tofsee | e427622200c88a83c5264c45c0b9fac2f7f0522ec1b0f4ec03a32decb5f9fca6

Analysis

max time kernel
13s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 04:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0dc76217d02be035c40cc9144d29e8e2.exe
Size 14.7MB
Sample231230-emdkpabfe5
SHA256 e427622200c88a83c5264c45c0b9fac2f7f0522ec1b0f4ec03a32decb5f9fca6
MD5 0dc76217d02be035c40cc9144d29e8e2
SHA1 4a0b870c840ecd0f03d045451444122132504cc3
SHA512 208b256722a325c41d379617d134576a99109098944543c04994fc3c725076dfb21987d40537b891bd95e135d0f926ee6355baf8ec644747acd337f3d875d7f9
SSDEEP 49152:ZR8888888888888888888888888888888888888888888888888888888888888D:
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

43.231.4.6
lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
4544	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	0dc76217d02be035c40cc9144d29e8e2.exe

Executes dropped EXE 1 IoCs

pid	Process
3384	pyniutak.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1984	sc.exe
4932	sc.exe
4060	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1216	1528	WerFault.exe	87
4964	3384	WerFault.exe	104

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 1920	1528	0dc76217d02be035c40cc9144d29e8e2.exe	92
PID 1528 wrote to memory of 1920	1528	0dc76217d02be035c40cc9144d29e8e2.exe	92
PID 1528 wrote to memory of 1920	1528	0dc76217d02be035c40cc9144d29e8e2.exe	92
PID 1528 wrote to memory of 2072	1528	0dc76217d02be035c40cc9144d29e8e2.exe	94
PID 1528 wrote to memory of 2072	1528	0dc76217d02be035c40cc9144d29e8e2.exe	94
PID 1528 wrote to memory of 2072	1528	0dc76217d02be035c40cc9144d29e8e2.exe	94
PID 1528 wrote to memory of 1984	1528	0dc76217d02be035c40cc9144d29e8e2.exe	96
PID 1528 wrote to memory of 1984	1528	0dc76217d02be035c40cc9144d29e8e2.exe	96
PID 1528 wrote to memory of 1984	1528	0dc76217d02be035c40cc9144d29e8e2.exe	96
PID 1528 wrote to memory of 4932	1528	Process not Found	99
PID 1528 wrote to memory of 4932	1528	Process not Found	99
PID 1528 wrote to memory of 4932	1528	Process not Found	99
PID 1528 wrote to memory of 4060	1528	Process not Found	101
PID 1528 wrote to memory of 4060	1528	Process not Found	101
PID 1528 wrote to memory of 4060	1528	Process not Found	101

C:\Users\Admin\AppData\Local\Temp\0dc76217d02be035c40cc9144d29e8e2.exe
"C:\Users\Admin\AppData\Local\Temp\0dc76217d02be035c40cc9144d29e8e2.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\epmuiuow\
  2⤵
  PID:1920
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\pyniutak.exe" C:\Windows\SysWOW64\epmuiuow\
  2⤵
  PID:2072
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create epmuiuow binPath= "C:\Windows\SysWOW64\epmuiuow\pyniutak.exe /d\"C:\Users\Admin\AppData\Local\Temp\0dc76217d02be035c40cc9144d29e8e2.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:1984
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description epmuiuow "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:4932
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start epmuiuow
  2⤵
  - Launches sc.exe
  PID:4060
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:4544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 1196
  2⤵
  - Program crash
  PID:1216

C:\Windows\SysWOW64\epmuiuow\pyniutak.exe
C:\Windows\SysWOW64\epmuiuow\pyniutak.exe /d"C:\Users\Admin\AppData\Local\Temp\0dc76217d02be035c40cc9144d29e8e2.exe"
1⤵
- Executes dropped EXE
PID:3384
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:1648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 516
  2⤵
  - Program crash
  PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1528 -ip 1528
1⤵
PID:5084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3384 -ip 3384
1⤵
PID:4680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pyniutak.exe

Path C:\Users\Admin\AppData\Local\Temp\pyniutak.exe
Size 374KB
SHA256 e051db0fb0ccb02f10603d5aacd89ec07ce6b2159f36963d994011e3aeedae9d
MD5 2d5c43f5b46908e62588726a64525429
SHA1 b9e214a385011418dd4e48a39721c3fed8c399ab
SHA512 ca66a03e19da793faf598b818cb6fcccb9d0f361576ad8486c1fad01507548bda2e5704b0ae190ce4dceee98d10fabfa0a06f50ab5295c6bbb14a0006771b8ef
SSDEEP 6144:6Pa61onRNT/p8UbDctJ8H5ogGAvZTX7eX7:6Pa61iPp8m4yjt18
MD5 SHA1 SHA512 SSDEEP

Submit Download

pyniutak.exe

Path C:\Windows\SysWOW64\epmuiuow\pyniutak.exe
Size 123KB
SHA256 63614a2b7e454704dc8f390c8ecf678a8e95de088decd61a21957621105955ec
MD5 26d7ce1e0163e160734a6db4cb6819a4
SHA1 3ba8b6ae0adf697673366fe70abc3a241c8a5a88
SHA512 d4f2cef8635f30fcc23097c48929ba078988508839941713e64ecfca1d625a5cb9c1afbfa9465023fc436acc8915f7d8f4e0ba87f918a796fd58afbdfe262283
SSDEEP 1536:6rqukJsZsuj1Zkx381oAKzFRtDgViPu8Z1p8PK2INXMZAFt/n4hsDz7U:6Pkemu4s1onRNEi/Z1p8CrcZePqsDzg
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1528-1-0x0000000003500000-0x0000000003600000-memory.dmp

Download

memory/1528-2-0x0000000003390000-0x00000000033A3000-memory.dmp

Download

memory/1528-4-0x0000000000400000-0x000000000323C000-memory.dmp

Download

memory/1528-7-0x0000000000400000-0x000000000323C000-memory.dmp

Download

memory/1648-12-0x0000000000610000-0x0000000000625000-memory.dmp

Download

memory/1648-17-0x0000000000610000-0x0000000000625000-memory.dmp

Download

memory/1648-20-0x0000000000610000-0x0000000000625000-memory.dmp

Download

memory/1648-21-0x0000000000610000-0x0000000000625000-memory.dmp

Download

memory/1648-22-0x0000000000610000-0x0000000000625000-memory.dmp

Download

memory/3384-9-0x0000000003580000-0x0000000003680000-memory.dmp

Download

memory/3384-11-0x0000000000400000-0x000000000323C000-memory.dmp

Download

memory/3384-10-0x0000000003B10000-0x0000000003B23000-memory.dmp

Download

memory/3384-13-0x0000000000400000-0x000000000323C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads