tofsee | 30205eaf6f581036262bfc099dfc5cc5d0e4d771dca3d1c4cf3dada59d097672

Analysis

max time kernel
193s
max time network
224s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 01:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nczyp5x21l5el.exe
Size 240KB
Sample240104-bzn1eaeean
SHA256 30205eaf6f581036262bfc099dfc5cc5d0e4d771dca3d1c4cf3dada59d097672
MD5 5c1b720ec28a3d4af24a19003fb56f50
SHA1 fa8c1236c3e7bc4d002be0abf5523659bf4c9af8
SHA512 178e4b5633b1c4d455555b394940d6b240dc4da22e621e6c91035870f3e275b25881ea712fc7b73a4e73d9d9376045834fb00b3d03454616d877ecd3cd91790c
SSDEEP 3072:JQT/QLtwugcvGMI9+x7alYjt8T/NOOZ/M5l/evBr+jL+0geRp:JE/QLXgSh7aSjtGZ/M5lP3ge
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

vanaheim.cn
jotunheim.name

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
320	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\yuxmhbgw\ImagePath = "C:\\Windows\\SysWOW64\\yuxmhbgw\\omwxzvye.exe"	svchost.exe

Deletes itself 1 IoCs

pid	Process
1092	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
1888	omwxzvye.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile:.repos	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1888 set thread context of 1092	1888	omwxzvye.exe	42

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
380	sc.exe
440	sc.exe
1740	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Buses	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\Buses\Config0 = 7cab393daa219b0324edb47d450dd49d084297dce82e72baa49d18fd547c781de936c0f481cd945d24edb47d470dd49d024195daf71261adc06d04fda6e22673bbc9154961cda56813d5854d7534e7ad644490bdb67d26e5945a06caf38d3c74bbc4103d29fca16a1dda864b733be39d084295d9e13f4bb4c06d00fdadfd5430d69b460536fea36a1cedc70f3252a0f40948f490b67d26ec9c550dccf7be54718bce15515bb9fd3041ed85487335e5ad5514c78984a934d4a4c2d8f29a8d541de4ac743d04bafb2f4fb2c70f320dd49d642df4bd8495bf38c62834fdc48d57d1f6ae743d04cca26f0adc864f6a3ceca94a18ccbd844d14dda46d34fdc48d541de4ad743d04cd945d24edb47d440dd49d642df4bd844d14dda46d34fdc48d541de4ad743d04cd715c24ed	svchost.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 2596	2724	nczyp5x21l5el.exe	29
PID 2724 wrote to memory of 2596	2724	nczyp5x21l5el.exe	29
PID 2724 wrote to memory of 2596	2724	nczyp5x21l5el.exe	29
PID 2724 wrote to memory of 2596	2724	nczyp5x21l5el.exe	29
PID 2724 wrote to memory of 2496	2724	nczyp5x21l5el.exe	31
PID 2724 wrote to memory of 2496	2724	nczyp5x21l5el.exe	31
PID 2724 wrote to memory of 2496	2724	nczyp5x21l5el.exe	31
PID 2724 wrote to memory of 2496	2724	nczyp5x21l5el.exe	31
PID 2724 wrote to memory of 1740	2724	nczyp5x21l5el.exe	33
PID 2724 wrote to memory of 1740	2724	nczyp5x21l5el.exe	33
PID 2724 wrote to memory of 1740	2724	nczyp5x21l5el.exe	33
PID 2724 wrote to memory of 1740	2724	nczyp5x21l5el.exe	33
PID 2724 wrote to memory of 380	2724	nczyp5x21l5el.exe	35
PID 2724 wrote to memory of 380	2724	nczyp5x21l5el.exe	35
PID 2724 wrote to memory of 380	2724	nczyp5x21l5el.exe	35
PID 2724 wrote to memory of 380	2724	nczyp5x21l5el.exe	35
PID 2724 wrote to memory of 440	2724	nczyp5x21l5el.exe	37
PID 2724 wrote to memory of 440	2724	nczyp5x21l5el.exe	37
PID 2724 wrote to memory of 440	2724	nczyp5x21l5el.exe	37
PID 2724 wrote to memory of 440	2724	nczyp5x21l5el.exe	37
PID 2724 wrote to memory of 320	2724	nczyp5x21l5el.exe	39
PID 2724 wrote to memory of 320	2724	nczyp5x21l5el.exe	39
PID 2724 wrote to memory of 320	2724	nczyp5x21l5el.exe	39
PID 2724 wrote to memory of 320	2724	nczyp5x21l5el.exe	39
PID 1888 wrote to memory of 1092	1888	omwxzvye.exe	42
PID 1888 wrote to memory of 1092	1888	omwxzvye.exe	42
PID 1888 wrote to memory of 1092	1888	omwxzvye.exe	42
PID 1888 wrote to memory of 1092	1888	omwxzvye.exe	42
PID 1888 wrote to memory of 1092	1888	omwxzvye.exe	42
PID 1888 wrote to memory of 1092	1888	omwxzvye.exe	42

C:\Users\Admin\AppData\Local\Temp\nczyp5x21l5el.exe
"C:\Users\Admin\AppData\Local\Temp\nczyp5x21l5el.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\yuxmhbgw\
  2⤵
  PID:2596
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\omwxzvye.exe" C:\Windows\SysWOW64\yuxmhbgw\
  2⤵
  PID:2496
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create yuxmhbgw binPath= "C:\Windows\SysWOW64\yuxmhbgw\omwxzvye.exe /d\"C:\Users\Admin\AppData\Local\Temp\nczyp5x21l5el.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:1740
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description yuxmhbgw "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:380
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start yuxmhbgw
  2⤵
  - Launches sc.exe
  PID:440
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:320

C:\Windows\SysWOW64\yuxmhbgw\omwxzvye.exe
C:\Windows\SysWOW64\yuxmhbgw\omwxzvye.exe /d"C:\Users\Admin\AppData\Local\Temp\nczyp5x21l5el.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:1092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omwxzvye.exe

Path C:\Users\Admin\AppData\Local\Temp\omwxzvye.exe
Size 3.2MB
SHA256 8ad5a992d57ad8ec1351b1191c2d7e4b038a10183489de40c4838c0c349f1cb1
MD5 38a16066c0c587460b981d79a0611b37
SHA1 b478e94f9b8a5d43afd5bc01e57feccc32b2e445
SHA512 ca40b02775ac73372fdf9a61db229ccd7bb01caf4759c3275ef614c379684dfbc0c51ba713a374a4ec2fc2986937fc543bb8fa85cc067e4d03da95f93d015c2b
SSDEEP 12288:UZjgn6pvYvYvYvYvYvYvYvYvYvYvYvYvYvYvYvYvYvYvYvYvYvYvYvYvYvYvYvYv:duIIIIIIIIIIIIIIIIIIIIIIIIIIII
MD5 SHA1 SHA512 SSDEEP

Submit Download

omwxzvye.exe

Path C:\Windows\SysWOW64\yuxmhbgw\omwxzvye.exe
Size 14.3MB
SHA256 43ca5bb6be33cc7ced00ef1bcc8ae58a68eb449b01d42aa3419f5dcd7397c2d6
MD5 8e1413f9b4ed36b2a345f46b778c82d8
SHA1 44dd7b1a1d59d10db5b9e473d16faa2b5889e5aa
SHA512 aa256e0c4f34710bc06d9b0540a50f901b437c2599b4fd7936f6c68f525795a95620580dd65a3b53faf59b4c97d655856a35773c74ae4976428685ebccb995e8
SSDEEP 24576:duIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII3:
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1092-19-0x0000000000080000-0x0000000000095000-memory.dmp

Download

memory/1092-27-0x0000000000080000-0x0000000000095000-memory.dmp

Download

memory/1092-26-0x0000000000080000-0x0000000000095000-memory.dmp

Download

memory/1092-22-0x0000000000080000-0x0000000000095000-memory.dmp

Download

memory/1092-20-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/1888-18-0x0000000000400000-0x000000000085D000-memory.dmp

Download

memory/1888-24-0x0000000000400000-0x000000000085D000-memory.dmp

Download

memory/1888-17-0x0000000000250000-0x0000000000350000-memory.dmp

Download

memory/2724-3-0x0000000000400000-0x000000000085D000-memory.dmp

Download

memory/2724-2-0x00000000001B0000-0x00000000001C3000-memory.dmp

Download

memory/2724-1-0x00000000002B0000-0x00000000003B0000-memory.dmp

Download

memory/2724-14-0x0000000000400000-0x000000000085D000-memory.dmp

Download

memory/2724-5-0x00000000002B0000-0x00000000003B0000-memory.dmp

Download

memory/2724-9-0x00000000001B0000-0x00000000001C3000-memory.dmp

Download

memory/2724-7-0x0000000000400000-0x000000000085D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads