tofsee | cb112438ca2527473f2e6eefd2dc9e8764af06e1e874cda251ab91dd84b320e9

General

Target
39fb6a97f7168d79787d8bcc96ee9ffe.exe
Size 14.1MB
Sample231231-rxh95shfa6
SHA256 cb112438ca2527473f2e6eefd2dc9e8764af06e1e874cda251ab91dd84b320e9
MD5 39fb6a97f7168d79787d8bcc96ee9ffe
SHA1 ab952d716c482fe38bfbf2529213368114f1ddab
SHA512 e1f3f32bb2f91484aeb6d95930d74dd566caaf2047d1a41fbd9467b43e9e442d5237cd535ed9f2976c1bb26f168d4c856681c9f7c93292fd40d4bcf9e4701a4b
SSDEEP 6144:H5VCb4QuzF3pIryyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyC:Z8NKF3p
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7
lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
4908	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\searzgko\ImagePath = "C:\\Windows\\SysWOW64\\searzgko\\svddbzdm.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	39fb6a97f7168d79787d8bcc96ee9ffe.exe

Deletes itself 1 IoCs

pid	Process
2372	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2632	svddbzdm.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2632 set thread context of 2372	2632	svddbzdm.exe	103

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
368	sc.exe
968	sc.exe
3944	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 848	1244	39fb6a97f7168d79787d8bcc96ee9ffe.exe	91
PID 1244 wrote to memory of 848	1244	39fb6a97f7168d79787d8bcc96ee9ffe.exe	91
PID 1244 wrote to memory of 848	1244	39fb6a97f7168d79787d8bcc96ee9ffe.exe	91
PID 1244 wrote to memory of 3404	1244	39fb6a97f7168d79787d8bcc96ee9ffe.exe	94
PID 1244 wrote to memory of 3404	1244	39fb6a97f7168d79787d8bcc96ee9ffe.exe	94
PID 1244 wrote to memory of 3404	1244	39fb6a97f7168d79787d8bcc96ee9ffe.exe	94
PID 1244 wrote to memory of 368	1244	39fb6a97f7168d79787d8bcc96ee9ffe.exe	96
PID 1244 wrote to memory of 368	1244	39fb6a97f7168d79787d8bcc96ee9ffe.exe	96
PID 1244 wrote to memory of 368	1244	39fb6a97f7168d79787d8bcc96ee9ffe.exe	96
PID 1244 wrote to memory of 968	1244	39fb6a97f7168d79787d8bcc96ee9ffe.exe	99
PID 1244 wrote to memory of 968	1244	39fb6a97f7168d79787d8bcc96ee9ffe.exe	99
PID 1244 wrote to memory of 968	1244	39fb6a97f7168d79787d8bcc96ee9ffe.exe	99
PID 1244 wrote to memory of 3944	1244	39fb6a97f7168d79787d8bcc96ee9ffe.exe	101
PID 1244 wrote to memory of 3944	1244	39fb6a97f7168d79787d8bcc96ee9ffe.exe	101
PID 1244 wrote to memory of 3944	1244	39fb6a97f7168d79787d8bcc96ee9ffe.exe	101
PID 2632 wrote to memory of 2372	2632	svddbzdm.exe	103
PID 2632 wrote to memory of 2372	2632	svddbzdm.exe	103
PID 2632 wrote to memory of 2372	2632	svddbzdm.exe	103
PID 2632 wrote to memory of 2372	2632	svddbzdm.exe	103
PID 2632 wrote to memory of 2372	2632	svddbzdm.exe	103
PID 1244 wrote to memory of 4908	1244	39fb6a97f7168d79787d8bcc96ee9ffe.exe	105
PID 1244 wrote to memory of 4908	1244	39fb6a97f7168d79787d8bcc96ee9ffe.exe	105
PID 1244 wrote to memory of 4908	1244	39fb6a97f7168d79787d8bcc96ee9ffe.exe	105

C:\Users\Admin\AppData\Local\Temp\39fb6a97f7168d79787d8bcc96ee9ffe.exe
"C:\Users\Admin\AppData\Local\Temp\39fb6a97f7168d79787d8bcc96ee9ffe.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\searzgko\
  2⤵
  PID:848
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\svddbzdm.exe" C:\Windows\SysWOW64\searzgko\
  2⤵
  PID:3404
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create searzgko binPath= "C:\Windows\SysWOW64\searzgko\svddbzdm.exe /d\"C:\Users\Admin\AppData\Local\Temp\39fb6a97f7168d79787d8bcc96ee9ffe.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:368
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description searzgko "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:968
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start searzgko
  2⤵
  - Launches sc.exe
  PID:3944
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:4908

C:\Windows\SysWOW64\searzgko\svddbzdm.exe
C:\Windows\SysWOW64\searzgko\svddbzdm.exe /d"C:\Users\Admin\AppData\Local\Temp\39fb6a97f7168d79787d8bcc96ee9ffe.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svddbzdm.exe

Path C:\Users\Admin\AppData\Local\Temp\svddbzdm.exe
Size 1.2MB
SHA256 d4790bd263b48632f6aab1a513aa6dd42ef90387825f004b46244199cc728124
MD5 99c612197e220c6d062f822aa555d226
SHA1 f52e4d2e1e84732c567cd9d8c873830e05a5bf15
SHA512 98f890f0e945d964e1b6cbabe3eafe5016bd0fb886d855f449f0399dde6d550d2d3aa7a76ba4ef36ad37627942a6703d34b34949243765bc5acc126b39b469ed
SSDEEP 6144:j5VCb4QuzF3pIryyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy3:F8NKF3p
MD5 SHA1 SHA512 SSDEEP

Submit Download

svddbzdm.exe

Path C:\Windows\SysWOW64\searzgko\svddbzdm.exe
Size 162KB
SHA256 5fd004530a78e0e051d07262800afb462a19fe2aab58298dfb0731857a1d9bd3
MD5 8110dba786805e6a5515c4c14a4e1b99
SHA1 756f5761611e5625f604bddee0006bcd8e843477
SHA512 e410c9250d98efae6238d8ff634d2013051f191c29a1dfd300492a387af31358c52a6e17965c38f7477e73e788be67431495db7164f15e972928b8064e001855
SSDEEP 1536:jkws21VCbEjTxSYytuzTjFWL9ydpIZCUceUceUceUceUceUceUceUceUceUcp:j5VCbexSYQuzF3pIZVyyyyyyyyym
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2372-3-0x0000000000DB0000-0x0000000000DC6000-memory.dmp

Download

memory/2372-6-0x0000000000DB0000-0x0000000000DC6000-memory.dmp

Download

memory/2372-7-0x0000000000DB0000-0x0000000000DC6000-memory.dmp

Download

memory/2372-8-0x0000000000DB0000-0x0000000000DC6000-memory.dmp

Download

memory/2372-9-0x0000000000DB0000-0x0000000000DC6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads