tofsee | 1dd9b91d9204e448403d82f29f1327979781e2b48e37825ba75d9f78e858d95a

Analysis

max time kernel
1s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 19:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2308ed21c12b2b43e8e22d1e595ef5e7.exe
Size

10.4MB
MD5

2308ed21c12b2b43e8e22d1e595ef5e7
SHA1

613d67ac63f1229c170412e0d39f6dcb46b5ca5b
SHA256

1dd9b91d9204e448403d82f29f1327979781e2b48e37825ba75d9f78e858d95a
SHA512

401ef803ec044fd1078d0893a926d5dcafd80cf54c7260bb79495b564a83aa8211d4dec2d76b6be1182616eab1db0373de826a6c939792e3fda93fe7e60934dc
SSDEEP

24576:slxdvCcpOKCtBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBT:slzOR

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

defeatwax.ru

refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
2812	netsh.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2400	sc.exe
2844	sc.exe
2388	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 1216	2436	2308ed21c12b2b43e8e22d1e595ef5e7.exe	29
PID 2436 wrote to memory of 1216	2436	2308ed21c12b2b43e8e22d1e595ef5e7.exe	29
PID 2436 wrote to memory of 1216	2436	2308ed21c12b2b43e8e22d1e595ef5e7.exe	29
PID 2436 wrote to memory of 1216	2436	2308ed21c12b2b43e8e22d1e595ef5e7.exe	29

C:\Users\Admin\AppData\Local\Temp\2308ed21c12b2b43e8e22d1e595ef5e7.exe
"C:\Users\Admin\AppData\Local\Temp\2308ed21c12b2b43e8e22d1e595ef5e7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\vltzcppi\
  2⤵
  PID:1216
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\rmwznyyg.exe" C:\Windows\SysWOW64\vltzcppi\
  2⤵
  PID:2132
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create vltzcppi binPath= "C:\Windows\SysWOW64\vltzcppi\rmwznyyg.exe /d\"C:\Users\Admin\AppData\Local\Temp\2308ed21c12b2b43e8e22d1e595ef5e7.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:2388
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description vltzcppi "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2400
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start vltzcppi
  2⤵
  - Launches sc.exe
  PID:2844
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:2812

C:\Windows\SysWOW64\vltzcppi\rmwznyyg.exe
C:\Windows\SysWOW64\vltzcppi\rmwznyyg.exe /d"C:\Users\Admin\AppData\Local\Temp\2308ed21c12b2b43e8e22d1e595ef5e7.exe"
1⤵
PID:2896
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2436-1-0x0000000000500000-0x0000000000600000-memory.dmp

Filesize
1024KB

Download
memory/2436-4-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2436-3-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download
memory/2436-8-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2688-18-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2688-19-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2688-20-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2688-14-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2688-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2688-9-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2688-21-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2896-16-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2896-12-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2896-10-0x0000000000250000-0x0000000000350000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads