tofsee | 05a8af759237e4c4b84f685669ac722006c97938991fadd34ec9bbd0ef2d58e2

Analysis

max time kernel
145s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 21:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d7eaebfd2a61cec5b8701148f4226b3.exe
Size

13.6MB
MD5

1d7eaebfd2a61cec5b8701148f4226b3
SHA1

d6a2723b8007f0bd295d2243c9ecaa6e73decadc
SHA256

05a8af759237e4c4b84f685669ac722006c97938991fadd34ec9bbd0ef2d58e2
SHA512

6d0b45dce771065609467f89d294f4500314c1fbf37c21a214f415ad8aa79b7773bdaf1119e8f5130e385906c2094c1e697661e336567424776fa6863a727f9b
SSDEEP

49152:6j5555555555555555555555555555555555555555555555555555555555555t:

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\zexvrppt = "0"	svchost.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
2612	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\zexvrppt\ImagePath = "C:\\Windows\\SysWOW64\\zexvrppt\\sftwyywj.exe"	svchost.exe

Deletes itself 1 IoCs

pid	Process
2716	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2744	sftwyywj.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2744 set thread context of 2716	2744	sftwyywj.exe	39

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2000	sc.exe
2920	sc.exe
2848	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2020	2968	1d7eaebfd2a61cec5b8701148f4226b3.exe	28
PID 2968 wrote to memory of 2020	2968	1d7eaebfd2a61cec5b8701148f4226b3.exe	28
PID 2968 wrote to memory of 2020	2968	1d7eaebfd2a61cec5b8701148f4226b3.exe	28
PID 2968 wrote to memory of 2020	2968	1d7eaebfd2a61cec5b8701148f4226b3.exe	28
PID 2968 wrote to memory of 1804	2968	1d7eaebfd2a61cec5b8701148f4226b3.exe	30
PID 2968 wrote to memory of 1804	2968	1d7eaebfd2a61cec5b8701148f4226b3.exe	30
PID 2968 wrote to memory of 1804	2968	1d7eaebfd2a61cec5b8701148f4226b3.exe	30
PID 2968 wrote to memory of 1804	2968	1d7eaebfd2a61cec5b8701148f4226b3.exe	30
PID 2968 wrote to memory of 2000	2968	1d7eaebfd2a61cec5b8701148f4226b3.exe	32
PID 2968 wrote to memory of 2000	2968	1d7eaebfd2a61cec5b8701148f4226b3.exe	32
PID 2968 wrote to memory of 2000	2968	1d7eaebfd2a61cec5b8701148f4226b3.exe	32
PID 2968 wrote to memory of 2000	2968	1d7eaebfd2a61cec5b8701148f4226b3.exe	32
PID 2968 wrote to memory of 2920	2968	1d7eaebfd2a61cec5b8701148f4226b3.exe	34
PID 2968 wrote to memory of 2920	2968	1d7eaebfd2a61cec5b8701148f4226b3.exe	34
PID 2968 wrote to memory of 2920	2968	1d7eaebfd2a61cec5b8701148f4226b3.exe	34
PID 2968 wrote to memory of 2920	2968	1d7eaebfd2a61cec5b8701148f4226b3.exe	34
PID 2968 wrote to memory of 2848	2968	1d7eaebfd2a61cec5b8701148f4226b3.exe	37
PID 2968 wrote to memory of 2848	2968	1d7eaebfd2a61cec5b8701148f4226b3.exe	37
PID 2968 wrote to memory of 2848	2968	1d7eaebfd2a61cec5b8701148f4226b3.exe	37
PID 2968 wrote to memory of 2848	2968	1d7eaebfd2a61cec5b8701148f4226b3.exe	37
PID 2744 wrote to memory of 2716	2744	sftwyywj.exe	39
PID 2744 wrote to memory of 2716	2744	sftwyywj.exe	39
PID 2744 wrote to memory of 2716	2744	sftwyywj.exe	39
PID 2744 wrote to memory of 2716	2744	sftwyywj.exe	39
PID 2744 wrote to memory of 2716	2744	sftwyywj.exe	39
PID 2744 wrote to memory of 2716	2744	sftwyywj.exe	39
PID 2968 wrote to memory of 2612	2968	1d7eaebfd2a61cec5b8701148f4226b3.exe	41
PID 2968 wrote to memory of 2612	2968	1d7eaebfd2a61cec5b8701148f4226b3.exe	41
PID 2968 wrote to memory of 2612	2968	1d7eaebfd2a61cec5b8701148f4226b3.exe	41
PID 2968 wrote to memory of 2612	2968	1d7eaebfd2a61cec5b8701148f4226b3.exe	41

C:\Users\Admin\AppData\Local\Temp\1d7eaebfd2a61cec5b8701148f4226b3.exe
"C:\Users\Admin\AppData\Local\Temp\1d7eaebfd2a61cec5b8701148f4226b3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\zexvrppt\
  2⤵
  PID:2020
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\sftwyywj.exe" C:\Windows\SysWOW64\zexvrppt\
  2⤵
  PID:1804
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create zexvrppt binPath= "C:\Windows\SysWOW64\zexvrppt\sftwyywj.exe /d\"C:\Users\Admin\AppData\Local\Temp\1d7eaebfd2a61cec5b8701148f4226b3.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:2000
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description zexvrppt "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2920
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start zexvrppt
  2⤵
  - Launches sc.exe
  PID:2848
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:2612

C:\Windows\SysWOW64\zexvrppt\sftwyywj.exe
C:\Windows\SysWOW64\zexvrppt\sftwyywj.exe /d"C:\Users\Admin\AppData\Local\Temp\1d7eaebfd2a61cec5b8701148f4226b3.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Windows security bypass
  - Sets service image path in registry
  - Deletes itself
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\sftwyywj.exe

Filesize
9.1MB

MD5
98b3d025bd764ae8cd4a24ee20e1b9e7

SHA1
90bd2b959b7a757132ff15c83665c849d2c0793e

SHA256
0530f4dbede3fd7d506bc9700d525e8323698c23a848b0ff50dc08c1e23f137e

SHA512
b0953adce037694c10dea6d90ab37e0db60d76aec1d471329d4d3b3a39b8b820d5a13d8b78c4bf23f3e1ee7783992e7cdf7c35e4f81acb40d2ca9012f7f72981

Download Submit
C:\Windows\SysWOW64\zexvrppt\sftwyywj.exe

Filesize
5.0MB

MD5
fec98ded28d626204f602b68640cb4de

SHA1
961d12a0fe95ffca28262e6969df7b0c7098d240

SHA256
d1d759cd34d65c5a929e832c9652de5aa50de057877d43277087e9b9b97f14c4

SHA512
c01aca3b6a23e2834fb8aaf62b5cbbc02956f015552fa22d03dd07023676374ad5cf5636a96a639590cc91b6d8ca5d6fed92bb19b099d0687c46adce0de45d20

Download Submit
memory/2716-9-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2716-20-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2716-18-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2716-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2716-19-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2716-12-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2716-16-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2744-13-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2744-7-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2968-2-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2968-17-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2968-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2968-1-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2968-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads