tofsee | 2ebdde8a101f5e49aa4a5da2a014a0e154a55eb74a447d2ec60adf0a8ad2b666

Analysis

max time kernel
159s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 22:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
05d67f82c9933f8b9ee66d28f868dd4d.exe
Size 13.3MB
Sample231229-2ke23afdfm
SHA256 2ebdde8a101f5e49aa4a5da2a014a0e154a55eb74a447d2ec60adf0a8ad2b666
MD5 05d67f82c9933f8b9ee66d28f868dd4d
SHA1 9e79b9992ff163bed0d4acf3e5557f1980d83333
SHA512 625572fd14f9bf97230d164615c2290ddd3c5fc873178b13a7855f601551d939f9b9812f27e703252919dfe91603e8077d2129a4b8b2def749d3df6c64b8a0ef
SSDEEP 49152:GkVuhFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFn:Gk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

43.231.4.6
lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
4444	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\sburgdh\ImagePath = "C:\\Windows\\SysWOW64\\sburgdh\\cucrzxbz.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	05d67f82c9933f8b9ee66d28f868dd4d.exe

Deletes itself 1 IoCs

pid	Process
3492	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
3132	cucrzxbz.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3132 set thread context of 3492	3132	cucrzxbz.exe	109

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2324	sc.exe
1732	sc.exe
5088	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2068	3440	WerFault.exe	90
4972	3132	WerFault.exe	108

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 3240	3440	05d67f82c9933f8b9ee66d28f868dd4d.exe	95
PID 3440 wrote to memory of 3240	3440	05d67f82c9933f8b9ee66d28f868dd4d.exe	95
PID 3440 wrote to memory of 3240	3440	05d67f82c9933f8b9ee66d28f868dd4d.exe	95
PID 3440 wrote to memory of 3748	3440	05d67f82c9933f8b9ee66d28f868dd4d.exe	97
PID 3440 wrote to memory of 3748	3440	05d67f82c9933f8b9ee66d28f868dd4d.exe	97
PID 3440 wrote to memory of 3748	3440	05d67f82c9933f8b9ee66d28f868dd4d.exe	97
PID 3440 wrote to memory of 2324	3440	05d67f82c9933f8b9ee66d28f868dd4d.exe	99
PID 3440 wrote to memory of 2324	3440	05d67f82c9933f8b9ee66d28f868dd4d.exe	99
PID 3440 wrote to memory of 2324	3440	05d67f82c9933f8b9ee66d28f868dd4d.exe	99
PID 3440 wrote to memory of 1732	3440	05d67f82c9933f8b9ee66d28f868dd4d.exe	101
PID 3440 wrote to memory of 1732	3440	05d67f82c9933f8b9ee66d28f868dd4d.exe	101
PID 3440 wrote to memory of 1732	3440	05d67f82c9933f8b9ee66d28f868dd4d.exe	101
PID 3440 wrote to memory of 5088	3440	05d67f82c9933f8b9ee66d28f868dd4d.exe	103
PID 3440 wrote to memory of 5088	3440	05d67f82c9933f8b9ee66d28f868dd4d.exe	103
PID 3440 wrote to memory of 5088	3440	05d67f82c9933f8b9ee66d28f868dd4d.exe	103
PID 3440 wrote to memory of 4444	3440	05d67f82c9933f8b9ee66d28f868dd4d.exe	105
PID 3440 wrote to memory of 4444	3440	05d67f82c9933f8b9ee66d28f868dd4d.exe	105
PID 3440 wrote to memory of 4444	3440	05d67f82c9933f8b9ee66d28f868dd4d.exe	105
PID 3132 wrote to memory of 3492	3132	cucrzxbz.exe	109
PID 3132 wrote to memory of 3492	3132	cucrzxbz.exe	109
PID 3132 wrote to memory of 3492	3132	cucrzxbz.exe	109
PID 3132 wrote to memory of 3492	3132	cucrzxbz.exe	109
PID 3132 wrote to memory of 3492	3132	cucrzxbz.exe	109

C:\Users\Admin\AppData\Local\Temp\05d67f82c9933f8b9ee66d28f868dd4d.exe
"C:\Users\Admin\AppData\Local\Temp\05d67f82c9933f8b9ee66d28f868dd4d.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\sburgdh\
  2⤵
  PID:3240
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\cucrzxbz.exe" C:\Windows\SysWOW64\sburgdh\
  2⤵
  PID:3748
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create sburgdh binPath= "C:\Windows\SysWOW64\sburgdh\cucrzxbz.exe /d\"C:\Users\Admin\AppData\Local\Temp\05d67f82c9933f8b9ee66d28f868dd4d.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:2324
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description sburgdh "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:1732
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start sburgdh
  2⤵
  - Launches sc.exe
  PID:5088
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:4444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 1200
  2⤵
  - Program crash
  PID:2068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3440 -ip 3440
1⤵
PID:2668

C:\Windows\SysWOW64\sburgdh\cucrzxbz.exe
C:\Windows\SysWOW64\sburgdh\cucrzxbz.exe /d"C:\Users\Admin\AppData\Local\Temp\05d67f82c9933f8b9ee66d28f868dd4d.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  PID:3492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 520
  2⤵
  - Program crash
  PID:4972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3132 -ip 3132
1⤵
PID:408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cucrzxbz.exe

Path C:\Users\Admin\AppData\Local\Temp\cucrzxbz.exe
Size 12.8MB
SHA256 e3b2cb0fbda4ed342a3e11db48ef4c6fd4441eb15c729efbbe3a51d6f955cf09
MD5 783349b7c285c1d86bf3a8467d00bfd0
SHA1 7188319df4e15cb47fdeff71ed04e4da62808695
SHA512 4774203a2e949a6b1bd8c932eb42deba9d65c691c8b39accfb4228dfad1535e704b3552aa5a56e463d2cd93a715f3625556e2b58cd90619df153398c8961fcb7
SSDEEP 49152:OkVuhFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFn:Ok
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3132-12-0x0000000000E10000-0x0000000000F10000-memory.dmp

Download

memory/3132-13-0x0000000000400000-0x0000000000C17000-memory.dmp

Download

memory/3132-19-0x0000000000400000-0x0000000000C17000-memory.dmp

Download

memory/3440-1-0x0000000000E50000-0x0000000000F50000-memory.dmp

Download

memory/3440-7-0x0000000000400000-0x0000000000C17000-memory.dmp

Download

memory/3440-9-0x0000000000E50000-0x0000000000F50000-memory.dmp

Download

memory/3440-4-0x0000000000400000-0x0000000000C17000-memory.dmp

Download

memory/3440-11-0x0000000000DE0000-0x0000000000DF3000-memory.dmp

Download

memory/3440-2-0x0000000000DE0000-0x0000000000DF3000-memory.dmp

Download

memory/3440-5-0x0000000000400000-0x0000000000C17000-memory.dmp

Download

memory/3492-18-0x0000000001250000-0x0000000001265000-memory.dmp

Download

memory/3492-14-0x0000000001250000-0x0000000001265000-memory.dmp

Download

memory/3492-20-0x0000000001250000-0x0000000001265000-memory.dmp

Download

memory/3492-21-0x0000000001250000-0x0000000001265000-memory.dmp

Download

memory/3492-22-0x0000000001250000-0x0000000001265000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads