tofsee | 22271e2c71304fbe07ac384b7900a449ac4e16252e63d916096399ba972ed16a

General

Target

7e434a6cbcc3d938039a2db91259dfcb.exe
Size

11.9MB
MD5

7e434a6cbcc3d938039a2db91259dfcb
SHA1

c7654ecaa2e52a2fec9083b62d4871ba58c67929
SHA256

22271e2c71304fbe07ac384b7900a449ac4e16252e63d916096399ba972ed16a
SHA512

d7bb6e2180e73ba01928dd6c087e0ab8cf64a5225f53a948521b64b205c57c00a3219a6b8ee321ac7a55bf83dafa19af22da04260025d51b9376da7f616c14a2
SSDEEP

49152:cBpQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ3:

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.6

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
1300	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	7e434a6cbcc3d938039a2db91259dfcb.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2728	sc.exe
4100	sc.exe
2532	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
760	1736	WerFault.exe	88

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1088	1736	7e434a6cbcc3d938039a2db91259dfcb.exe	101
PID 1736 wrote to memory of 1088	1736	7e434a6cbcc3d938039a2db91259dfcb.exe	101
PID 1736 wrote to memory of 1088	1736	7e434a6cbcc3d938039a2db91259dfcb.exe	101
PID 1736 wrote to memory of 1400	1736	7e434a6cbcc3d938039a2db91259dfcb.exe	103
PID 1736 wrote to memory of 1400	1736	7e434a6cbcc3d938039a2db91259dfcb.exe	103
PID 1736 wrote to memory of 1400	1736	7e434a6cbcc3d938039a2db91259dfcb.exe	103
PID 1736 wrote to memory of 2728	1736	7e434a6cbcc3d938039a2db91259dfcb.exe	105
PID 1736 wrote to memory of 2728	1736	7e434a6cbcc3d938039a2db91259dfcb.exe	105
PID 1736 wrote to memory of 2728	1736	7e434a6cbcc3d938039a2db91259dfcb.exe	105
PID 1736 wrote to memory of 4100	1736	7e434a6cbcc3d938039a2db91259dfcb.exe	107
PID 1736 wrote to memory of 4100	1736	7e434a6cbcc3d938039a2db91259dfcb.exe	107
PID 1736 wrote to memory of 4100	1736	7e434a6cbcc3d938039a2db91259dfcb.exe	107
PID 1736 wrote to memory of 2532	1736	7e434a6cbcc3d938039a2db91259dfcb.exe	109
PID 1736 wrote to memory of 2532	1736	7e434a6cbcc3d938039a2db91259dfcb.exe	109
PID 1736 wrote to memory of 2532	1736	7e434a6cbcc3d938039a2db91259dfcb.exe	109
PID 1736 wrote to memory of 1300	1736	7e434a6cbcc3d938039a2db91259dfcb.exe	111
PID 1736 wrote to memory of 1300	1736	7e434a6cbcc3d938039a2db91259dfcb.exe	111
PID 1736 wrote to memory of 1300	1736	7e434a6cbcc3d938039a2db91259dfcb.exe	111

C:\Users\Admin\AppData\Local\Temp\7e434a6cbcc3d938039a2db91259dfcb.exe
"C:\Users\Admin\AppData\Local\Temp\7e434a6cbcc3d938039a2db91259dfcb.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\hlswegpy\
  2⤵
  PID:1088
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\iijrxsug.exe" C:\Windows\SysWOW64\hlswegpy\
  2⤵
  PID:1400
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create hlswegpy binPath= "C:\Windows\SysWOW64\hlswegpy\iijrxsug.exe /d\"C:\Users\Admin\AppData\Local\Temp\7e434a6cbcc3d938039a2db91259dfcb.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:2728
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description hlswegpy "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:4100
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start hlswegpy
  2⤵
  - Launches sc.exe
  PID:2532
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:1300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 1044
  2⤵
  - Program crash
  PID:760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1736 -ip 1736
1⤵
PID:4964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\iijrxsug.exe

Filesize
11.3MB

MD5
222895bebec2d707e938458292d4cca4

SHA1
fb14eb8d48a5e9555986f063a8514443e82302ed

SHA256
76dcc513f5f4657caff2b818a72112bbbd50c141c491502da0a5aab9e6b4f102

SHA512
260216c8027f01d7acc185126a80155dd011205d3b86a0e75a16864d911262511faf21346616f154f97db9c537574f0b4b181b2bbbdffea85c2dfc9decab5fcd

Download Submit
memory/1736-1-0x00000000033B0000-0x00000000034B0000-memory.dmp

Filesize
1024KB

Download
memory/1736-2-0x0000000000400000-0x000000000323B000-memory.dmp

Filesize
46.2MB

Download
memory/1736-3-0x0000000004E50000-0x0000000004E63000-memory.dmp

Filesize
76KB

Download
memory/1736-6-0x00000000033B0000-0x00000000034B0000-memory.dmp

Filesize
1024KB

Download
memory/1736-8-0x0000000000400000-0x000000000323B000-memory.dmp

Filesize
46.2MB

Download
memory/1736-10-0x0000000000400000-0x000000000323B000-memory.dmp

Filesize
46.2MB

Download
memory/1736-11-0x0000000000400000-0x000000000323B000-memory.dmp

Filesize
46.2MB

Download
memory/1736-12-0x0000000000400000-0x000000000323B000-memory.dmp

Filesize
46.2MB

Download
memory/1736-17-0x0000000000400000-0x000000000323B000-memory.dmp

Filesize
46.2MB

Download
memory/1736-19-0x0000000004E50000-0x0000000004E63000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads