tofsee | 0e32b2bbd0347fc8b4eae683f22b1d34f2c5514ae863c32fe2fc32089219a70b

Analysis

max time kernel
181s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2024, 09:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3c76d5aa8de1b32addf4299acb170e3d.exe
Size 13.0MB
Sample240101-k6bs4aaba5
SHA256 0e32b2bbd0347fc8b4eae683f22b1d34f2c5514ae863c32fe2fc32089219a70b
MD5 3c76d5aa8de1b32addf4299acb170e3d
SHA1 a5a172dccbe1fbb50ef8afb7a4edfe9531138df3
SHA512 b6fa9e3a6316b3e1ae51d33b51e8b58e7b6f33ee49b6153c2a8d2a45634c404570860a4e9337c72d341df9f6a8a22364408ab2e3bf66a6655ffdeb921683a551
SSDEEP 24576:BYQkpx/ORHsD000000000000000000000000000000000000000000000000000M:CQm/rR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan upx

Malware Config

Extracted

Family

tofsee

43.231.4.7
lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
4728	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\pmxuytjj\ImagePath = "C:\\Windows\\SysWOW64\\pmxuytjj\\svbvkvgm.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	3c76d5aa8de1b32addf4299acb170e3d.exe

Deletes itself 1 IoCs

pid	Process
4888	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2332	svbvkvgm.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0006000000023223-4.dat	upx
behavioral2/files/0x0006000000023223-5.dat	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2332 set thread context of 4888	2332	svbvkvgm.exe	114

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4940	sc.exe
1228	sc.exe
1532	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4964	2020	WerFault.exe	88
5064	2332	WerFault.exe	105

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 5064	2020	3c76d5aa8de1b32addf4299acb170e3d.exe	112
PID 2020 wrote to memory of 5064	2020	3c76d5aa8de1b32addf4299acb170e3d.exe	112
PID 2020 wrote to memory of 5064	2020	3c76d5aa8de1b32addf4299acb170e3d.exe	112
PID 2020 wrote to memory of 4476	2020	3c76d5aa8de1b32addf4299acb170e3d.exe	96
PID 2020 wrote to memory of 4476	2020	3c76d5aa8de1b32addf4299acb170e3d.exe	96
PID 2020 wrote to memory of 4476	2020	3c76d5aa8de1b32addf4299acb170e3d.exe	96
PID 2020 wrote to memory of 4940	2020	3c76d5aa8de1b32addf4299acb170e3d.exe	98
PID 2020 wrote to memory of 4940	2020	3c76d5aa8de1b32addf4299acb170e3d.exe	98
PID 2020 wrote to memory of 4940	2020	3c76d5aa8de1b32addf4299acb170e3d.exe	98
PID 2020 wrote to memory of 1228	2020	3c76d5aa8de1b32addf4299acb170e3d.exe	101
PID 2020 wrote to memory of 1228	2020	3c76d5aa8de1b32addf4299acb170e3d.exe	101
PID 2020 wrote to memory of 1228	2020	3c76d5aa8de1b32addf4299acb170e3d.exe	101
PID 2020 wrote to memory of 1532	2020	3c76d5aa8de1b32addf4299acb170e3d.exe	103
PID 2020 wrote to memory of 1532	2020	3c76d5aa8de1b32addf4299acb170e3d.exe	103
PID 2020 wrote to memory of 1532	2020	3c76d5aa8de1b32addf4299acb170e3d.exe	103
PID 2020 wrote to memory of 4728	2020	3c76d5aa8de1b32addf4299acb170e3d.exe	106
PID 2020 wrote to memory of 4728	2020	3c76d5aa8de1b32addf4299acb170e3d.exe	106
PID 2020 wrote to memory of 4728	2020	3c76d5aa8de1b32addf4299acb170e3d.exe	106
PID 2332 wrote to memory of 4888	2332	svbvkvgm.exe	114
PID 2332 wrote to memory of 4888	2332	svbvkvgm.exe	114
PID 2332 wrote to memory of 4888	2332	svbvkvgm.exe	114
PID 2332 wrote to memory of 4888	2332	svbvkvgm.exe	114
PID 2332 wrote to memory of 4888	2332	svbvkvgm.exe	114

C:\Users\Admin\AppData\Local\Temp\3c76d5aa8de1b32addf4299acb170e3d.exe
"C:\Users\Admin\AppData\Local\Temp\3c76d5aa8de1b32addf4299acb170e3d.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\pmxuytjj\
  2⤵
  PID:5064
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\svbvkvgm.exe" C:\Windows\SysWOW64\pmxuytjj\
  2⤵
  PID:4476
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create pmxuytjj binPath= "C:\Windows\SysWOW64\pmxuytjj\svbvkvgm.exe /d\"C:\Users\Admin\AppData\Local\Temp\3c76d5aa8de1b32addf4299acb170e3d.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:4940
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description pmxuytjj "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:1228
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start pmxuytjj
  2⤵
  - Launches sc.exe
  PID:1532
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:4728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 648
  2⤵
  - Program crash
  PID:4964

C:\Windows\SysWOW64\pmxuytjj\svbvkvgm.exe
C:\Windows\SysWOW64\pmxuytjj\svbvkvgm.exe /d"C:\Users\Admin\AppData\Local\Temp\3c76d5aa8de1b32addf4299acb170e3d.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 532
  2⤵
  - Program crash
  PID:5064
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2020 -ip 2020
1⤵
PID:4860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2332 -ip 2332
1⤵
PID:3260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svbvkvgm.exe

Path C:\Users\Admin\AppData\Local\Temp\svbvkvgm.exe
Size 11.2MB
SHA256 f419efd6fbbe558e23d4900114da8df1c944a1feeb0dcda98f26e94fa886b4fa
MD5 4ae2394b4e0a8de5f0a8fb6ef03676fb
SHA1 b2d23a22062883d059cbbd4c0dddb30e79b2c024
SHA512 416d1b412e791fea8c4d7e0b3dcafef6e237c2036f1235b9f74c99c77cfae6a2f7584b2ba2bd3a407fb28d3a69ec5651a8fd7f35b58ef74cd54589f2d2cafb0d
SSDEEP 24576:6YQkpx/ORHsD000000000000000000000000000000000000000000000000000A:5Qm/rn
MD5 SHA1 SHA512 SSDEEP

Submit Download

svbvkvgm.exe

Path C:\Windows\SysWOW64\pmxuytjj\svbvkvgm.exe
Size 6.2MB
SHA256 42f4149673c85753b240b6682a11d589e81f46f9faef75d5a0f3408d8b1aa3b1
MD5 c5e7116b0aa353958354f5af23474221
SHA1 2af0f526492a13adaf0ecb60be3eaf16f68b2aa4
SHA512 254d9fc5fe1974b9e348bc8ef4eb094165da84acf82e2919422876f7a8bc5265e69358540569a8594a677d8331c4a78609b7bc05cfd30a334a3b99ab5f4d4d95
SSDEEP 24576:6YQkpx/ORHsD0000000000000000000000000000000000000000000000000007:5Qm/ra
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2020-1-0x0000000004A30000-0x0000000004A43000-memory.dmp

Download

memory/2020-0-0x0000000004910000-0x000000000491D000-memory.dmp

Download

memory/2020-3-0x0000000000400000-0x00000000047BC000-memory.dmp

Download

memory/2020-6-0x0000000000400000-0x00000000047BC000-memory.dmp

Download

memory/2332-7-0x0000000004C40000-0x0000000004C53000-memory.dmp

Download

memory/2332-12-0x0000000000400000-0x00000000047BC000-memory.dmp

Download

memory/4888-8-0x0000000000140000-0x0000000000155000-memory.dmp

Download

memory/4888-11-0x0000000000140000-0x0000000000155000-memory.dmp

Download

memory/4888-13-0x0000000000140000-0x0000000000155000-memory.dmp

Download

memory/4888-14-0x0000000000140000-0x0000000000155000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads