tofsee | 68144fe9a725e15493eb9156fc66f401701aff5daec246cb7489eca9993fa751

General

Target

0162043ff06fc0b7df59995580637c08.exe
Size

10.1MB
MD5

0162043ff06fc0b7df59995580637c08
SHA1

dbc586ca0e60b45b96824f4daa8d0ec4d3d41bdd
SHA256

68144fe9a725e15493eb9156fc66f401701aff5daec246cb7489eca9993fa751
SHA512

76bdd28851dd82ff301f77e98a1cd03cc6950dfdd04396293fb4d1181c74febdead5574b2a5d20148908a9a13850be83b279c1a5248be633bf30b62aa953c121
SSDEEP

196608:YV8YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY4:

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.6

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
4416	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nszekpmk\ImagePath = "C:\\Windows\\SysWOW64\\nszekpmk\\xrtwpoo.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	0162043ff06fc0b7df59995580637c08.exe

Deletes itself 1 IoCs

pid	Process
2688	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
4540	xrtwpoo.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4540 set thread context of 2688	4540	xrtwpoo.exe	105

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3620	sc.exe
1916	sc.exe
3884	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
748	2164	WerFault.exe	86
2612	4540	WerFault.exe	100

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 4868	2164	0162043ff06fc0b7df59995580637c08.exe	90
PID 2164 wrote to memory of 4868	2164	0162043ff06fc0b7df59995580637c08.exe	90
PID 2164 wrote to memory of 4868	2164	0162043ff06fc0b7df59995580637c08.exe	90
PID 2164 wrote to memory of 4716	2164	0162043ff06fc0b7df59995580637c08.exe	92
PID 2164 wrote to memory of 4716	2164	0162043ff06fc0b7df59995580637c08.exe	92
PID 2164 wrote to memory of 4716	2164	0162043ff06fc0b7df59995580637c08.exe	92
PID 2164 wrote to memory of 3620	2164	0162043ff06fc0b7df59995580637c08.exe	95
PID 2164 wrote to memory of 3620	2164	0162043ff06fc0b7df59995580637c08.exe	95
PID 2164 wrote to memory of 3620	2164	0162043ff06fc0b7df59995580637c08.exe	95
PID 2164 wrote to memory of 1916	2164	0162043ff06fc0b7df59995580637c08.exe	96
PID 2164 wrote to memory of 1916	2164	0162043ff06fc0b7df59995580637c08.exe	96
PID 2164 wrote to memory of 1916	2164	0162043ff06fc0b7df59995580637c08.exe	96
PID 2164 wrote to memory of 3884	2164	0162043ff06fc0b7df59995580637c08.exe	98
PID 2164 wrote to memory of 3884	2164	0162043ff06fc0b7df59995580637c08.exe	98
PID 2164 wrote to memory of 3884	2164	0162043ff06fc0b7df59995580637c08.exe	98
PID 2164 wrote to memory of 4416	2164	0162043ff06fc0b7df59995580637c08.exe	102
PID 2164 wrote to memory of 4416	2164	0162043ff06fc0b7df59995580637c08.exe	102
PID 2164 wrote to memory of 4416	2164	0162043ff06fc0b7df59995580637c08.exe	102
PID 4540 wrote to memory of 2688	4540	xrtwpoo.exe	105
PID 4540 wrote to memory of 2688	4540	xrtwpoo.exe	105
PID 4540 wrote to memory of 2688	4540	xrtwpoo.exe	105
PID 4540 wrote to memory of 2688	4540	xrtwpoo.exe	105
PID 4540 wrote to memory of 2688	4540	xrtwpoo.exe	105

C:\Users\Admin\AppData\Local\Temp\0162043ff06fc0b7df59995580637c08.exe
"C:\Users\Admin\AppData\Local\Temp\0162043ff06fc0b7df59995580637c08.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\nszekpmk\
  2⤵
  PID:4868
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\xrtwpoo.exe" C:\Windows\SysWOW64\nszekpmk\
  2⤵
  PID:4716
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create nszekpmk binPath= "C:\Windows\SysWOW64\nszekpmk\xrtwpoo.exe /d\"C:\Users\Admin\AppData\Local\Temp\0162043ff06fc0b7df59995580637c08.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:3620
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description nszekpmk "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:1916
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start nszekpmk
  2⤵
  - Launches sc.exe
  PID:3884
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:4416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 1164
  2⤵
  - Program crash
  PID:748

C:\Windows\SysWOW64\nszekpmk\xrtwpoo.exe
C:\Windows\SysWOW64\nszekpmk\xrtwpoo.exe /d"C:\Users\Admin\AppData\Local\Temp\0162043ff06fc0b7df59995580637c08.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  PID:2688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 556
  2⤵
  - Program crash
  PID:2612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2164 -ip 2164
1⤵
PID:4644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4540 -ip 4540
1⤵
PID:4772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\xrtwpoo.exe

Filesize
9.1MB

MD5
e4263d4b11d27626ae666d8faa3ee018

SHA1
75b8f8eae78b4b6d0f860444cfffa7eb9b6b74b5

SHA256
89bbe318dbe34253046f55752d806eca06dab14c26362e62b223234ca04c5f37

SHA512
affffbb21ce5026ea88f6b7d4b732b9f7a08731917dd57bea89d655a00ec66d0a141c8eed7ad8257db5f5a5561104fb9a76f3b869e9e7c66d1397917310a7249

Download Submit
C:\Windows\SysWOW64\nszekpmk\xrtwpoo.exe

Filesize
10.7MB

MD5
2866ab644ada607fb12947f7807843c3

SHA1
41cc9d1dfe60b330d3a7b043442af4881922d2bf

SHA256
911957122f2dd571e29e5ee3ebb7e70b85ecd1a7b16fbbac2bee2f55d5157df6

SHA512
abb19685e7994b8805a6ee98f1f5875815dd5638695517cadbde78eb93222d334981e8f7ca6251c29ff5aac4d80ee99b5c5fdcbfff91fdf425d0970e1ec3a08e

Download Submit
memory/2164-1-0x00000000009D0000-0x0000000000AD0000-memory.dmp

Filesize
1024KB

Download
memory/2164-2-0x0000000000970000-0x0000000000983000-memory.dmp

Filesize
76KB

Download
memory/2164-4-0x0000000000400000-0x00000000008EA000-memory.dmp

Filesize
4.9MB

Download
memory/2164-8-0x0000000000400000-0x00000000008EA000-memory.dmp

Filesize
4.9MB

Download
memory/2688-12-0x0000000000C00000-0x0000000000C15000-memory.dmp

Filesize
84KB

Download
memory/2688-15-0x0000000000C00000-0x0000000000C15000-memory.dmp

Filesize
84KB

Download
memory/2688-18-0x0000000000C00000-0x0000000000C15000-memory.dmp

Filesize
84KB

Download
memory/2688-19-0x0000000000C00000-0x0000000000C15000-memory.dmp

Filesize
84KB

Download
memory/2688-20-0x0000000000C00000-0x0000000000C15000-memory.dmp

Filesize
84KB

Download
memory/4540-10-0x0000000000940000-0x0000000000953000-memory.dmp

Filesize
76KB

Download
memory/4540-11-0x0000000000400000-0x00000000008EA000-memory.dmp

Filesize
4.9MB

Download
memory/4540-9-0x0000000000960000-0x0000000000A60000-memory.dmp

Filesize
1024KB

Download
memory/4540-17-0x0000000000400000-0x00000000008EA000-memory.dmp

Filesize
4.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads