tofsee | e254728f6f9e3a2a0e2add68c71cb9901fc89e74518e9bfa5ff65505c217c41c

Analysis

max time kernel
153s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 02:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fc3952f3e3c67a63a838d5cbf390b675.exe
Size 14.4MB
Sample231230-czacpafbb3
SHA256 e254728f6f9e3a2a0e2add68c71cb9901fc89e74518e9bfa5ff65505c217c41c
MD5 fc3952f3e3c67a63a838d5cbf390b675
SHA1 c27d62c6c6382a853603139bd5d179ad77c077b8
SHA512 c546ebe17819c78123abbaa198cd55f1d108585596cd1964f594f5dae6e0546d1defdabc76b0c9bea801ccc8de9a8ed2761b477afd3dd8f560a340d407c13708
SSDEEP 98304:Yjhd88888888888888888888888888888888888888888888888888888888888I:Y
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

176.111.174.19
lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
5112	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xwlicjwq\ImagePath = "C:\\Windows\\SysWOW64\\xwlicjwq\\vqmtfpds.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	fc3952f3e3c67a63a838d5cbf390b675.exe

Deletes itself 1 IoCs

pid	Process
1580	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2808	vqmtfpds.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2808 set thread context of 1580	2808	vqmtfpds.exe	111

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4980	sc.exe
1732	sc.exe
2760	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2340	2120	WerFault.exe	87
1340	2808	WerFault.exe	105

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 3560	2120	fc3952f3e3c67a63a838d5cbf390b675.exe	93
PID 2120 wrote to memory of 3560	2120	fc3952f3e3c67a63a838d5cbf390b675.exe	93
PID 2120 wrote to memory of 3560	2120	fc3952f3e3c67a63a838d5cbf390b675.exe	93
PID 2120 wrote to memory of 3648	2120	fc3952f3e3c67a63a838d5cbf390b675.exe	95
PID 2120 wrote to memory of 3648	2120	fc3952f3e3c67a63a838d5cbf390b675.exe	95
PID 2120 wrote to memory of 3648	2120	fc3952f3e3c67a63a838d5cbf390b675.exe	95
PID 2120 wrote to memory of 4980	2120	fc3952f3e3c67a63a838d5cbf390b675.exe	100
PID 2120 wrote to memory of 4980	2120	fc3952f3e3c67a63a838d5cbf390b675.exe	100
PID 2120 wrote to memory of 4980	2120	fc3952f3e3c67a63a838d5cbf390b675.exe	100
PID 2120 wrote to memory of 1732	2120	fc3952f3e3c67a63a838d5cbf390b675.exe	101
PID 2120 wrote to memory of 1732	2120	fc3952f3e3c67a63a838d5cbf390b675.exe	101
PID 2120 wrote to memory of 1732	2120	fc3952f3e3c67a63a838d5cbf390b675.exe	101
PID 2120 wrote to memory of 2760	2120	fc3952f3e3c67a63a838d5cbf390b675.exe	103
PID 2120 wrote to memory of 2760	2120	fc3952f3e3c67a63a838d5cbf390b675.exe	103
PID 2120 wrote to memory of 2760	2120	fc3952f3e3c67a63a838d5cbf390b675.exe	103
PID 2120 wrote to memory of 5112	2120	fc3952f3e3c67a63a838d5cbf390b675.exe	107
PID 2120 wrote to memory of 5112	2120	fc3952f3e3c67a63a838d5cbf390b675.exe	107
PID 2120 wrote to memory of 5112	2120	fc3952f3e3c67a63a838d5cbf390b675.exe	107
PID 2808 wrote to memory of 1580	2808	vqmtfpds.exe	111
PID 2808 wrote to memory of 1580	2808	vqmtfpds.exe	111
PID 2808 wrote to memory of 1580	2808	vqmtfpds.exe	111
PID 2808 wrote to memory of 1580	2808	vqmtfpds.exe	111
PID 2808 wrote to memory of 1580	2808	vqmtfpds.exe	111

C:\Users\Admin\AppData\Local\Temp\fc3952f3e3c67a63a838d5cbf390b675.exe
"C:\Users\Admin\AppData\Local\Temp\fc3952f3e3c67a63a838d5cbf390b675.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\xwlicjwq\
  2⤵
  PID:3560
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\vqmtfpds.exe" C:\Windows\SysWOW64\xwlicjwq\
  2⤵
  PID:3648
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create xwlicjwq binPath= "C:\Windows\SysWOW64\xwlicjwq\vqmtfpds.exe /d\"C:\Users\Admin\AppData\Local\Temp\fc3952f3e3c67a63a838d5cbf390b675.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:4980
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description xwlicjwq "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:1732
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start xwlicjwq
  2⤵
  - Launches sc.exe
  PID:2760
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:5112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 1204
  2⤵
  - Program crash
  PID:2340

C:\Windows\SysWOW64\xwlicjwq\vqmtfpds.exe
C:\Windows\SysWOW64\xwlicjwq\vqmtfpds.exe /d"C:\Users\Admin\AppData\Local\Temp\fc3952f3e3c67a63a838d5cbf390b675.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  PID:1580
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 520
  2⤵
  - Program crash
  PID:1340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2120 -ip 2120
1⤵
PID:3460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2808 -ip 2808
1⤵
PID:1692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vqmtfpds.exe

Path C:\Users\Admin\AppData\Local\Temp\vqmtfpds.exe
Size 9.9MB
SHA256 0a41ffbc5f9297cb887139a3a8455ab0516a4aae6f3c72c97954e51fe6c13dd1
MD5 226922f29af380942aea37764a519619
SHA1 b6216130937c981adb38f82f0b8eb5cdf8edb47b
SHA512 53d1f3b7f1a404bc5d8c30f70abc8da936819f1fe91cdb0ced0272296ffb80506e7abad7f5d34b9bcf67bfa938a9423a10f1018bdd33bb14267049c701d92bd5
SSDEEP 98304:Qjhd888888888888888888888888888888888888888888888888888888888886:QZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

vqmtfpds.exe

Path C:\Windows\SysWOW64\xwlicjwq\vqmtfpds.exe
Size 2.7MB
SHA256 f1b6fb89bd04ee07e690d7f8a464fadb5fb18886e46c3512de791138abdf958d
MD5 83fbe49d2670d87d2f1c924daac2160c
SHA1 a1edaafd1b562706dc950b2131a1eac9062baa17
SHA512 7054036210d66e44e6b89da0f5c7d5a342c9c27fc7e8a70d9bce2599eefb5079d8919d31d7fb756c7f05ceb5fe7671797f23e7a5e8467e58c75391e6b37d0b65
SSDEEP 49152:QjhzR8888888888888888888888888888888888888888888888888888888888f:Qjhd888888888888888888888888888I
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1580-12-0x00000000001D0000-0x00000000001E5000-memory.dmp

Download

memory/1580-15-0x00000000001D0000-0x00000000001E5000-memory.dmp

Download

memory/1580-18-0x00000000001D0000-0x00000000001E5000-memory.dmp

Download

memory/1580-19-0x00000000001D0000-0x00000000001E5000-memory.dmp

Download

memory/1580-20-0x00000000001D0000-0x00000000001E5000-memory.dmp

Download

memory/2120-3-0x0000000000400000-0x000000000045D000-memory.dmp

Download

memory/2120-2-0x0000000000700000-0x0000000000713000-memory.dmp

Download

memory/2120-8-0x0000000000400000-0x000000000045D000-memory.dmp

Download

memory/2120-1-0x0000000000750000-0x0000000000850000-memory.dmp

Download

memory/2808-9-0x0000000000400000-0x000000000045D000-memory.dmp

Download

memory/2808-10-0x0000000000750000-0x0000000000850000-memory.dmp

Download

memory/2808-11-0x00000000005B0000-0x00000000005C3000-memory.dmp

Download

memory/2808-17-0x0000000000400000-0x000000000045D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads