Analysis
- max time kernel
3s - max time network
110s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
01/01/2024, 09:13
General
- Target 3c77933f76d009d8d87b6a029c201f24.exe
- Size 10.4MB
- Sample240101-k6w42aabb3
- SHA256 4a52a76a61e432707da8c37f1cafa6ea664e4f2750b6ad604b0343c68f0542a7
Malware Config
Extracted
-
tofsee
-
43.231.4.7
-
lazystax.ru
Signatures
- Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
- Creates new service(s) 1 TTPs
- Modifies Windows Firewall 1 TTPs 1 IoCs
- Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c77933f76d009d8d87b6a029c201f24.exe"C:\Users\Admin\AppData\Local\Temp\3c77933f76d009d8d87b6a029c201f24.exe"1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\hnndtceg\2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\jawdutxb.exe" C:\Windows\SysWOW64\hnndtceg\2⤵
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create hnndtceg binPath= "C:\Windows\SysWOW64\hnndtceg\jawdutxb.exe /d\"C:\Users\Admin\AppData\Local\Temp\3c77933f76d009d8d87b6a029c201f24.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description hnndtceg "wifi internet conection"2⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start hnndtceg2⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\hnndtceg\jawdutxb.exeC:\Windows\SysWOW64\hnndtceg\jawdutxb.exe /d"C:\Users\Admin\AppData\Local\Temp\3c77933f76d009d8d87b6a029c201f24.exe"1⤵
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/800-2-0x0000000005410000-0x0000000005423000-memory.dmp
memory/800-1-0x00000000037E0000-0x00000000038E0000-memory.dmp
memory/800-4-0x0000000000400000-0x00000000036CD000-memory.dmp
memory/800-8-0x0000000005410000-0x0000000005423000-memory.dmp
memory/800-7-0x0000000000400000-0x00000000036CD000-memory.dmp
memory/1072-10-0x0000000000A60000-0x0000000000A75000-memory.dmp
memory/1072-14-0x0000000000A60000-0x0000000000A75000-memory.dmp
memory/1072-17-0x0000000000A60000-0x0000000000A75000-memory.dmp
memory/1072-18-0x0000000000A60000-0x0000000000A75000-memory.dmp
memory/1072-19-0x0000000000A60000-0x0000000000A75000-memory.dmp
memory/2356-11-0x0000000003740000-0x0000000003840000-memory.dmp
memory/2356-16-0x0000000000400000-0x00000000036CD000-memory.dmp