tofsee | 7ec2f5fa69e89fa6c3e23ff269f55517ad6ccf833db9c33d13abeae3fe0eaf0f

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 10:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
15abd71fa9afdedfbc3f64e46c477ded.exe
Size 10.7MB
Sample231230-mcghlagahn
SHA256 7ec2f5fa69e89fa6c3e23ff269f55517ad6ccf833db9c33d13abeae3fe0eaf0f
MD5 15abd71fa9afdedfbc3f64e46c477ded
SHA1 4497a99e9a59dd93c0cf04ea356f491ae39bf709
SHA512 51f6016b01d29ca1d0b3f233de56fcf8fa9d31ed104f1a8be7c0f8fbe6ab15a4d6d0e2ba98bb5f759f180d9e1a8faa1b41ea523aba8b6b37e2beebed74c0f89d
SSDEEP 6144:tvk9RADRUv1CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCP:uRAD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

43.231.4.7
lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\spjoxhoo = "0"	svchost.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
2684	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\spjoxhoo\ImagePath = "C:\\Windows\\SysWOW64\\spjoxhoo\\lsffitlg.exe"	svchost.exe

Deletes itself 1 IoCs

pid	Process
2664	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2800	lsffitlg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2800 set thread context of 2664	2800	lsffitlg.exe	41

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2692	sc.exe
2788	sc.exe
2672	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2236	2512	15abd71fa9afdedfbc3f64e46c477ded.exe	28
PID 2512 wrote to memory of 2236	2512	15abd71fa9afdedfbc3f64e46c477ded.exe	28
PID 2512 wrote to memory of 2236	2512	15abd71fa9afdedfbc3f64e46c477ded.exe	28
PID 2512 wrote to memory of 2236	2512	15abd71fa9afdedfbc3f64e46c477ded.exe	28
PID 2512 wrote to memory of 1800	2512	15abd71fa9afdedfbc3f64e46c477ded.exe	30
PID 2512 wrote to memory of 1800	2512	15abd71fa9afdedfbc3f64e46c477ded.exe	30
PID 2512 wrote to memory of 1800	2512	15abd71fa9afdedfbc3f64e46c477ded.exe	30
PID 2512 wrote to memory of 1800	2512	15abd71fa9afdedfbc3f64e46c477ded.exe	30
PID 2512 wrote to memory of 2692	2512	15abd71fa9afdedfbc3f64e46c477ded.exe	32
PID 2512 wrote to memory of 2692	2512	15abd71fa9afdedfbc3f64e46c477ded.exe	32
PID 2512 wrote to memory of 2692	2512	15abd71fa9afdedfbc3f64e46c477ded.exe	32
PID 2512 wrote to memory of 2692	2512	15abd71fa9afdedfbc3f64e46c477ded.exe	32
PID 2512 wrote to memory of 2788	2512	15abd71fa9afdedfbc3f64e46c477ded.exe	34
PID 2512 wrote to memory of 2788	2512	15abd71fa9afdedfbc3f64e46c477ded.exe	34
PID 2512 wrote to memory of 2788	2512	15abd71fa9afdedfbc3f64e46c477ded.exe	34
PID 2512 wrote to memory of 2788	2512	15abd71fa9afdedfbc3f64e46c477ded.exe	34
PID 2512 wrote to memory of 2672	2512	15abd71fa9afdedfbc3f64e46c477ded.exe	36
PID 2512 wrote to memory of 2672	2512	15abd71fa9afdedfbc3f64e46c477ded.exe	36
PID 2512 wrote to memory of 2672	2512	15abd71fa9afdedfbc3f64e46c477ded.exe	36
PID 2512 wrote to memory of 2672	2512	15abd71fa9afdedfbc3f64e46c477ded.exe	36
PID 2800 wrote to memory of 2664	2800	lsffitlg.exe	41
PID 2800 wrote to memory of 2664	2800	lsffitlg.exe	41
PID 2800 wrote to memory of 2664	2800	lsffitlg.exe	41
PID 2800 wrote to memory of 2664	2800	lsffitlg.exe	41
PID 2800 wrote to memory of 2664	2800	lsffitlg.exe	41
PID 2800 wrote to memory of 2664	2800	lsffitlg.exe	41
PID 2512 wrote to memory of 2684	2512	15abd71fa9afdedfbc3f64e46c477ded.exe	40
PID 2512 wrote to memory of 2684	2512	15abd71fa9afdedfbc3f64e46c477ded.exe	40
PID 2512 wrote to memory of 2684	2512	15abd71fa9afdedfbc3f64e46c477ded.exe	40
PID 2512 wrote to memory of 2684	2512	15abd71fa9afdedfbc3f64e46c477ded.exe	40

C:\Users\Admin\AppData\Local\Temp\15abd71fa9afdedfbc3f64e46c477ded.exe
"C:\Users\Admin\AppData\Local\Temp\15abd71fa9afdedfbc3f64e46c477ded.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\spjoxhoo\
  2⤵
  PID:2236
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\lsffitlg.exe" C:\Windows\SysWOW64\spjoxhoo\
  2⤵
  PID:1800
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create spjoxhoo binPath= "C:\Windows\SysWOW64\spjoxhoo\lsffitlg.exe /d\"C:\Users\Admin\AppData\Local\Temp\15abd71fa9afdedfbc3f64e46c477ded.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:2692
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description spjoxhoo "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2788
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start spjoxhoo
  2⤵
  - Launches sc.exe
  PID:2672
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:2684

C:\Windows\SysWOW64\spjoxhoo\lsffitlg.exe
C:\Windows\SysWOW64\spjoxhoo\lsffitlg.exe /d"C:\Users\Admin\AppData\Local\Temp\15abd71fa9afdedfbc3f64e46c477ded.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Windows security bypass
  - Sets service image path in registry
  - Deletes itself
  PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsffitlg.exe

Path C:\Users\Admin\AppData\Local\Temp\lsffitlg.exe
Size 2.2MB
SHA256 a0b74d276ee46a986fa90423b1587f75e7a61188197fd6000fa542572273535d
MD5 0deeaa4b5456f21884e46170e5dab986
SHA1 fd3e3cdbca195dd59fb55fdce4e96e223f2f87a6
SHA512 d0f9d0b0e168f364f95491c33ba816ebf05875c2df1336e94745dc75a9c376301b35aa8ab7b51d583081d352bd0fdddd4874e61a2525d7b07eba21dfe9419053
SSDEEP 6144:cvk9RADRUv1CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC+:dRADf
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsffitlg.exe

Path C:\Windows\SysWOW64\spjoxhoo\lsffitlg.exe
Size 443KB
SHA256 8645979e4834a64c8551352a9c93c0b08b327a90e620be701947060ecc52270f
MD5 84edae3674cbdfb424d1ad1e0de6c478
SHA1 600f79c6feee9fb7a7bf6c65bc49ec4709e79248
SHA512 33947a85f986b2f89f7f277a18ffb51acedd851216ccc34e34b66abbe52da198eddc20013839335f2c29cf275c9070ffd80efb5e724bf2b022115960fb404821
SSDEEP 6144:cvk9RADRUv1CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCJ:dRAD0
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2512-2-0x0000000000260000-0x0000000000261000-memory.dmp

Download

memory/2512-1-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2512-0-0x0000000000250000-0x0000000000251000-memory.dmp

Download

memory/2512-16-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2664-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2664-15-0x0000000000080000-0x0000000000095000-memory.dmp

Download

memory/2664-11-0x0000000000080000-0x0000000000095000-memory.dmp

Download

memory/2664-8-0x0000000000080000-0x0000000000095000-memory.dmp

Download

memory/2664-18-0x0000000000080000-0x0000000000095000-memory.dmp

Download

memory/2664-17-0x0000000000080000-0x0000000000095000-memory.dmp

Download

memory/2664-19-0x0000000000080000-0x0000000000095000-memory.dmp

Download

memory/2800-13-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2800-7-0x00000000005E0000-0x00000000005E1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads