tofsee | 203694f0c55e49f55c8b4d536ad636057b08134ac4af3236b9037ca5dd390cfb

Analysis

max time kernel
184s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 03:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0cde7523f9306133e846dbc71e48eede.exe
Size 11.5MB
Sample231230-dybd2aebb4
SHA256 203694f0c55e49f55c8b4d536ad636057b08134ac4af3236b9037ca5dd390cfb
MD5 0cde7523f9306133e846dbc71e48eede
SHA1 a48b4d47560c026ef8206f7ee2857f5d606f215a
SHA512 03702471ffb32ce08323b278d0c697d892a55d5d0f0a508befb660065805e7c3235c4b712acb4b22434c7be0942b0aeaf084a46161e2b0f521feace252a40c03
SSDEEP 24576:6htJbmFQuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuue:DF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

defeatwax.ru
refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
1532	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\tjjnjtxp\ImagePath = "C:\\Windows\\SysWOW64\\tjjnjtxp\\vnsszrlp.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	0cde7523f9306133e846dbc71e48eede.exe

Deletes itself 1 IoCs

pid	Process
3844	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
4068	vnsszrlp.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4068 set thread context of 3844	4068	vnsszrlp.exe	112

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5012	sc.exe
1100	sc.exe
2008	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4500	4824	WerFault.exe	90
4628	4068	WerFault.exe	107

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 3524	4824	0cde7523f9306133e846dbc71e48eede.exe	93
PID 4824 wrote to memory of 3524	4824	0cde7523f9306133e846dbc71e48eede.exe	93
PID 4824 wrote to memory of 3524	4824	0cde7523f9306133e846dbc71e48eede.exe	93
PID 4824 wrote to memory of 4852	4824	0cde7523f9306133e846dbc71e48eede.exe	96
PID 4824 wrote to memory of 4852	4824	0cde7523f9306133e846dbc71e48eede.exe	96
PID 4824 wrote to memory of 4852	4824	0cde7523f9306133e846dbc71e48eede.exe	96
PID 4824 wrote to memory of 5012	4824	0cde7523f9306133e846dbc71e48eede.exe	98
PID 4824 wrote to memory of 5012	4824	0cde7523f9306133e846dbc71e48eede.exe	98
PID 4824 wrote to memory of 5012	4824	0cde7523f9306133e846dbc71e48eede.exe	98
PID 4824 wrote to memory of 1100	4824	0cde7523f9306133e846dbc71e48eede.exe	100
PID 4824 wrote to memory of 1100	4824	0cde7523f9306133e846dbc71e48eede.exe	100
PID 4824 wrote to memory of 1100	4824	0cde7523f9306133e846dbc71e48eede.exe	100
PID 4824 wrote to memory of 2008	4824	0cde7523f9306133e846dbc71e48eede.exe	102
PID 4824 wrote to memory of 2008	4824	0cde7523f9306133e846dbc71e48eede.exe	102
PID 4824 wrote to memory of 2008	4824	0cde7523f9306133e846dbc71e48eede.exe	102
PID 4824 wrote to memory of 1532	4824	0cde7523f9306133e846dbc71e48eede.exe	104
PID 4824 wrote to memory of 1532	4824	0cde7523f9306133e846dbc71e48eede.exe	104
PID 4824 wrote to memory of 1532	4824	0cde7523f9306133e846dbc71e48eede.exe	104
PID 4068 wrote to memory of 3844	4068	vnsszrlp.exe	112
PID 4068 wrote to memory of 3844	4068	vnsszrlp.exe	112
PID 4068 wrote to memory of 3844	4068	vnsszrlp.exe	112
PID 4068 wrote to memory of 3844	4068	vnsszrlp.exe	112
PID 4068 wrote to memory of 3844	4068	vnsszrlp.exe	112

C:\Users\Admin\AppData\Local\Temp\0cde7523f9306133e846dbc71e48eede.exe
"C:\Users\Admin\AppData\Local\Temp\0cde7523f9306133e846dbc71e48eede.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\tjjnjtxp\
  2⤵
  PID:3524
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\vnsszrlp.exe" C:\Windows\SysWOW64\tjjnjtxp\
  2⤵
  PID:4852
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create tjjnjtxp binPath= "C:\Windows\SysWOW64\tjjnjtxp\vnsszrlp.exe /d\"C:\Users\Admin\AppData\Local\Temp\0cde7523f9306133e846dbc71e48eede.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:5012
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description tjjnjtxp "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:1100
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start tjjnjtxp
  2⤵
  - Launches sc.exe
  PID:2008
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:1532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 1044
  2⤵
  - Program crash
  PID:4500

C:\Windows\SysWOW64\tjjnjtxp\vnsszrlp.exe
C:\Windows\SysWOW64\tjjnjtxp\vnsszrlp.exe /d"C:\Users\Admin\AppData\Local\Temp\0cde7523f9306133e846dbc71e48eede.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  PID:3844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 560
  2⤵
  - Program crash
  PID:4628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4824 -ip 4824
1⤵
PID:3576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4068 -ip 4068
1⤵
PID:948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vnsszrlp.exe

Path C:\Users\Admin\AppData\Local\Temp\vnsszrlp.exe
Size 2.0MB
SHA256 bfb88b94cbd065c843d0addb200ab49f96f1a23adc4e1f3ef66666b47b76b16c
MD5 f97ae834bc0492329d869a222eef7742
SHA1 849aa8360ff880e4be38fb05fcc451d45af91468
SHA512 acf051205a1520b680b94c22d7432b24974d2277348b7d9242be68e5642ee7f382bf7458f84017e227cf206e757472f5124423d46a31b5bf642495660f2e8b49
SSDEEP 24576:ihtJbmFQuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu+:rF
MD5 SHA1 SHA512 SSDEEP

Submit Download

vnsszrlp.exe

Path C:\Windows\SysWOW64\tjjnjtxp\vnsszrlp.exe
Size 10.0MB
SHA256 39191be3fb3770a46ed220bf6cf68e4974424cfca9b2da675c71707350940c53
MD5 2ce112a3bc4582961ce1aaf6135e73f6
SHA1 a146d8df5fba479bc8a4a6bd356cea7cc7e87cbf
SHA512 34613c5f090654565567286e05eb449f12ad869d411245b7586b7bee0cb587780d51f8f2d824e4c01faf522ba783f6c255e74c00a2da707f90d8179b8a5b6d1b
SSDEEP 24576:ihtJbmFQuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu+:rF
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3844-21-0x00000000005D0000-0x00000000005E5000-memory.dmp

Download

memory/3844-20-0x00000000005D0000-0x00000000005E5000-memory.dmp

Download

memory/3844-18-0x00000000005D0000-0x00000000005E5000-memory.dmp

Download

memory/3844-14-0x00000000005D0000-0x00000000005E5000-memory.dmp

Download

memory/4068-13-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/4068-19-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/4068-12-0x00000000005D0000-0x00000000006D0000-memory.dmp

Download

memory/4824-5-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/4824-11-0x00000000005E0000-0x00000000005F3000-memory.dmp

Download

memory/4824-9-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/4824-1-0x0000000000480000-0x0000000000580000-memory.dmp

Download

memory/4824-3-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/4824-2-0x00000000005E0000-0x00000000005F3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads