tofsee | b2b52413eb8374756d3fff43e2f16d6229dc1327edd1f5fb225bd3c0fecad4f8

General

Target

4718067e3e7b2de52dcdb60475f4f800.exe
Size

12.5MB
MD5

4718067e3e7b2de52dcdb60475f4f800
SHA1

e8dc7059536917d1e9bd7d0aff721f945785db1d
SHA256

b2b52413eb8374756d3fff43e2f16d6229dc1327edd1f5fb225bd3c0fecad4f8
SHA512

3f5866d8bf4ea81143be22e032643677d01d7fa8e2cc77d5a5c68c03c2c8697b8241ebe6c60f96bc7b36651d26073f568a9204158523ab48962c1e337eb55561
SSDEEP

49152:CWqmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm7:

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
4496	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\upovqebl\ImagePath = "C:\\Windows\\SysWOW64\\upovqebl\\vrjjgvui.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	4718067e3e7b2de52dcdb60475f4f800.exe

Deletes itself 1 IoCs

pid	Process
4964	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2132	vrjjgvui.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2132 set thread context of 4964	2132	vrjjgvui.exe	105

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3472	sc.exe
1072	sc.exe
1156	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4120	972	WerFault.exe	86
2992	2132	WerFault.exe	100

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 972 wrote to memory of 1740	972	4718067e3e7b2de52dcdb60475f4f800.exe	90
PID 972 wrote to memory of 1740	972	4718067e3e7b2de52dcdb60475f4f800.exe	90
PID 972 wrote to memory of 1740	972	4718067e3e7b2de52dcdb60475f4f800.exe	90
PID 972 wrote to memory of 1624	972	4718067e3e7b2de52dcdb60475f4f800.exe	92
PID 972 wrote to memory of 1624	972	4718067e3e7b2de52dcdb60475f4f800.exe	92
PID 972 wrote to memory of 1624	972	4718067e3e7b2de52dcdb60475f4f800.exe	92
PID 972 wrote to memory of 3472	972	4718067e3e7b2de52dcdb60475f4f800.exe	94
PID 972 wrote to memory of 3472	972	4718067e3e7b2de52dcdb60475f4f800.exe	94
PID 972 wrote to memory of 3472	972	4718067e3e7b2de52dcdb60475f4f800.exe	94
PID 972 wrote to memory of 1072	972	4718067e3e7b2de52dcdb60475f4f800.exe	96
PID 972 wrote to memory of 1072	972	4718067e3e7b2de52dcdb60475f4f800.exe	96
PID 972 wrote to memory of 1072	972	4718067e3e7b2de52dcdb60475f4f800.exe	96
PID 972 wrote to memory of 1156	972	4718067e3e7b2de52dcdb60475f4f800.exe	98
PID 972 wrote to memory of 1156	972	4718067e3e7b2de52dcdb60475f4f800.exe	98
PID 972 wrote to memory of 1156	972	4718067e3e7b2de52dcdb60475f4f800.exe	98
PID 972 wrote to memory of 4496	972	4718067e3e7b2de52dcdb60475f4f800.exe	101
PID 972 wrote to memory of 4496	972	4718067e3e7b2de52dcdb60475f4f800.exe	101
PID 972 wrote to memory of 4496	972	4718067e3e7b2de52dcdb60475f4f800.exe	101
PID 2132 wrote to memory of 4964	2132	vrjjgvui.exe	105
PID 2132 wrote to memory of 4964	2132	vrjjgvui.exe	105
PID 2132 wrote to memory of 4964	2132	vrjjgvui.exe	105
PID 2132 wrote to memory of 4964	2132	vrjjgvui.exe	105
PID 2132 wrote to memory of 4964	2132	vrjjgvui.exe	105

C:\Users\Admin\AppData\Local\Temp\4718067e3e7b2de52dcdb60475f4f800.exe
"C:\Users\Admin\AppData\Local\Temp\4718067e3e7b2de52dcdb60475f4f800.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:972
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\upovqebl\
  2⤵
  PID:1740
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\vrjjgvui.exe" C:\Windows\SysWOW64\upovqebl\
  2⤵
  PID:1624
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create upovqebl binPath= "C:\Windows\SysWOW64\upovqebl\vrjjgvui.exe /d\"C:\Users\Admin\AppData\Local\Temp\4718067e3e7b2de52dcdb60475f4f800.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:3472
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description upovqebl "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:1072
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start upovqebl
  2⤵
  - Launches sc.exe
  PID:1156
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:4496
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 972 -s 1036
  2⤵
  - Program crash
  PID:4120

C:\Windows\SysWOW64\upovqebl\vrjjgvui.exe
C:\Windows\SysWOW64\upovqebl\vrjjgvui.exe /d"C:\Users\Admin\AppData\Local\Temp\4718067e3e7b2de52dcdb60475f4f800.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  PID:4964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 516
  2⤵
  - Program crash
  PID:2992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 972 -ip 972
1⤵
PID:768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2132 -ip 2132
1⤵
PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\vrjjgvui.exe

Filesize
14.6MB

MD5
13301448c67a17519893caf5f2376791

SHA1
d165c06c997f4402bc400b8c04bc997efe72fed5

SHA256
f70a76a46c7d0091484b49802f83235266876743ffe96f221e422e7c10b551b8

SHA512
30516778f3c508c558bd3bcbabd0f5b0c4ff1645ccda0fbdbe7fd71f3035f26b9ff653d9e6de861c6166e77d8bac92e2803a38eb8cf13a807cc30a33805990a8

Download Submit
C:\Windows\SysWOW64\upovqebl\vrjjgvui.exe

Filesize
2.1MB

MD5
1d9d882be3e198a68a0d347ca723f848

SHA1
c2a338bac751710f484ec532325fb6a1d8b60573

SHA256
4f3bb52e6bf40171118135e0d70570c04050bd07b9188b59acfca4d08cc68ba2

SHA512
fb887fe70be8c3bfd39f2ead01ff71a4fe83137e4739058ad2be0610dac2f132a147c5163762037ccb31508c24883384b10e2d9bb79d0bcd7dedb4a9f3999701

Download Submit
memory/972-2-0x00000000001C0000-0x00000000001D3000-memory.dmp

Filesize
76KB

Download
memory/972-1-0x00000000009B0000-0x0000000000AB0000-memory.dmp

Filesize
1024KB

Download
memory/972-4-0x0000000000400000-0x0000000000842000-memory.dmp

Filesize
4.3MB

Download
memory/972-16-0x0000000000400000-0x0000000000842000-memory.dmp

Filesize
4.3MB

Download
memory/2132-9-0x00000000001C0000-0x00000000001D3000-memory.dmp

Filesize
76KB

Download
memory/2132-12-0x0000000000400000-0x0000000000842000-memory.dmp

Filesize
4.3MB

Download
memory/2132-15-0x0000000000400000-0x0000000000842000-memory.dmp

Filesize
4.3MB

Download
memory/2132-8-0x0000000000A80000-0x0000000000B80000-memory.dmp

Filesize
1024KB

Download
memory/4964-10-0x00000000008C0000-0x00000000008D5000-memory.dmp

Filesize
84KB

Download
memory/4964-14-0x00000000008C0000-0x00000000008D5000-memory.dmp

Filesize
84KB

Download
memory/4964-17-0x00000000008C0000-0x00000000008D5000-memory.dmp

Filesize
84KB

Download
memory/4964-18-0x00000000008C0000-0x00000000008D5000-memory.dmp

Filesize
84KB

Download
memory/4964-19-0x00000000008C0000-0x00000000008D5000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads