tofsee | 8e89af2f025980f2da8a9b1a64e8dae8b4b2adabfd5d05249f33623184861908

Analysis

max time kernel
10s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 10:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
15de9ae1eeada687aa5ac2e9bad394ae.exe
Size 214KB
Sample231230-mgm6yahccm
SHA256 8e89af2f025980f2da8a9b1a64e8dae8b4b2adabfd5d05249f33623184861908
MD5 15de9ae1eeada687aa5ac2e9bad394ae
SHA1 dac4099c676593d3ec91b8c53d0c6a1e7dba48ba
SHA512 3894f8aff4a787c6261f88e4e3e03d92f5d557c5364550499c0cd0579ae245b2d5a4cdc674805e645647fb3d1be47ea34aba0cddc59507ab109826dbe19413fd
SSDEEP 3072:QPrrj3XS00qsd5HL1pETv5owmPoqm/WWaArywoOLi6:wj3XStf7HLvGGtg3WzRwoOL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

defeatwax.ru
refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
2192	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	15de9ae1eeada687aa5ac2e9bad394ae.exe

Deletes itself 1 IoCs

pid	Process
1852	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
1564	vnsszrlp.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1564 set thread context of 1852	1564	vnsszrlp.exe	113

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3536	sc.exe
4896	sc.exe
2052	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3936	2984	WerFault.exe	14
3320	1564	WerFault.exe	103

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 60	2984	15de9ae1eeada687aa5ac2e9bad394ae.exe	55
PID 2984 wrote to memory of 60	2984	15de9ae1eeada687aa5ac2e9bad394ae.exe	55
PID 2984 wrote to memory of 60	2984	15de9ae1eeada687aa5ac2e9bad394ae.exe	55
PID 2984 wrote to memory of 2920	2984	15de9ae1eeada687aa5ac2e9bad394ae.exe	65
PID 2984 wrote to memory of 2920	2984	15de9ae1eeada687aa5ac2e9bad394ae.exe	65
PID 2984 wrote to memory of 2920	2984	15de9ae1eeada687aa5ac2e9bad394ae.exe	65
PID 2984 wrote to memory of 4896	2984	15de9ae1eeada687aa5ac2e9bad394ae.exe	87
PID 2984 wrote to memory of 4896	2984	15de9ae1eeada687aa5ac2e9bad394ae.exe	87
PID 2984 wrote to memory of 4896	2984	15de9ae1eeada687aa5ac2e9bad394ae.exe	87
PID 2984 wrote to memory of 2052	2984	15de9ae1eeada687aa5ac2e9bad394ae.exe	97
PID 2984 wrote to memory of 2052	2984	15de9ae1eeada687aa5ac2e9bad394ae.exe	97
PID 2984 wrote to memory of 2052	2984	15de9ae1eeada687aa5ac2e9bad394ae.exe	97
PID 2984 wrote to memory of 3536	2984	15de9ae1eeada687aa5ac2e9bad394ae.exe	102
PID 2984 wrote to memory of 3536	2984	15de9ae1eeada687aa5ac2e9bad394ae.exe	102
PID 2984 wrote to memory of 3536	2984	15de9ae1eeada687aa5ac2e9bad394ae.exe	102
PID 2984 wrote to memory of 2192	2984	15de9ae1eeada687aa5ac2e9bad394ae.exe	108
PID 2984 wrote to memory of 2192	2984	15de9ae1eeada687aa5ac2e9bad394ae.exe	108
PID 2984 wrote to memory of 2192	2984	15de9ae1eeada687aa5ac2e9bad394ae.exe	108
PID 1564 wrote to memory of 1852	1564	vnsszrlp.exe	113
PID 1564 wrote to memory of 1852	1564	vnsszrlp.exe	113
PID 1564 wrote to memory of 1852	1564	vnsszrlp.exe	113
PID 1564 wrote to memory of 1852	1564	vnsszrlp.exe	113
PID 1564 wrote to memory of 1852	1564	vnsszrlp.exe	113

C:\Users\Admin\AppData\Local\Temp\15de9ae1eeada687aa5ac2e9bad394ae.exe
"C:\Users\Admin\AppData\Local\Temp\15de9ae1eeada687aa5ac2e9bad394ae.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\arrybcpv\
  2⤵
  PID:60
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\vnsszrlp.exe" C:\Windows\SysWOW64\arrybcpv\
  2⤵
  PID:2920
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create arrybcpv binPath= "C:\Windows\SysWOW64\arrybcpv\vnsszrlp.exe /d\"C:\Users\Admin\AppData\Local\Temp\15de9ae1eeada687aa5ac2e9bad394ae.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:4896
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description arrybcpv "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2052
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start arrybcpv
  2⤵
  - Launches sc.exe
  PID:3536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 660
  2⤵
  - Program crash
  PID:3936
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:2192

C:\Windows\SysWOW64\arrybcpv\vnsszrlp.exe
C:\Windows\SysWOW64\arrybcpv\vnsszrlp.exe /d"C:\Users\Admin\AppData\Local\Temp\15de9ae1eeada687aa5ac2e9bad394ae.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Deletes itself
  PID:1852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1564 -s 520
  2⤵
  - Program crash
  PID:3320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2984 -ip 2984
1⤵
PID:3624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1564 -ip 1564
1⤵
PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vnsszrlp.exe

Path C:\Users\Admin\AppData\Local\Temp\vnsszrlp.exe
Size 92KB
SHA256 e847640b731a6d995728cf9f23d208a7ab7e7180f677dbdc08a8fe5458949175
MD5 d2341d4a4d57e47ed65d6d2caae13207
SHA1 7a4c32a8011f9bc1c7c6d109e6b64460e8f0cb3b
SHA512 37e915075664d8a2c3e4fa76903ace59c3cb9c06df6ef615fc154abadffb7a0e76e5d9cbd551a728cbdce3f33eb2d4d6f4bdb3b19d5812640cf4341693c9389e
SSDEEP 1536:2EZRnrrOvIpx1C/GXSRPeIxqyRrJbYxU8uY:jPrrj3XS00qsde
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1564-15-0x0000000000400000-0x0000000002C6D000-memory.dmp

Download

memory/1564-10-0x0000000002DA0000-0x0000000002EA0000-memory.dmp

Download

memory/1564-18-0x0000000000400000-0x0000000002C6D000-memory.dmp

Download

memory/1852-17-0x0000000001250000-0x0000000001265000-memory.dmp

Download

memory/1852-14-0x0000000001250000-0x0000000001265000-memory.dmp

Download

memory/1852-16-0x0000000001250000-0x0000000001265000-memory.dmp

Download

memory/1852-11-0x0000000001250000-0x0000000001265000-memory.dmp

Download

memory/1852-19-0x0000000001250000-0x0000000001265000-memory.dmp

Download

memory/2984-9-0x0000000004870000-0x0000000004883000-memory.dmp

Download

memory/2984-8-0x0000000000400000-0x0000000002C6D000-memory.dmp

Download

memory/2984-2-0x0000000004870000-0x0000000004883000-memory.dmp

Download

memory/2984-4-0x0000000000400000-0x0000000002C6D000-memory.dmp

Download

memory/2984-1-0x0000000002D90000-0x0000000002E90000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads