tofsee | ce01494008d505ee538796c5283d93f3b17c049ed3eb6097e77857e8ca938b6b

General

Target

404915212cf53138397c2505a845319a.exe
Size

11.1MB
MD5

404915212cf53138397c2505a845319a
SHA1

d845065469c5b28b4c4394b2f4c4eaf34b8405a7
SHA256

ce01494008d505ee538796c5283d93f3b17c049ed3eb6097e77857e8ca938b6b
SHA512

073cfec303442c6d221a958ef72a01810ebdf44f3d887d5d65073f0a02d77c37e1094cbf9a28ca892cd2d118cc2a0882fb694f426b5c3713993bcbf660366b3c
SSDEEP

24576:sjCj10HSqGgeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeev:s/D

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
3360	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ilsdrevd\ImagePath = "C:\\Windows\\SysWOW64\\ilsdrevd\\clbpqetz.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	404915212cf53138397c2505a845319a.exe

Executes dropped EXE 1 IoCs

pid	Process
1588	clbpqetz.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1588 set thread context of 2920	1588	clbpqetz.exe	105

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4804	sc.exe
2524	sc.exe
864	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 3096	4812	404915212cf53138397c2505a845319a.exe	93
PID 4812 wrote to memory of 3096	4812	404915212cf53138397c2505a845319a.exe	93
PID 4812 wrote to memory of 3096	4812	404915212cf53138397c2505a845319a.exe	93
PID 4812 wrote to memory of 4740	4812	404915212cf53138397c2505a845319a.exe	95
PID 4812 wrote to memory of 4740	4812	404915212cf53138397c2505a845319a.exe	95
PID 4812 wrote to memory of 4740	4812	404915212cf53138397c2505a845319a.exe	95
PID 4812 wrote to memory of 864	4812	404915212cf53138397c2505a845319a.exe	96
PID 4812 wrote to memory of 864	4812	404915212cf53138397c2505a845319a.exe	96
PID 4812 wrote to memory of 864	4812	404915212cf53138397c2505a845319a.exe	96
PID 4812 wrote to memory of 4804	4812	404915212cf53138397c2505a845319a.exe	99
PID 4812 wrote to memory of 4804	4812	404915212cf53138397c2505a845319a.exe	99
PID 4812 wrote to memory of 4804	4812	404915212cf53138397c2505a845319a.exe	99
PID 4812 wrote to memory of 2524	4812	404915212cf53138397c2505a845319a.exe	101
PID 4812 wrote to memory of 2524	4812	404915212cf53138397c2505a845319a.exe	101
PID 4812 wrote to memory of 2524	4812	404915212cf53138397c2505a845319a.exe	101
PID 4812 wrote to memory of 3360	4812	404915212cf53138397c2505a845319a.exe	103
PID 4812 wrote to memory of 3360	4812	404915212cf53138397c2505a845319a.exe	103
PID 4812 wrote to memory of 3360	4812	404915212cf53138397c2505a845319a.exe	103
PID 1588 wrote to memory of 2920	1588	clbpqetz.exe	105
PID 1588 wrote to memory of 2920	1588	clbpqetz.exe	105
PID 1588 wrote to memory of 2920	1588	clbpqetz.exe	105
PID 1588 wrote to memory of 2920	1588	clbpqetz.exe	105
PID 1588 wrote to memory of 2920	1588	clbpqetz.exe	105

C:\Users\Admin\AppData\Local\Temp\404915212cf53138397c2505a845319a.exe
"C:\Users\Admin\AppData\Local\Temp\404915212cf53138397c2505a845319a.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ilsdrevd\
  2⤵
  PID:3096
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\clbpqetz.exe" C:\Windows\SysWOW64\ilsdrevd\
  2⤵
  PID:4740
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create ilsdrevd binPath= "C:\Windows\SysWOW64\ilsdrevd\clbpqetz.exe /d\"C:\Users\Admin\AppData\Local\Temp\404915212cf53138397c2505a845319a.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:864
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description ilsdrevd "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:4804
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start ilsdrevd
  2⤵
  - Launches sc.exe
  PID:2524
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:3360

C:\Windows\SysWOW64\ilsdrevd\clbpqetz.exe
C:\Windows\SysWOW64\ilsdrevd\clbpqetz.exe /d"C:\Users\Admin\AppData\Local\Temp\404915212cf53138397c2505a845319a.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\clbpqetz.exe

Filesize
1.2MB

MD5
c3c076a77d0471da0b2865d173b76847

SHA1
123d8d04abeadd6d573b63cd9729ce91cf988335

SHA256
95a60232cb0b2dd443fce1134a819fbfdb7d9b980fd9bb73691adf4dc53b2a77

SHA512
b75aeed7dddfc265d09511cc075440673c2d13b10af34f96b453c74ac1b1bd80ccc1282a707d6b062f508b9cc85973481231a348cbfe373d5ef59854679bae84

Download Submit
C:\Windows\SysWOW64\ilsdrevd\clbpqetz.exe

Filesize
807KB

MD5
0dd4b6f7cca19de4f8e9ddc67be603e0

SHA1
195286e07a419f458b7df6902518a9943581c206

SHA256
df2db738922613ea34f863069404d82e66af990ffb931a249f16add626e038e0

SHA512
1f4d42abcf2c8a45601ec6413a9cfe9d9c14452cdf01d9146e840e32458455b7c500a6f1d8b64967a931b07c1d2c56a5638893727eb4f034c7a47bc21e0fbcfc

Download Submit
memory/1588-18-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1588-8-0x00000000006C0000-0x00000000007C0000-memory.dmp

Filesize
1024KB

Download
memory/1588-9-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1588-23-0x0000000000D30000-0x0000000000D43000-memory.dmp

Filesize
76KB

Download
memory/2920-16-0x0000000000200000-0x0000000000215000-memory.dmp

Filesize
84KB

Download
memory/2920-26-0x0000000000200000-0x0000000000215000-memory.dmp

Filesize
84KB

Download
memory/2920-10-0x0000000000200000-0x0000000000215000-memory.dmp

Filesize
84KB

Download
memory/2920-13-0x0000000000200000-0x0000000000215000-memory.dmp

Filesize
84KB

Download
memory/2920-15-0x0000000000200000-0x0000000000215000-memory.dmp

Filesize
84KB

Download
memory/4812-14-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4812-1-0x0000000000610000-0x0000000000710000-memory.dmp

Filesize
1024KB

Download
memory/4812-21-0x0000000000610000-0x0000000000710000-memory.dmp

Filesize
1024KB

Download
memory/4812-3-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4812-2-0x00000000005E0000-0x00000000005F3000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads