tofsee | 02447f8d1ef4148ef09948fe2bdd57ed15e3b4f6fd86db9c4ef81004a43a0d6d

Analysis

max time kernel
144s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 13:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1a6060726c5693529f35ca4c0a90637e.exe
Size

11.8MB
MD5

1a6060726c5693529f35ca4c0a90637e
SHA1

34d52fd089ae855f763caef6eb2a5a3e24092b0e
SHA256

02447f8d1ef4148ef09948fe2bdd57ed15e3b4f6fd86db9c4ef81004a43a0d6d
SHA512

d49ba36c91421a48f817a3704f2df101e8d646e981025425b776050fa4f9d7d42822ad3e5c3d5ebb701f3dd4a26f3cd78993f6840826484887400c4847449698
SSDEEP

6144:0KTDS3aiZOTXbKdags2FNxWUWF5zoINm/nu:hMaiZOT+dags21Wts9vu

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

defeatwax.ru

refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\wmnkuykq = "0"	svchost.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
2568	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wmnkuykq\ImagePath = "C:\\Windows\\SysWOW64\\wmnkuykq\\nixhmrjh.exe"	svchost.exe

Deletes itself 1 IoCs

pid	Process
2552	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2672	nixhmrjh.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2672 set thread context of 2552	2672	nixhmrjh.exe	41

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2692	sc.exe
2828	sc.exe
2784	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2628	2332	1a6060726c5693529f35ca4c0a90637e.exe	28
PID 2332 wrote to memory of 2628	2332	1a6060726c5693529f35ca4c0a90637e.exe	28
PID 2332 wrote to memory of 2628	2332	1a6060726c5693529f35ca4c0a90637e.exe	28
PID 2332 wrote to memory of 2628	2332	1a6060726c5693529f35ca4c0a90637e.exe	28
PID 2332 wrote to memory of 2680	2332	1a6060726c5693529f35ca4c0a90637e.exe	30
PID 2332 wrote to memory of 2680	2332	1a6060726c5693529f35ca4c0a90637e.exe	30
PID 2332 wrote to memory of 2680	2332	1a6060726c5693529f35ca4c0a90637e.exe	30
PID 2332 wrote to memory of 2680	2332	1a6060726c5693529f35ca4c0a90637e.exe	30
PID 2332 wrote to memory of 2692	2332	1a6060726c5693529f35ca4c0a90637e.exe	32
PID 2332 wrote to memory of 2692	2332	1a6060726c5693529f35ca4c0a90637e.exe	32
PID 2332 wrote to memory of 2692	2332	1a6060726c5693529f35ca4c0a90637e.exe	32
PID 2332 wrote to memory of 2692	2332	1a6060726c5693529f35ca4c0a90637e.exe	32
PID 2332 wrote to memory of 2828	2332	1a6060726c5693529f35ca4c0a90637e.exe	34
PID 2332 wrote to memory of 2828	2332	1a6060726c5693529f35ca4c0a90637e.exe	34
PID 2332 wrote to memory of 2828	2332	1a6060726c5693529f35ca4c0a90637e.exe	34
PID 2332 wrote to memory of 2828	2332	1a6060726c5693529f35ca4c0a90637e.exe	34
PID 2332 wrote to memory of 2784	2332	1a6060726c5693529f35ca4c0a90637e.exe	36
PID 2332 wrote to memory of 2784	2332	1a6060726c5693529f35ca4c0a90637e.exe	36
PID 2332 wrote to memory of 2784	2332	1a6060726c5693529f35ca4c0a90637e.exe	36
PID 2332 wrote to memory of 2784	2332	1a6060726c5693529f35ca4c0a90637e.exe	36
PID 2332 wrote to memory of 2568	2332	1a6060726c5693529f35ca4c0a90637e.exe	38
PID 2332 wrote to memory of 2568	2332	1a6060726c5693529f35ca4c0a90637e.exe	38
PID 2332 wrote to memory of 2568	2332	1a6060726c5693529f35ca4c0a90637e.exe	38
PID 2332 wrote to memory of 2568	2332	1a6060726c5693529f35ca4c0a90637e.exe	38
PID 2672 wrote to memory of 2552	2672	nixhmrjh.exe	41
PID 2672 wrote to memory of 2552	2672	nixhmrjh.exe	41
PID 2672 wrote to memory of 2552	2672	nixhmrjh.exe	41
PID 2672 wrote to memory of 2552	2672	nixhmrjh.exe	41
PID 2672 wrote to memory of 2552	2672	nixhmrjh.exe	41
PID 2672 wrote to memory of 2552	2672	nixhmrjh.exe	41

C:\Users\Admin\AppData\Local\Temp\1a6060726c5693529f35ca4c0a90637e.exe
"C:\Users\Admin\AppData\Local\Temp\1a6060726c5693529f35ca4c0a90637e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\wmnkuykq\
  2⤵
  PID:2628
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\nixhmrjh.exe" C:\Windows\SysWOW64\wmnkuykq\
  2⤵
  PID:2680
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create wmnkuykq binPath= "C:\Windows\SysWOW64\wmnkuykq\nixhmrjh.exe /d\"C:\Users\Admin\AppData\Local\Temp\1a6060726c5693529f35ca4c0a90637e.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:2692
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description wmnkuykq "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2828
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start wmnkuykq
  2⤵
  - Launches sc.exe
  PID:2784
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:2568

C:\Windows\SysWOW64\wmnkuykq\nixhmrjh.exe
C:\Windows\SysWOW64\wmnkuykq\nixhmrjh.exe /d"C:\Users\Admin\AppData\Local\Temp\1a6060726c5693529f35ca4c0a90637e.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Windows security bypass
  - Sets service image path in registry
  - Deletes itself
  PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nixhmrjh.exe

Filesize
13.8MB

MD5
5c446a3265365bd727214be85e32b37c

SHA1
49c74ac10db3dd15e75426dd472adee06e1629a5

SHA256
690db98b341d1e173cf2f28b870ef79003a280d45206f7d568373b850c6e3756

SHA512
e95d2688f6a38f0b70fe083a17582409ee36c2e55fdc216e20b1842055b38fe0aee75a7c893a1d0d48f378cd5b8dc2278b6463f2ac6d243fa6daec1ec7f6bc82

Download Submit
C:\Windows\SysWOW64\wmnkuykq\nixhmrjh.exe

Filesize
6.6MB

MD5
412ec48aa1c1e85aab9e2be069e65eb5

SHA1
90175f230eb50a4d3a52560c8446e5c2b0f3d2b4

SHA256
17ac0d80ed2d7afcb78bf5cebcfdc1826952f0a562919244471bebe2fbbbfd8d

SHA512
5ff2a96add0bc250cdd77359ea3dad4e87d7698bd9c8b29df7fda4156f5a2931c402dfe319c783ee169fd7c1cf8914334aa065b5c88fac41301909656dff6b6d

Download Submit
memory/2332-1-0x00000000002B0000-0x00000000003B0000-memory.dmp

Filesize
1024KB

Download
memory/2332-2-0x00000000001B0000-0x00000000001C3000-memory.dmp

Filesize
76KB

Download
memory/2332-4-0x0000000000400000-0x000000000324F000-memory.dmp

Filesize
46.3MB

Download
memory/2332-6-0x0000000000400000-0x000000000324F000-memory.dmp

Filesize
46.3MB

Download
memory/2332-7-0x00000000001B0000-0x00000000001C3000-memory.dmp

Filesize
76KB

Download
memory/2552-11-0x00000000000D0000-0x00000000000E5000-memory.dmp

Filesize
84KB

Download
memory/2552-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2552-14-0x00000000000D0000-0x00000000000E5000-memory.dmp

Filesize
84KB

Download
memory/2552-18-0x00000000000D0000-0x00000000000E5000-memory.dmp

Filesize
84KB

Download
memory/2552-20-0x00000000000D0000-0x00000000000E5000-memory.dmp

Filesize
84KB

Download
memory/2552-21-0x00000000000D0000-0x00000000000E5000-memory.dmp

Filesize
84KB

Download
memory/2552-22-0x00000000000D0000-0x00000000000E5000-memory.dmp

Filesize
84KB

Download
memory/2672-10-0x0000000003310000-0x0000000003410000-memory.dmp

Filesize
1024KB

Download
memory/2672-19-0x0000000000400000-0x000000000324F000-memory.dmp

Filesize
46.3MB

Download
memory/2672-17-0x0000000000400000-0x000000000324F000-memory.dmp

Filesize
46.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads