tofsee | 05a8af759237e4c4b84f685669ac722006c97938991fadd34ec9bbd0ef2d58e2

General

Target

1d7eaebfd2a61cec5b8701148f4226b3.exe
Size

13.6MB
MD5

1d7eaebfd2a61cec5b8701148f4226b3
SHA1

d6a2723b8007f0bd295d2243c9ecaa6e73decadc
SHA256

05a8af759237e4c4b84f685669ac722006c97938991fadd34ec9bbd0ef2d58e2
SHA512

6d0b45dce771065609467f89d294f4500314c1fbf37c21a214f415ad8aa79b7773bdaf1119e8f5130e385906c2094c1e697661e336567424776fa6863a727f9b
SSDEEP

49152:6j5555555555555555555555555555555555555555555555555555555555555t:

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
756	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wziqltpt\ImagePath = "C:\\Windows\\SysWOW64\\wziqltpt\\llkqbpwz.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	1d7eaebfd2a61cec5b8701148f4226b3.exe

Deletes itself 1 IoCs

pid	Process
3444	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
1076	llkqbpwz.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1076 set thread context of 3444	1076	llkqbpwz.exe	103

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3732	sc.exe
1604	sc.exe
4692	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 3968	3448	1d7eaebfd2a61cec5b8701148f4226b3.exe	91
PID 3448 wrote to memory of 3968	3448	1d7eaebfd2a61cec5b8701148f4226b3.exe	91
PID 3448 wrote to memory of 3968	3448	1d7eaebfd2a61cec5b8701148f4226b3.exe	91
PID 3448 wrote to memory of 4076	3448	1d7eaebfd2a61cec5b8701148f4226b3.exe	93
PID 3448 wrote to memory of 4076	3448	1d7eaebfd2a61cec5b8701148f4226b3.exe	93
PID 3448 wrote to memory of 4076	3448	1d7eaebfd2a61cec5b8701148f4226b3.exe	93
PID 3448 wrote to memory of 3732	3448	1d7eaebfd2a61cec5b8701148f4226b3.exe	96
PID 3448 wrote to memory of 3732	3448	1d7eaebfd2a61cec5b8701148f4226b3.exe	96
PID 3448 wrote to memory of 3732	3448	1d7eaebfd2a61cec5b8701148f4226b3.exe	96
PID 3448 wrote to memory of 1604	3448	1d7eaebfd2a61cec5b8701148f4226b3.exe	98
PID 3448 wrote to memory of 1604	3448	1d7eaebfd2a61cec5b8701148f4226b3.exe	98
PID 3448 wrote to memory of 1604	3448	1d7eaebfd2a61cec5b8701148f4226b3.exe	98
PID 3448 wrote to memory of 4692	3448	1d7eaebfd2a61cec5b8701148f4226b3.exe	101
PID 3448 wrote to memory of 4692	3448	1d7eaebfd2a61cec5b8701148f4226b3.exe	101
PID 3448 wrote to memory of 4692	3448	1d7eaebfd2a61cec5b8701148f4226b3.exe	101
PID 3448 wrote to memory of 756	3448	1d7eaebfd2a61cec5b8701148f4226b3.exe	105
PID 3448 wrote to memory of 756	3448	1d7eaebfd2a61cec5b8701148f4226b3.exe	105
PID 3448 wrote to memory of 756	3448	1d7eaebfd2a61cec5b8701148f4226b3.exe	105
PID 1076 wrote to memory of 3444	1076	llkqbpwz.exe	103
PID 1076 wrote to memory of 3444	1076	llkqbpwz.exe	103
PID 1076 wrote to memory of 3444	1076	llkqbpwz.exe	103
PID 1076 wrote to memory of 3444	1076	llkqbpwz.exe	103
PID 1076 wrote to memory of 3444	1076	llkqbpwz.exe	103

C:\Users\Admin\AppData\Local\Temp\1d7eaebfd2a61cec5b8701148f4226b3.exe
"C:\Users\Admin\AppData\Local\Temp\1d7eaebfd2a61cec5b8701148f4226b3.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\wziqltpt\
  2⤵
  PID:3968
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\llkqbpwz.exe" C:\Windows\SysWOW64\wziqltpt\
  2⤵
  PID:4076
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create wziqltpt binPath= "C:\Windows\SysWOW64\wziqltpt\llkqbpwz.exe /d\"C:\Users\Admin\AppData\Local\Temp\1d7eaebfd2a61cec5b8701148f4226b3.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:3732
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description wziqltpt "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:1604
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start wziqltpt
  2⤵
  - Launches sc.exe
  PID:4692
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:756

C:\Windows\SysWOW64\wziqltpt\llkqbpwz.exe
C:\Windows\SysWOW64\wziqltpt\llkqbpwz.exe /d"C:\Users\Admin\AppData\Local\Temp\1d7eaebfd2a61cec5b8701148f4226b3.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  PID:3444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\llkqbpwz.exe

Filesize
4.3MB

MD5
83c48c6dd846838ead8d2444418d990a

SHA1
86c718ac1858d040427ca054e685dab9a5411598

SHA256
4ff6396fabb36ab8e63763466995cabaef285f09838a58d11ba40bf1c87ecd0a

SHA512
03974f8b9eb9a939a204e566aa69d8f80119704782c521383042f557617b337927ca7d37729e0af23a2bc873be5ba40cad6f9382d17c90b498ddfbb32c92de2b

Download Submit
C:\Windows\SysWOW64\wziqltpt\llkqbpwz.exe

Filesize
2.0MB

MD5
a9c04429794b62f433decaa4248aa2ee

SHA1
d890c097c227f177b1bee6d0ae407aee5f13b60b

SHA256
50f21daf0924b8157963cdaf0df0fdaf08581e3bbbdfa5efce4eb2d86138559b

SHA512
384230ee3adeb02277df4bfd176eac0e944f524a73e7c19e32796a174005302609b8b1ab109b779fcfde20368cd5ab2e88c107b393cb5f0ddee0d4c1ba772e8d

Download Submit
memory/1076-9-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/1076-7-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1076-12-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3444-14-0x0000000000370000-0x0000000000385000-memory.dmp

Filesize
84KB

Download
memory/3444-16-0x0000000000370000-0x0000000000385000-memory.dmp

Filesize
84KB

Download
memory/3444-15-0x0000000000370000-0x0000000000385000-memory.dmp

Filesize
84KB

Download
memory/3444-11-0x0000000000370000-0x0000000000385000-memory.dmp

Filesize
84KB

Download
memory/3444-17-0x0000000000370000-0x0000000000385000-memory.dmp

Filesize
84KB

Download
memory/3444-18-0x0000000000370000-0x0000000000385000-memory.dmp

Filesize
84KB

Download
memory/3448-8-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3448-2-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3448-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3448-1-0x0000000002160000-0x0000000002161000-memory.dmp

Filesize
4KB

Download
memory/3448-3-0x0000000002170000-0x0000000002171000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads