tofsee | e85a0596ff82987f0b4cf78140a43650ae7af258edebca34924a2baa58304632

Analysis

max time kernel
5s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 19:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
01e7399665fb666967364e6d28b461d9.exe
Size 14.5MB
Sample231229-yarrbsffa2
SHA256 e85a0596ff82987f0b4cf78140a43650ae7af258edebca34924a2baa58304632
MD5 01e7399665fb666967364e6d28b461d9
SHA1 8f75397db09e07565dab1e45d45d85e5f42503ff
SHA512 d2a0443676b6c4b46939fbb136825b91eb3fe5f1c3f459d5e84397a2b9a1d75782cd9417f7c4af8148ebd2a7cdd9b830696a7fb2f1ce9d4da0f68f2b160cf658
SSDEEP 98304:bjhd88888888888888888888888888888888888888888888888888888888888H:b
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

176.111.174.19
lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
3808	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	01e7399665fb666967364e6d28b461d9.exe

Executes dropped EXE 1 IoCs

pid	Process
2620	fnuezxuz.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4748	sc.exe
2816	sc.exe
4784	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4432	1508	WerFault.exe	28
5020	2620	WerFault.exe	102

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 4804	1508	01e7399665fb666967364e6d28b461d9.exe	92
PID 1508 wrote to memory of 4804	1508	01e7399665fb666967364e6d28b461d9.exe	92
PID 1508 wrote to memory of 4804	1508	01e7399665fb666967364e6d28b461d9.exe	92
PID 1508 wrote to memory of 3216	1508	01e7399665fb666967364e6d28b461d9.exe	95
PID 1508 wrote to memory of 3216	1508	01e7399665fb666967364e6d28b461d9.exe	95
PID 1508 wrote to memory of 3216	1508	01e7399665fb666967364e6d28b461d9.exe	95
PID 1508 wrote to memory of 4748	1508	01e7399665fb666967364e6d28b461d9.exe	97
PID 1508 wrote to memory of 4748	1508	01e7399665fb666967364e6d28b461d9.exe	97
PID 1508 wrote to memory of 4748	1508	01e7399665fb666967364e6d28b461d9.exe	97
PID 1508 wrote to memory of 2816	1508	01e7399665fb666967364e6d28b461d9.exe	99
PID 1508 wrote to memory of 2816	1508	01e7399665fb666967364e6d28b461d9.exe	99
PID 1508 wrote to memory of 2816	1508	01e7399665fb666967364e6d28b461d9.exe	99
PID 1508 wrote to memory of 4784	1508	01e7399665fb666967364e6d28b461d9.exe	101
PID 1508 wrote to memory of 4784	1508	01e7399665fb666967364e6d28b461d9.exe	101
PID 1508 wrote to memory of 4784	1508	01e7399665fb666967364e6d28b461d9.exe	101
PID 1508 wrote to memory of 3808	1508	01e7399665fb666967364e6d28b461d9.exe	106
PID 1508 wrote to memory of 3808	1508	01e7399665fb666967364e6d28b461d9.exe	106
PID 1508 wrote to memory of 3808	1508	01e7399665fb666967364e6d28b461d9.exe	106

C:\Users\Admin\AppData\Local\Temp\01e7399665fb666967364e6d28b461d9.exe
"C:\Users\Admin\AppData\Local\Temp\01e7399665fb666967364e6d28b461d9.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\qvsjiiij\
  2⤵
  PID:4804
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\fnuezxuz.exe" C:\Windows\SysWOW64\qvsjiiij\
  2⤵
  PID:3216
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create qvsjiiij binPath= "C:\Windows\SysWOW64\qvsjiiij\fnuezxuz.exe /d\"C:\Users\Admin\AppData\Local\Temp\01e7399665fb666967364e6d28b461d9.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:4748
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description qvsjiiij "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2816
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start qvsjiiij
  2⤵
  - Launches sc.exe
  PID:4784
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:3808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 1208
  2⤵
  - Program crash
  PID:4432

C:\Windows\SysWOW64\qvsjiiij\fnuezxuz.exe
C:\Windows\SysWOW64\qvsjiiij\fnuezxuz.exe /d"C:\Users\Admin\AppData\Local\Temp\01e7399665fb666967364e6d28b461d9.exe"
1⤵
- Executes dropped EXE
PID:2620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 520
  2⤵
  - Program crash
  PID:5020
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:4268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1508 -ip 1508
1⤵
PID:3920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2620 -ip 2620
1⤵
PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fnuezxuz.exe

Path C:\Users\Admin\AppData\Local\Temp\fnuezxuz.exe
Size 628KB
SHA256 379f7b9043711b8eefd776435995a87ed96997fe355070a52e88d63e608c0897
MD5 3345d443eb4c1f5600875a99b8bbd568
SHA1 2b32bc059ecfcc798bdfb2fe4756e1b5a366d18d
SHA512 14386cfc06c9af47f6fded6cc9f4118ce4c6b5bab45d0a3c8d7b1effb0362ee15003f59c260da757d1e235b18036f72d8ccf0ebefa077bc0af6bb8ea0ff0d197
SSDEEP 12288:UWwHGULjC+0aC0nb0hbPR+eOdZYg4Eug8888888888888888889:WHhjf0aLgaz4i8888888888888888889
MD5 SHA1 SHA512 SSDEEP

Submit Download

fnuezxuz.exe

Path C:\Windows\SysWOW64\qvsjiiij\fnuezxuz.exe
Size 1.3MB
SHA256 df899fd150159697076afabdfc10260ce068520460f98f6e7f57b2e52b573e0e
MD5 16afa9be87794e5f472468bee24fffa6
SHA1 867fb52a8a17c26e6e2e91e807bc6e71b6398594
SHA512 2c8b604e04327ee098264371cdd043b289d1f079e778d2603249d62b5bc151e376adcb0f4ba25d367f52133bc691eae6868e6fe92f9bb36b867420923db5b400
SSDEEP 24576:WHhjf0aLgaz4i88888888888888888888888888888888888888888888888888Y:WjhzR88888888888888888888888888I
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1508-8-0x00000000021C0000-0x00000000021D3000-memory.dmp

Download

memory/1508-3-0x0000000000400000-0x000000000045D000-memory.dmp

Download

memory/1508-1-0x00000000005D0000-0x00000000006D0000-memory.dmp

Download

memory/1508-7-0x0000000000400000-0x000000000045D000-memory.dmp

Download

memory/1508-2-0x00000000021C0000-0x00000000021D3000-memory.dmp

Download

memory/2620-11-0x0000000000400000-0x000000000045D000-memory.dmp

Download

memory/2620-16-0x0000000000400000-0x000000000045D000-memory.dmp

Download

memory/2620-10-0x00000000006C0000-0x00000000007C0000-memory.dmp

Download

memory/4268-15-0x0000000001260000-0x0000000001275000-memory.dmp

Download

memory/4268-17-0x0000000001260000-0x0000000001275000-memory.dmp

Download

memory/4268-12-0x0000000001260000-0x0000000001275000-memory.dmp

Download

memory/4268-18-0x0000000001260000-0x0000000001275000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads