tofsee | 0d5ef3fe0be680bbdf3fa207553673a3ca01e500476cd7364bcf8357f6fb0bc3

General

Target

00c56635473dd208896b29f6a030d19f.exe
Size

11.7MB
MD5

00c56635473dd208896b29f6a030d19f
SHA1

b11bd4e24d06d3249e7e0f0fb1d4c92fa4027b0c
SHA256

0d5ef3fe0be680bbdf3fa207553673a3ca01e500476cd7364bcf8357f6fb0bc3
SHA512

5dcb84ffbaee4b44efeba5b400d51a248fbc01eb9df957d77cb06c391709aea1dc93c734875e08f9b1fd8fc4566e56eb4d5815000ffbb4b3267e7d6bef1d7fd5
SSDEEP

49152:Kjrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrz:0

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
3012	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ufvvqhps\ImagePath = "C:\\Windows\\SysWOW64\\ufvvqhps\\arknuhts.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation	00c56635473dd208896b29f6a030d19f.exe

Deletes itself 1 IoCs

pid	Process
1964	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
4904	arknuhts.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4904 set thread context of 1964	4904	arknuhts.exe	104

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1192	sc.exe
5104	sc.exe
4764	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 3776	4592	00c56635473dd208896b29f6a030d19f.exe	92
PID 4592 wrote to memory of 3776	4592	00c56635473dd208896b29f6a030d19f.exe	92
PID 4592 wrote to memory of 3776	4592	00c56635473dd208896b29f6a030d19f.exe	92
PID 4592 wrote to memory of 4512	4592	00c56635473dd208896b29f6a030d19f.exe	94
PID 4592 wrote to memory of 4512	4592	00c56635473dd208896b29f6a030d19f.exe	94
PID 4592 wrote to memory of 4512	4592	00c56635473dd208896b29f6a030d19f.exe	94
PID 4592 wrote to memory of 1192	4592	00c56635473dd208896b29f6a030d19f.exe	96
PID 4592 wrote to memory of 1192	4592	00c56635473dd208896b29f6a030d19f.exe	96
PID 4592 wrote to memory of 1192	4592	00c56635473dd208896b29f6a030d19f.exe	96
PID 4592 wrote to memory of 5104	4592	00c56635473dd208896b29f6a030d19f.exe	98
PID 4592 wrote to memory of 5104	4592	00c56635473dd208896b29f6a030d19f.exe	98
PID 4592 wrote to memory of 5104	4592	00c56635473dd208896b29f6a030d19f.exe	98
PID 4592 wrote to memory of 4764	4592	00c56635473dd208896b29f6a030d19f.exe	100
PID 4592 wrote to memory of 4764	4592	00c56635473dd208896b29f6a030d19f.exe	100
PID 4592 wrote to memory of 4764	4592	00c56635473dd208896b29f6a030d19f.exe	100
PID 4592 wrote to memory of 3012	4592	00c56635473dd208896b29f6a030d19f.exe	103
PID 4592 wrote to memory of 3012	4592	00c56635473dd208896b29f6a030d19f.exe	103
PID 4592 wrote to memory of 3012	4592	00c56635473dd208896b29f6a030d19f.exe	103
PID 4904 wrote to memory of 1964	4904	arknuhts.exe	104
PID 4904 wrote to memory of 1964	4904	arknuhts.exe	104
PID 4904 wrote to memory of 1964	4904	arknuhts.exe	104
PID 4904 wrote to memory of 1964	4904	arknuhts.exe	104
PID 4904 wrote to memory of 1964	4904	arknuhts.exe	104

C:\Users\Admin\AppData\Local\Temp\00c56635473dd208896b29f6a030d19f.exe
"C:\Users\Admin\AppData\Local\Temp\00c56635473dd208896b29f6a030d19f.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ufvvqhps\
  2⤵
  PID:3776
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\arknuhts.exe" C:\Windows\SysWOW64\ufvvqhps\
  2⤵
  PID:4512
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create ufvvqhps binPath= "C:\Windows\SysWOW64\ufvvqhps\arknuhts.exe /d\"C:\Users\Admin\AppData\Local\Temp\00c56635473dd208896b29f6a030d19f.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:1192
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description ufvvqhps "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:5104
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start ufvvqhps
  2⤵
  - Launches sc.exe
  PID:4764
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:3012

C:\Windows\SysWOW64\ufvvqhps\arknuhts.exe
C:\Windows\SysWOW64\ufvvqhps\arknuhts.exe /d"C:\Users\Admin\AppData\Local\Temp\00c56635473dd208896b29f6a030d19f.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  PID:1964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\arknuhts.exe

Filesize
347KB

MD5
aab2c023d3e22cbf8972bf884cc01afe

SHA1
b18cc74a898e915023c1db6c981999227b8ee39c

SHA256
a0ab69030fd54d2d137076e8ab6132ffb1b7f46d047d08a6474d04296ce1dd89

SHA512
78dce08fe45499c0f8a4053037d2645acea16b433d8ee8721301c9691252475b4b8ae47589c6f3e14e655fb04cce73b6668cef1e8843b6b78ddae3f9dd01c166

Download Submit
C:\Windows\SysWOW64\ufvvqhps\arknuhts.exe

Filesize
381KB

MD5
698496572af3d68659a8118a852636b1

SHA1
6ccb1db6108a2237a3f6f79623a2f86cb9020e81

SHA256
9b97b8ba9bba1896b7792d195a19f43f89a859a0b8cb706f3241131ff0846477

SHA512
f03454f8bca2f4f456f7716db9770949121024bb155f490e738de8aa055fb25222dbf59775f7a88bf77b3e8a6d8978a6022ed78c4b7a06439dfc0bc04403f81c

Download Submit
memory/1964-18-0x0000000000110000-0x0000000000125000-memory.dmp

Filesize
84KB

Download
memory/1964-17-0x0000000000110000-0x0000000000125000-memory.dmp

Filesize
84KB

Download
memory/1964-15-0x0000000000110000-0x0000000000125000-memory.dmp

Filesize
84KB

Download
memory/1964-16-0x0000000000110000-0x0000000000125000-memory.dmp

Filesize
84KB

Download
memory/1964-11-0x0000000000110000-0x0000000000125000-memory.dmp

Filesize
84KB

Download
memory/4592-1-0x00000000004F0000-0x00000000004F1000-memory.dmp

Filesize
4KB

Download
memory/4592-6-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4592-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4592-2-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4592-3-0x0000000000500000-0x0000000000501000-memory.dmp

Filesize
4KB

Download
memory/4904-8-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4904-9-0x00000000004A0000-0x00000000004A1000-memory.dmp

Filesize
4KB

Download
memory/4904-12-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads