tofsee | b2b52413eb8374756d3fff43e2f16d6229dc1327edd1f5fb225bd3c0fecad4f8

Analysis

max time kernel
148s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 20:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4718067e3e7b2de52dcdb60475f4f800.exe
Size

12.5MB
MD5

4718067e3e7b2de52dcdb60475f4f800
SHA1

e8dc7059536917d1e9bd7d0aff721f945785db1d
SHA256

b2b52413eb8374756d3fff43e2f16d6229dc1327edd1f5fb225bd3c0fecad4f8
SHA512

3f5866d8bf4ea81143be22e032643677d01d7fa8e2cc77d5a5c68c03c2c8697b8241ebe6c60f96bc7b36651d26073f568a9204158523ab48962c1e337eb55561
SSDEEP

49152:CWqmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm7:

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\mbewaztd = "0"	svchost.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
2588	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\mbewaztd\ImagePath = "C:\\Windows\\SysWOW64\\mbewaztd\\qpdftqrj.exe"	svchost.exe

Deletes itself 1 IoCs

pid	Process
2568	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2576	qpdftqrj.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2576 set thread context of 2568	2576	qpdftqrj.exe	38

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2412	sc.exe
2660	sc.exe
2904	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2016	2380	4718067e3e7b2de52dcdb60475f4f800.exe	28
PID 2380 wrote to memory of 2016	2380	4718067e3e7b2de52dcdb60475f4f800.exe	28
PID 2380 wrote to memory of 2016	2380	4718067e3e7b2de52dcdb60475f4f800.exe	28
PID 2380 wrote to memory of 2016	2380	4718067e3e7b2de52dcdb60475f4f800.exe	28
PID 2380 wrote to memory of 3060	2380	4718067e3e7b2de52dcdb60475f4f800.exe	31
PID 2380 wrote to memory of 3060	2380	4718067e3e7b2de52dcdb60475f4f800.exe	31
PID 2380 wrote to memory of 3060	2380	4718067e3e7b2de52dcdb60475f4f800.exe	31
PID 2380 wrote to memory of 3060	2380	4718067e3e7b2de52dcdb60475f4f800.exe	31
PID 2380 wrote to memory of 2412	2380	4718067e3e7b2de52dcdb60475f4f800.exe	32
PID 2380 wrote to memory of 2412	2380	4718067e3e7b2de52dcdb60475f4f800.exe	32
PID 2380 wrote to memory of 2412	2380	4718067e3e7b2de52dcdb60475f4f800.exe	32
PID 2380 wrote to memory of 2412	2380	4718067e3e7b2de52dcdb60475f4f800.exe	32
PID 2380 wrote to memory of 2660	2380	4718067e3e7b2de52dcdb60475f4f800.exe	35
PID 2380 wrote to memory of 2660	2380	4718067e3e7b2de52dcdb60475f4f800.exe	35
PID 2380 wrote to memory of 2660	2380	4718067e3e7b2de52dcdb60475f4f800.exe	35
PID 2380 wrote to memory of 2660	2380	4718067e3e7b2de52dcdb60475f4f800.exe	35
PID 2380 wrote to memory of 2904	2380	4718067e3e7b2de52dcdb60475f4f800.exe	37
PID 2380 wrote to memory of 2904	2380	4718067e3e7b2de52dcdb60475f4f800.exe	37
PID 2380 wrote to memory of 2904	2380	4718067e3e7b2de52dcdb60475f4f800.exe	37
PID 2380 wrote to memory of 2904	2380	4718067e3e7b2de52dcdb60475f4f800.exe	37
PID 2576 wrote to memory of 2568	2576	qpdftqrj.exe	38
PID 2576 wrote to memory of 2568	2576	qpdftqrj.exe	38
PID 2576 wrote to memory of 2568	2576	qpdftqrj.exe	38
PID 2576 wrote to memory of 2568	2576	qpdftqrj.exe	38
PID 2576 wrote to memory of 2568	2576	qpdftqrj.exe	38
PID 2576 wrote to memory of 2568	2576	qpdftqrj.exe	38
PID 2380 wrote to memory of 2588	2380	4718067e3e7b2de52dcdb60475f4f800.exe	40
PID 2380 wrote to memory of 2588	2380	4718067e3e7b2de52dcdb60475f4f800.exe	40
PID 2380 wrote to memory of 2588	2380	4718067e3e7b2de52dcdb60475f4f800.exe	40
PID 2380 wrote to memory of 2588	2380	4718067e3e7b2de52dcdb60475f4f800.exe	40

C:\Users\Admin\AppData\Local\Temp\4718067e3e7b2de52dcdb60475f4f800.exe
"C:\Users\Admin\AppData\Local\Temp\4718067e3e7b2de52dcdb60475f4f800.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\mbewaztd\
  2⤵
  PID:2016
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\qpdftqrj.exe" C:\Windows\SysWOW64\mbewaztd\
  2⤵
  PID:3060
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create mbewaztd binPath= "C:\Windows\SysWOW64\mbewaztd\qpdftqrj.exe /d\"C:\Users\Admin\AppData\Local\Temp\4718067e3e7b2de52dcdb60475f4f800.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:2412
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description mbewaztd "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2660
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start mbewaztd
  2⤵
  - Launches sc.exe
  PID:2904
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:2588

C:\Windows\SysWOW64\svchost.exe
svchost.exe
1⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
PID:2568

C:\Windows\SysWOW64\mbewaztd\qpdftqrj.exe
C:\Windows\SysWOW64\mbewaztd\qpdftqrj.exe /d"C:\Users\Admin\AppData\Local\Temp\4718067e3e7b2de52dcdb60475f4f800.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\qpdftqrj.exe

Filesize
1.2MB

MD5
186ed3c672f177f7e0e38d64a6814cd0

SHA1
baa9578bef95b0f789d3f8fce1cde1082da95244

SHA256
3a781f48de359cc6b5e59123dcdb90ed1ee303f227cfc591a6b9693134a3c4c1

SHA512
e055a08f7347d2fbf899fe3f4b819c902fd43d0f9a0d4789d46566a1d7a25b6805294ed2e7092af5f6b1cd6cb5a1667dba2025c7ccc979582e09cd3a930534ac

Download Submit
C:\Windows\SysWOW64\mbewaztd\qpdftqrj.exe

Filesize
384KB

MD5
7d692acaaa56433c9326f2cf369f69b0

SHA1
7e808d6215ce16c9bf1bc9d7d0fd2e8ce474b3de

SHA256
0a0ee55f85fb1ccf894b406b6b16a5da8a670e5008a58042101a944a8316a522

SHA512
815952a375ac3d74dfbc1a94365997ca1a5e6657398dba062cc946ffc781a94fbf86665579b9c3eee58b7ff6b04491f54dff50d4fb6a99ac1eba0768a03e058d

Download Submit
memory/2380-18-0x0000000000400000-0x0000000000842000-memory.dmp

Filesize
4.3MB

Download
memory/2380-4-0x0000000000400000-0x0000000000842000-memory.dmp

Filesize
4.3MB

Download
memory/2380-3-0x0000000000020000-0x0000000000033000-memory.dmp

Filesize
76KB

Download
memory/2380-1-0x0000000000290000-0x0000000000390000-memory.dmp

Filesize
1024KB

Download
memory/2568-13-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2568-17-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2568-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2568-8-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2568-20-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2568-19-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2568-21-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2576-15-0x0000000000400000-0x0000000000842000-memory.dmp

Filesize
4.3MB

Download
memory/2576-11-0x0000000000400000-0x0000000000842000-memory.dmp

Filesize
4.3MB

Download
memory/2576-9-0x0000000000C90000-0x0000000000D90000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads