tofsee | 240967f196a84b28e897545973dd24e2f2f1b6b0e5793b2f296005d89d91f87a

Analysis

max time kernel
159s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 13:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
38f15aaf745fb328eeeefd9eeb7fb715.exe
Size 10.1MB
Sample231231-raq2gabgb9
SHA256 240967f196a84b28e897545973dd24e2f2f1b6b0e5793b2f296005d89d91f87a
MD5 38f15aaf745fb328eeeefd9eeb7fb715
SHA1 15ad9fd116c2fa305f3fd917901f536fae85bf5f
SHA512 d6e3269978f85a478875b7d33d16524a06ce959f1db77145e121dc2fa7d916d68f98dbdcba7c08705672b94e551dee2c4925f51569595b6afeb8a75a1dc9364d
SSDEEP 24576:YerU5sWbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbH:YsW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

defeatwax.ru
refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
900	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\igkrftla\ImagePath = "C:\\Windows\\SysWOW64\\igkrftla\\boomlmzz.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	38f15aaf745fb328eeeefd9eeb7fb715.exe

Executes dropped EXE 1 IoCs

pid	Process
3292	boomlmzz.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3292 set thread context of 4384	3292	boomlmzz.exe	103

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3128	sc.exe
3140	sc.exe
2980	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 1396	4512	38f15aaf745fb328eeeefd9eeb7fb715.exe	90
PID 4512 wrote to memory of 1396	4512	38f15aaf745fb328eeeefd9eeb7fb715.exe	90
PID 4512 wrote to memory of 1396	4512	38f15aaf745fb328eeeefd9eeb7fb715.exe	90
PID 4512 wrote to memory of 3928	4512	38f15aaf745fb328eeeefd9eeb7fb715.exe	93
PID 4512 wrote to memory of 3928	4512	38f15aaf745fb328eeeefd9eeb7fb715.exe	93
PID 4512 wrote to memory of 3928	4512	38f15aaf745fb328eeeefd9eeb7fb715.exe	93
PID 4512 wrote to memory of 3128	4512	38f15aaf745fb328eeeefd9eeb7fb715.exe	95
PID 4512 wrote to memory of 3128	4512	38f15aaf745fb328eeeefd9eeb7fb715.exe	95
PID 4512 wrote to memory of 3128	4512	38f15aaf745fb328eeeefd9eeb7fb715.exe	95
PID 4512 wrote to memory of 3140	4512	38f15aaf745fb328eeeefd9eeb7fb715.exe	97
PID 4512 wrote to memory of 3140	4512	38f15aaf745fb328eeeefd9eeb7fb715.exe	97
PID 4512 wrote to memory of 3140	4512	38f15aaf745fb328eeeefd9eeb7fb715.exe	97
PID 4512 wrote to memory of 2980	4512	38f15aaf745fb328eeeefd9eeb7fb715.exe	98
PID 4512 wrote to memory of 2980	4512	38f15aaf745fb328eeeefd9eeb7fb715.exe	98
PID 4512 wrote to memory of 2980	4512	38f15aaf745fb328eeeefd9eeb7fb715.exe	98
PID 4512 wrote to memory of 900	4512	38f15aaf745fb328eeeefd9eeb7fb715.exe	102
PID 4512 wrote to memory of 900	4512	38f15aaf745fb328eeeefd9eeb7fb715.exe	102
PID 4512 wrote to memory of 900	4512	38f15aaf745fb328eeeefd9eeb7fb715.exe	102
PID 3292 wrote to memory of 4384	3292	boomlmzz.exe	103
PID 3292 wrote to memory of 4384	3292	boomlmzz.exe	103
PID 3292 wrote to memory of 4384	3292	boomlmzz.exe	103
PID 3292 wrote to memory of 4384	3292	boomlmzz.exe	103
PID 3292 wrote to memory of 4384	3292	boomlmzz.exe	103

C:\Users\Admin\AppData\Local\Temp\38f15aaf745fb328eeeefd9eeb7fb715.exe
"C:\Users\Admin\AppData\Local\Temp\38f15aaf745fb328eeeefd9eeb7fb715.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\igkrftla\
  2⤵
  PID:1396
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\boomlmzz.exe" C:\Windows\SysWOW64\igkrftla\
  2⤵
  PID:3928
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create igkrftla binPath= "C:\Windows\SysWOW64\igkrftla\boomlmzz.exe /d\"C:\Users\Admin\AppData\Local\Temp\38f15aaf745fb328eeeefd9eeb7fb715.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:3128
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description igkrftla "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:3140
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start igkrftla
  2⤵
  - Launches sc.exe
  PID:2980
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:900

C:\Windows\SysWOW64\igkrftla\boomlmzz.exe
C:\Windows\SysWOW64\igkrftla\boomlmzz.exe /d"C:\Users\Admin\AppData\Local\Temp\38f15aaf745fb328eeeefd9eeb7fb715.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3292
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  PID:4384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

boomlmzz.exe

Path C:\Users\Admin\AppData\Local\Temp\boomlmzz.exe
Size 14KB
SHA256 79641a05b933d1a8e71c7223c7f765f0ea4d54f5a79568c948231a9d7d0bffa3
MD5 13caf8d7c0fc1c9d0fafafc09f2b50ce
SHA1 3a2bc8158f6af6bf0d061f9c6a6a00ed3014ab9b
SHA512 baf0d54285c18c6297119b931b4f51aaab0b615c92792b15b122b2c70e7cebd899a6ff6e799b9e6ff8a28687214bb31bfc25beb0a6454451e5de04ce4ee74595
SSDEEP 384:G3lSkHoVaJBV44Of7vE2driMCDd1vuptg7T6gcl6:GLHo8JvKfLlzCXT6r6
MD5 SHA1 SHA512 SSDEEP

Submit Download

boomlmzz.exe

Path C:\Windows\SysWOW64\igkrftla\boomlmzz.exe
Size 39KB
SHA256 907a41f8f7a7781bba4ac0460ab18eb89c02b14e54554fa5301be5d5cb3c67d4
MD5 6140118779ebfa3ad3bbdb1dfb3861b4
SHA1 5cefd53e30e18be10916e9320cde3a722251f2fc
SHA512 14af8f0e97fd062872c199da13011d45217c97e148f84cea8f69a775a065d8d337d22f05cadf5d6ef0c472f1f3930b4d23ee05b9adb032a2f4a3e43bb101ab96
SSDEEP 768:GLHo8JvKfLlzCXT6rNkVF18Wve1pvFMO5geh3VuxOrmuyD2d:OQzlApwoOPhF2Oauqe
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3292-9-0x00000000004F0000-0x0000000000503000-memory.dmp

Download

memory/3292-18-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3292-11-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3292-8-0x00000000006A0000-0x00000000007A0000-memory.dmp

Download

memory/4384-10-0x0000000000110000-0x0000000000125000-memory.dmp

Download

memory/4384-14-0x0000000000110000-0x0000000000125000-memory.dmp

Download

memory/4384-16-0x0000000000110000-0x0000000000125000-memory.dmp

Download

memory/4384-17-0x0000000000110000-0x0000000000125000-memory.dmp

Download

memory/4384-25-0x0000000000110000-0x0000000000125000-memory.dmp

Download

memory/4512-2-0x00000000005D0000-0x00000000005E3000-memory.dmp

Download

memory/4512-1-0x0000000000660000-0x0000000000760000-memory.dmp

Download

memory/4512-15-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4512-3-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4512-24-0x0000000000660000-0x0000000000760000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads