wrote to memory of 4384	1964	048103a4210a2f0e08ed83b61a333560.exe	97
PID 1964 wrote to memory of 4384	1964	048103a4210a2f0e08ed83b61a333560.exe	97
PID 1964 wrote to memory of 1708	1964	048103a4210a2f0e08ed83b61a333560.exe	102
PID 1964 wrote to memory of 1708	1964	048103a4210a2f0e08ed83b61a333560.exe	102
PID 1964 wrote to memory of 1708	1964	048103a4210a2f0e08ed83b61a333560.exe	102
PID 4612 wrote to memory of 620	4612	pgomwrym.exe	105
PID 4612 wrote to memory of 620	4612	pgomwrym.exe	105
PID 4612 wrote to memory of 620	4612	pgomwrym.exe	105
PID 4612 wrote to memory of 620	4612	pgomwrym.exe	105
PID 4612 wrote to memory of 620	4612	pgomwrym.exe	105

C:\Users\Admin\AppData\Local\Temp\048103a4210a2f0e08ed83b61a333560.exe
"C:\Users\Admin\AppData\Local\Temp\048103a4210a2f0e08ed83b61a333560.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\vlqwldvr\
  2⤵
  PID:1796
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\pgomwrym.exe" C:\Windows\SysWOW64\vlqwldvr\
  2⤵
  PID:3648
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create vlqwldvr binPath= "C:\Windows\SysWOW64\vlqwldvr\pgomwrym.exe /d\"C:\Users\Admin\AppData\Local\Temp\048103a4210a2f0e08ed83b61a333560.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:4616
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description vlqwldvr "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:1356
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start vlqwldvr
  2⤵
  - Launches sc.exe
  PID:4384
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:1708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 1040
  2⤵
  - Program crash
  PID:2980

C:\Windows\SysWOW64\vlqwldvr\pgomwrym.exe
C:\Windows\SysWOW64\vlqwldvr\pgomwrym.exe /d"C:\Users\Admin\AppData\Local\Temp\048103a4210a2f0e08ed83b61a333560.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  PID:620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 512
  2⤵
  - Program crash
  PID:3572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1964 -ip 1964
1⤵
PID:3092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4612 -ip 4612
1⤵
PID:4980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pgomwrym.exe

Path C:\Users\Admin\AppData\Local\Temp\pgomwrym.exe
Size 489KB
SHA256 1192afea1bbe4d3986521f7ecaaaa52bab963b34752f5202a0257186a6d60cda
MD5 c37d098b60a5a16795a86f76f4805a26
SHA1 826b39fa2668dca42fd39b0b8ceced311af5b9ba
SHA512 fcd23001a1522746b22a88565a77e7663898de8e4f1917de6152befb0554bf54bb49d440b0425e20db8f661404791e2ebafe7ce5246dfaca2f6424ba8a2d8f86
SSDEEP 6144:6zzosmCqpr2kfxtMLdL8JXMU8KKKKKKKKKp:6PosmnpFOLd9KKKKKKKKKp
MD5 SHA1 SHA512 SSDEEP

Submit Download

pgomwrym.exe

Path C:\Windows\SysWOW64\vlqwldvr\pgomwrym.exe
Size 1.2MB
SHA256 1fc19d995786dcf3477c1b2943504047e9d666b36ef05caffb14ab002f543986
MD5 ddb7ef2f181f2a4f386c674df53ea74f
SHA1 88596d8c21e80d56ccd424917a123ec3c28c4542
SHA512 0543bc050b438b35f69b9fdc341864dfe3419c7b190137760c775fcad00564e65b545a360fdccc5545ca7101fd7f04e80648c4621128b7b15c09626ed7b8b7e0
SSDEEP 24576:BtF49KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKT:BtFt
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/620-15-0x0000000000390000-0x00000000003A5000-memory.dmp

Download

memory/620-17-0x0000000000390000-0x00000000003A5000-memory.dmp

Download

memory/620-9-0x0000000000390000-0x00000000003A5000-memory.dmp

Download

memory/620-13-0x0000000000390000-0x00000000003A5000-memory.dmp

Download

memory/620-16-0x0000000000390000-0x00000000003A5000-memory.dmp

Download

memory/1964-2-0x0000000004ED0000-0x0000000004EE3000-memory.dmp

Download

memory/1964-1-0x0000000005080000-0x0000000005180000-memory.dmp

Download

memory/1964-12-0x0000000000400000-0x0000000004DB8000-memory.dmp

Download

memory/4612-7-0x0000000004FF0000-0x00000000050F0000-memory.dmp

Download

memory/4612-14-0x0000000000400000-0x0000000004DB8000-memory.dmp

Download

memory/4612-8-0x0000000004E00000-0x0000000004E13000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads