tofsee | 3b096e70a59f87eabdcc239f9eac549cbdabb51ae3b82e299b9d840d3878a415

Analysis

max time kernel
184s
max time network
200s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2024, 10:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1e2e1af08d379134811a4cd10474714d.exe
Size 11.6MB
Sample240101-mde16abec6
SHA256 3b096e70a59f87eabdcc239f9eac549cbdabb51ae3b82e299b9d840d3878a415
MD5 1e2e1af08d379134811a4cd10474714d
SHA1 fb6f3185b989a372d1d53ab7b50fbfd19be32046
SHA512 12dd43e0efeba2f974e7ae8bebe55109853670d4af991686a3fb529986eed32aefc8e86b3a5e5d9d2c5332f9d473a452dd8ae2ed5f2214c7a518dc189aeef9d1
SSDEEP 24576:sjY+lg48SlJPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP3:XHSl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

43.231.4.6
lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
3020	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\djooxzrs\ImagePath = "C:\\Windows\\SysWOW64\\djooxzrs\\daxvhshv.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	1e2e1af08d379134811a4cd10474714d.exe

Deletes itself 1 IoCs

pid	Process
4888	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
1792	daxvhshv.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1792 set thread context of 4888	1792	daxvhshv.exe	112

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4508	sc.exe
1036	sc.exe
4032	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4876	4688	WerFault.exe	88
5004	1792	WerFault.exe	105

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 3576	4688	1e2e1af08d379134811a4cd10474714d.exe	93
PID 4688 wrote to memory of 3576	4688	1e2e1af08d379134811a4cd10474714d.exe	93
PID 4688 wrote to memory of 3576	4688	1e2e1af08d379134811a4cd10474714d.exe	93
PID 4688 wrote to memory of 2600	4688	1e2e1af08d379134811a4cd10474714d.exe	94
PID 4688 wrote to memory of 2600	4688	1e2e1af08d379134811a4cd10474714d.exe	94
PID 4688 wrote to memory of 2600	4688	1e2e1af08d379134811a4cd10474714d.exe	94
PID 4688 wrote to memory of 4032	4688	1e2e1af08d379134811a4cd10474714d.exe	98
PID 4688 wrote to memory of 4032	4688	1e2e1af08d379134811a4cd10474714d.exe	98
PID 4688 wrote to memory of 4032	4688	1e2e1af08d379134811a4cd10474714d.exe	98
PID 4688 wrote to memory of 4508	4688	1e2e1af08d379134811a4cd10474714d.exe	101
PID 4688 wrote to memory of 4508	4688	1e2e1af08d379134811a4cd10474714d.exe	101
PID 4688 wrote to memory of 4508	4688	1e2e1af08d379134811a4cd10474714d.exe	101
PID 4688 wrote to memory of 1036	4688	1e2e1af08d379134811a4cd10474714d.exe	104
PID 4688 wrote to memory of 1036	4688	1e2e1af08d379134811a4cd10474714d.exe	104
PID 4688 wrote to memory of 1036	4688	1e2e1af08d379134811a4cd10474714d.exe	104
PID 4688 wrote to memory of 3020	4688	1e2e1af08d379134811a4cd10474714d.exe	108
PID 4688 wrote to memory of 3020	4688	1e2e1af08d379134811a4cd10474714d.exe	108
PID 4688 wrote to memory of 3020	4688	1e2e1af08d379134811a4cd10474714d.exe	108
PID 1792 wrote to memory of 4888	1792	daxvhshv.exe	112
PID 1792 wrote to memory of 4888	1792	daxvhshv.exe	112
PID 1792 wrote to memory of 4888	1792	daxvhshv.exe	112
PID 1792 wrote to memory of 4888	1792	daxvhshv.exe	112
PID 1792 wrote to memory of 4888	1792	daxvhshv.exe	112

C:\Users\Admin\AppData\Local\Temp\1e2e1af08d379134811a4cd10474714d.exe
"C:\Users\Admin\AppData\Local\Temp\1e2e1af08d379134811a4cd10474714d.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\djooxzrs\
  2⤵
  PID:3576
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\daxvhshv.exe" C:\Windows\SysWOW64\djooxzrs\
  2⤵
  PID:2600
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create djooxzrs binPath= "C:\Windows\SysWOW64\djooxzrs\daxvhshv.exe /d\"C:\Users\Admin\AppData\Local\Temp\1e2e1af08d379134811a4cd10474714d.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:4032
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description djooxzrs "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:4508
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start djooxzrs
  2⤵
  - Launches sc.exe
  PID:1036
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:3020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 1160
  2⤵
  - Program crash
  PID:4876

C:\Windows\SysWOW64\djooxzrs\daxvhshv.exe
C:\Windows\SysWOW64\djooxzrs\daxvhshv.exe /d"C:\Users\Admin\AppData\Local\Temp\1e2e1af08d379134811a4cd10474714d.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  PID:4888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 532
  2⤵
  - Program crash
  PID:5004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4688 -ip 4688
1⤵
PID:4728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1792 -ip 1792
1⤵
PID:1056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

daxvhshv.exe

Path C:\Users\Admin\AppData\Local\Temp\daxvhshv.exe
Size 90KB
SHA256 11725efd59b49f1dbfb65f88d73ae807106e8e5b418e8f506a822dc31da402b8
MD5 eb7c2fc694c5061e8223d64f51a2c18a
SHA1 f9dc56087be7c19fac8a06d298ea6ee7c112f829
SHA512 8dba8c4efda25ae40e88914a85e15f0a6b4e436fdfbfd7f4fcdbdacf572a86d0d0b585134022530b0cfc680c6c6a0684d8b6b91163f44caf073e411f28a59f70
SSDEEP 1536:Cq1jgHTbM9fjbTan0EM1KKvMBbgcSKTro5ioWxyk3JJG8NGT9:Cq1jgHTbcWnIjv0j+5ioWvJJC9
MD5 SHA1 SHA512 SSDEEP

Submit Download

daxvhshv.exe

Path C:\Windows\SysWOW64\djooxzrs\daxvhshv.exe
Size 220KB
SHA256 9a9fa5f47bcf04dfd3cef062f308360f36a9cc3d22e4525b00d44ab31200173c
MD5 4fd9ccdcb027058b870ab9731e1c3ec4
SHA1 e3fd323dd5393a07e3fa691f2824e650cfe7818a
SHA512 f8339addfc3f32cf3e5444bc9a678970f1c0e6ade6c9dc42795007613ec0a9e97e761ae3ea82dcb18365f689f13fb0c55e9ec162ae5140d489d2b52423f3f130
SSDEEP 6144:Cq1jgHPcWnIjY+lGJJCUW70aIba6f0LYSeejwy2Z4Yx:UcWIjY+lGJJbeE48SljD2GE
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1792-11-0x00000000009A0000-0x0000000000AA0000-memory.dmp

Download

memory/1792-16-0x00000000009A0000-0x0000000000AA0000-memory.dmp

Download

memory/1792-20-0x0000000000400000-0x00000000008E9000-memory.dmp

Download

memory/1792-13-0x0000000000400000-0x00000000008E9000-memory.dmp

Download

memory/1792-12-0x0000000000400000-0x00000000008E9000-memory.dmp

Download

memory/4688-9-0x00000000024F0000-0x0000000002503000-memory.dmp

Download

memory/4688-1-0x0000000000B30000-0x0000000000C30000-memory.dmp

Download

memory/4688-8-0x0000000000400000-0x00000000008E9000-memory.dmp

Download

memory/4688-2-0x00000000024F0000-0x0000000002503000-memory.dmp

Download

memory/4688-5-0x0000000000400000-0x00000000008E9000-memory.dmp

Download

memory/4688-4-0x0000000000400000-0x00000000008E9000-memory.dmp

Download

memory/4888-15-0x00000000002C0000-0x00000000002D5000-memory.dmp

Download

memory/4888-19-0x00000000002C0000-0x00000000002D5000-memory.dmp

Download

memory/4888-21-0x00000000002C0000-0x00000000002D5000-memory.dmp

Download

memory/4888-22-0x00000000002C0000-0x00000000002D5000-memory.dmp

Download

memory/4888-23-0x00000000002C0000-0x00000000002D5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads