tofsee | 38d1de62b07f072de9aab3a81d82d3066eadf97a016504e7188864f29328b6c2

Analysis

max time kernel
7s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2024, 06:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c29b2a85beb671f0504afc7c3e1346a.exe
Size

12.5MB
MD5

3c29b2a85beb671f0504afc7c3e1346a
SHA1

4db3c724d1d4377bcb85ed2d625ef23867308ce9
SHA256

38d1de62b07f072de9aab3a81d82d3066eadf97a016504e7188864f29328b6c2
SHA512

89668f1629ea80ec2ebe9e754327abd34bb2b4ffbe75afdf4fe0c50a3e0198f64bf8b8fd95a9752254bc998e751edef0db9a7cf148a5c96946c98bba3cd9311f
SSDEEP

24576:ojDuKnh7YzbKBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB3:onh

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

defeatwax.ru

refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
1352	netsh.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1588	sc.exe
2588	sc.exe
3912	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\3c29b2a85beb671f0504afc7c3e1346a.exe
"C:\Users\Admin\AppData\Local\Temp\3c29b2a85beb671f0504afc7c3e1346a.exe"
1⤵
PID:4976
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\vxfrgnhp\
  2⤵
  PID:5032
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\oolgjarj.exe" C:\Windows\SysWOW64\vxfrgnhp\
  2⤵
  PID:1004
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create vxfrgnhp binPath= "C:\Windows\SysWOW64\vxfrgnhp\oolgjarj.exe /d\"C:\Users\Admin\AppData\Local\Temp\3c29b2a85beb671f0504afc7c3e1346a.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:1588
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description vxfrgnhp "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2588
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start vxfrgnhp
  2⤵
  - Launches sc.exe
  PID:3912
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:1352

C:\Windows\SysWOW64\vxfrgnhp\oolgjarj.exe
C:\Windows\SysWOW64\vxfrgnhp\oolgjarj.exe /d"C:\Users\Admin\AppData\Local\Temp\3c29b2a85beb671f0504afc7c3e1346a.exe"
1⤵
PID:912
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\oolgjarj.exe

Filesize
8KB

MD5
1d084d1506f374e642204ccd2f68e2d5

SHA1
2d6547c6db94a222d08be946a53e0aac11bf9381

SHA256
2a864fae1e1d4b98656db7869f738ad6e2efd550957b512137ec22c3265b1d34

SHA512
71f94bb750ee18c9fb4fd13814fdf9894b7961e4569a9cc11ad41b5a93d1f01532dbb4d10b766b1ad05df66004b64fd9c1dedc4e6c050c69e4138757f712ecd9

Download Submit
C:\Windows\SysWOW64\vxfrgnhp\oolgjarj.exe

Filesize
35KB

MD5
bec816630e6c0e9eada8cefd8ffe1f63

SHA1
1991e01cf841421709c1f729619eb831caf96db7

SHA256
516d7c8c8756d238fea571d0741a17ea0e6449afc5de8ef45f15a3ec3c901736

SHA512
281c23b5779d0924e1d980c92bca35c112c4d9e0e931db7a1ccdc5fe525ab0a98403338e4a8a6eeb516281889d1079500675dfb59a1dbcc02828dbfcaa354c70

Download Submit
memory/756-11-0x0000000000850000-0x0000000000865000-memory.dmp

Filesize
84KB

Download
memory/756-25-0x0000000000850000-0x0000000000865000-memory.dmp

Filesize
84KB

Download
memory/756-19-0x0000000000850000-0x0000000000865000-memory.dmp

Filesize
84KB

Download
memory/756-16-0x0000000000850000-0x0000000000865000-memory.dmp

Filesize
84KB

Download
memory/756-14-0x0000000000850000-0x0000000000865000-memory.dmp

Filesize
84KB

Download
memory/912-8-0x0000000000740000-0x0000000000840000-memory.dmp

Filesize
1024KB

Download
memory/912-10-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/912-9-0x00000000005C0000-0x00000000005D3000-memory.dmp

Filesize
76KB

Download
memory/912-18-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4976-1-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/4976-15-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4976-3-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4976-22-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/4976-2-0x00000000021B0000-0x00000000021C3000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads