tofsee | e3a865793575dddcdb926aee82c24accb320862e047141baf615e77e0a511f95

Analysis

max time kernel
235s
max time network
265s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 02:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0bcfea1fc56a9a1e848ec7f654f63ab0.exe
Size 14.5MB
Sample231230-c2jddaffg5
SHA256 e3a865793575dddcdb926aee82c24accb320862e047141baf615e77e0a511f95
MD5 0bcfea1fc56a9a1e848ec7f654f63ab0
SHA1 ed727b4cb6319c1c5957d515b34f0e464fa1581e
SHA512 6d21b2fb9ed005f2e2b9363527d763220e69f2a5df0843ddd1c8d049ec4f7f10de0b9a2e2abaf7bee6bdbf37ec0033cecc2c8238fa896912d31670a1c724e728
SSDEEP 12288:WKBz1FxKfGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGm:9Bz1Fx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

43.231.4.7
lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
3660	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xpmggtgv\ImagePath = "C:\\Windows\\SysWOW64\\xpmggtgv\\gbfxnyay.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	0bcfea1fc56a9a1e848ec7f654f63ab0.exe

Deletes itself 1 IoCs

pid	Process
5000	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
5040	gbfxnyay.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5040 set thread context of 5000	5040	gbfxnyay.exe	114

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
116	sc.exe
3644	sc.exe
4328	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3604	3004	WerFault.exe	89
4324	5040	WerFault.exe	112

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 3700	3004	0bcfea1fc56a9a1e848ec7f654f63ab0.exe	96
PID 3004 wrote to memory of 3700	3004	0bcfea1fc56a9a1e848ec7f654f63ab0.exe	96
PID 3004 wrote to memory of 3700	3004	0bcfea1fc56a9a1e848ec7f654f63ab0.exe	96
PID 3004 wrote to memory of 224	3004	0bcfea1fc56a9a1e848ec7f654f63ab0.exe	98
PID 3004 wrote to memory of 224	3004	0bcfea1fc56a9a1e848ec7f654f63ab0.exe	98
PID 3004 wrote to memory of 224	3004	0bcfea1fc56a9a1e848ec7f654f63ab0.exe	98
PID 3004 wrote to memory of 4328	3004	0bcfea1fc56a9a1e848ec7f654f63ab0.exe	101
PID 3004 wrote to memory of 4328	3004	0bcfea1fc56a9a1e848ec7f654f63ab0.exe	101
PID 3004 wrote to memory of 4328	3004	0bcfea1fc56a9a1e848ec7f654f63ab0.exe	101
PID 3004 wrote to memory of 116	3004	0bcfea1fc56a9a1e848ec7f654f63ab0.exe	104
PID 3004 wrote to memory of 116	3004	0bcfea1fc56a9a1e848ec7f654f63ab0.exe	104
PID 3004 wrote to memory of 116	3004	0bcfea1fc56a9a1e848ec7f654f63ab0.exe	104
PID 3004 wrote to memory of 3644	3004	0bcfea1fc56a9a1e848ec7f654f63ab0.exe	105
PID 3004 wrote to memory of 3644	3004	0bcfea1fc56a9a1e848ec7f654f63ab0.exe	105
PID 3004 wrote to memory of 3644	3004	0bcfea1fc56a9a1e848ec7f654f63ab0.exe	105
PID 3004 wrote to memory of 3660	3004	0bcfea1fc56a9a1e848ec7f654f63ab0.exe	108
PID 3004 wrote to memory of 3660	3004	0bcfea1fc56a9a1e848ec7f654f63ab0.exe	108
PID 3004 wrote to memory of 3660	3004	0bcfea1fc56a9a1e848ec7f654f63ab0.exe	108
PID 5040 wrote to memory of 5000	5040	gbfxnyay.exe	114
PID 5040 wrote to memory of 5000	5040	gbfxnyay.exe	114
PID 5040 wrote to memory of 5000	5040	gbfxnyay.exe	114
PID 5040 wrote to memory of 5000	5040	gbfxnyay.exe	114
PID 5040 wrote to memory of 5000	5040	gbfxnyay.exe	114

C:\Users\Admin\AppData\Local\Temp\0bcfea1fc56a9a1e848ec7f654f63ab0.exe
"C:\Users\Admin\AppData\Local\Temp\0bcfea1fc56a9a1e848ec7f654f63ab0.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\xpmggtgv\
  2⤵
  PID:3700
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\gbfxnyay.exe" C:\Windows\SysWOW64\xpmggtgv\
  2⤵
  PID:224
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create xpmggtgv binPath= "C:\Windows\SysWOW64\xpmggtgv\gbfxnyay.exe /d\"C:\Users\Admin\AppData\Local\Temp\0bcfea1fc56a9a1e848ec7f654f63ab0.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:4328
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description xpmggtgv "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:116
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start xpmggtgv
  2⤵
  - Launches sc.exe
  PID:3644
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:3660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 1272
  2⤵
  - Program crash
  PID:3604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3004 -ip 3004
1⤵
PID:4240

C:\Windows\SysWOW64\xpmggtgv\gbfxnyay.exe
C:\Windows\SysWOW64\xpmggtgv\gbfxnyay.exe /d"C:\Users\Admin\AppData\Local\Temp\0bcfea1fc56a9a1e848ec7f654f63ab0.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  PID:5000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 516
  2⤵
  - Program crash
  PID:4324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5040 -ip 5040
1⤵
PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gbfxnyay.exe

Path C:\Users\Admin\AppData\Local\Temp\gbfxnyay.exe
Size 356KB
SHA256 34348f1fd6d9e26c172123bba881b0257444103570162c459ca953bde5283b46
MD5 cfdbc86450b4c3f8710d89c33a0c8ffc
SHA1 ae30e10a17ae1ff78245893a99f129351311db2b
SHA512 9d7e92c3403155becfe46c8c9a1d29388f2360d48352b6ce0251143e5255010c3aee4acc283b2e508eb493a9e822dfb4c5b50bb1107a275850fc0a7315901eeb
SSDEEP 6144:7TfGM8BHdvtFxrePUmrGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGD:7KBz1FxKfGGGGGGGGGGGGGGGGGGGGGGz
MD5 SHA1 SHA512 SSDEEP

Submit Download

gbfxnyay.exe

Path C:\Windows\SysWOW64\xpmggtgv\gbfxnyay.exe
Size 810KB
SHA256 c7d8851e10e12186312024ba52d80693bb8e9d5e1ee5ea6a33ce06cb1f9f2cd1
MD5 ba16b8de98cfcd04471fce451fafcb45
SHA1 5093e0e497e8cc33d94dfe9b17b7717ed4918226
SHA512 d1f6bd25deb605a0b0a3c2b59d942ac711f2c048d5f650f5d667d37b1cae809695f33e74a432147952d9a99c9e54429bfd5e60ccfe794ceb0c14a6dfc5d34527
SSDEEP 12288:7KBz1FxKfGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGs:+Bz1FxR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3004-11-0x0000000003460000-0x0000000003473000-memory.dmp

Download

memory/3004-12-0x0000000000400000-0x0000000003348000-memory.dmp

Download

memory/3004-6-0x0000000000400000-0x0000000003348000-memory.dmp

Download

memory/3004-7-0x0000000000400000-0x0000000003348000-memory.dmp

Download

memory/3004-3-0x0000000003460000-0x0000000003473000-memory.dmp

Download

memory/3004-10-0x0000000003670000-0x0000000003770000-memory.dmp

Download

memory/3004-0-0x0000000000400000-0x0000000003348000-memory.dmp

Download

memory/3004-5-0x0000000000400000-0x0000000003348000-memory.dmp

Download

memory/3004-2-0x0000000003670000-0x0000000003770000-memory.dmp

Download

memory/5000-19-0x0000000000700000-0x0000000000715000-memory.dmp

Download

memory/5000-25-0x0000000000700000-0x0000000000715000-memory.dmp

Download

memory/5000-30-0x0000000000700000-0x0000000000715000-memory.dmp

Download

memory/5000-31-0x0000000000700000-0x0000000000715000-memory.dmp

Download

memory/5040-23-0x00000000035A0000-0x00000000036A0000-memory.dmp

Download

memory/5040-22-0x0000000000400000-0x0000000003348000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads