tofsee | 531bdeb17a9c3dd2fafa554d41b044cc26b597260feed98f13cae36a9825d400

Analysis

max time kernel
242s
max time network
256s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 19:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4929cf4b5fecde39e27ec00f0954edad.exe
Size 12.0MB
Sample240107-x9ltpadec2
SHA256 531bdeb17a9c3dd2fafa554d41b044cc26b597260feed98f13cae36a9825d400
MD5 4929cf4b5fecde39e27ec00f0954edad
SHA1 faa8f0dd088e4b4d0775e183f1e4c3b35898e9da
SHA512 06cd567b72318c19d3e1c35608ad69b8adf70067fa7e436712abcb8cfe4bf716e4c2df44c70da88518b409bd9830b32b9d9661a9a010d83d299fb7771269cac2
SSDEEP 24576:xjDuKnh7YzbKBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBD:xnh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

defeatwax.ru
refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
1568	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\zbmogerx\ImagePath = "C:\\Windows\\SysWOW64\\zbmogerx\\nfkkrjdh.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	4929cf4b5fecde39e27ec00f0954edad.exe

Executes dropped EXE 1 IoCs

pid	Process
2724	nfkkrjdh.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2724 set thread context of 2164	2724	nfkkrjdh.exe	112

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2280	sc.exe
3744	sc.exe
3972	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 4344	2968	4929cf4b5fecde39e27ec00f0954edad.exe	94
PID 2968 wrote to memory of 4344	2968	4929cf4b5fecde39e27ec00f0954edad.exe	94
PID 2968 wrote to memory of 4344	2968	4929cf4b5fecde39e27ec00f0954edad.exe	94
PID 2968 wrote to memory of 4568	2968	4929cf4b5fecde39e27ec00f0954edad.exe	96
PID 2968 wrote to memory of 4568	2968	4929cf4b5fecde39e27ec00f0954edad.exe	96
PID 2968 wrote to memory of 4568	2968	4929cf4b5fecde39e27ec00f0954edad.exe	96
PID 2968 wrote to memory of 2280	2968	4929cf4b5fecde39e27ec00f0954edad.exe	101
PID 2968 wrote to memory of 2280	2968	4929cf4b5fecde39e27ec00f0954edad.exe	101
PID 2968 wrote to memory of 2280	2968	4929cf4b5fecde39e27ec00f0954edad.exe	101
PID 2968 wrote to memory of 3744	2968	4929cf4b5fecde39e27ec00f0954edad.exe	104
PID 2968 wrote to memory of 3744	2968	4929cf4b5fecde39e27ec00f0954edad.exe	104
PID 2968 wrote to memory of 3744	2968	4929cf4b5fecde39e27ec00f0954edad.exe	104
PID 2968 wrote to memory of 3972	2968	4929cf4b5fecde39e27ec00f0954edad.exe	106
PID 2968 wrote to memory of 3972	2968	4929cf4b5fecde39e27ec00f0954edad.exe	106
PID 2968 wrote to memory of 3972	2968	4929cf4b5fecde39e27ec00f0954edad.exe	106
PID 2968 wrote to memory of 1568	2968	4929cf4b5fecde39e27ec00f0954edad.exe	108
PID 2968 wrote to memory of 1568	2968	4929cf4b5fecde39e27ec00f0954edad.exe	108
PID 2968 wrote to memory of 1568	2968	4929cf4b5fecde39e27ec00f0954edad.exe	108
PID 2724 wrote to memory of 2164	2724	nfkkrjdh.exe	112
PID 2724 wrote to memory of 2164	2724	nfkkrjdh.exe	112
PID 2724 wrote to memory of 2164	2724	nfkkrjdh.exe	112
PID 2724 wrote to memory of 2164	2724	nfkkrjdh.exe	112
PID 2724 wrote to memory of 2164	2724	nfkkrjdh.exe	112

C:\Users\Admin\AppData\Local\Temp\4929cf4b5fecde39e27ec00f0954edad.exe
"C:\Users\Admin\AppData\Local\Temp\4929cf4b5fecde39e27ec00f0954edad.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\zbmogerx\
  2⤵
  PID:4344
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\nfkkrjdh.exe" C:\Windows\SysWOW64\zbmogerx\
  2⤵
  PID:4568
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create zbmogerx binPath= "C:\Windows\SysWOW64\zbmogerx\nfkkrjdh.exe /d\"C:\Users\Admin\AppData\Local\Temp\4929cf4b5fecde39e27ec00f0954edad.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:2280
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description zbmogerx "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:3744
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start zbmogerx
  2⤵
  - Launches sc.exe
  PID:3972
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:1568

C:\Windows\SysWOW64\zbmogerx\nfkkrjdh.exe
C:\Windows\SysWOW64\zbmogerx\nfkkrjdh.exe /d"C:\Users\Admin\AppData\Local\Temp\4929cf4b5fecde39e27ec00f0954edad.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nfkkrjdh.exe

Path C:\Users\Admin\AppData\Local\Temp\nfkkrjdh.exe
Size 14.2MB
SHA256 d29d68f9d3dc81a08e7cb0c23f2cfc87ea2ea64f6ccbe2d89542053d4e8942af
MD5 68b8db0d03d6c7d32925898f28b7b61e
SHA1 2c17098d58dfdc0b37ab4d4afb5d8cfc973969fb
SHA512 71759ea8ba28035e4ac4419e4d567f156f4dcdd30f53efd1bb372482e764f89feec33c4d3cf9c849866de05f9884b068a6d15902f5850fb0e8304a6ba005dfe3
SSDEEP 24576:tjDuKnh7YzbKBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBf:tnh
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2164-33-0x0000000001240000-0x0000000001255000-memory.dmp

Download

memory/2164-30-0x0000000001240000-0x0000000001255000-memory.dmp

Download

memory/2164-25-0x0000000001240000-0x0000000001255000-memory.dmp

Download

memory/2164-23-0x0000000001240000-0x0000000001255000-memory.dmp

Download

memory/2164-17-0x0000000001240000-0x0000000001255000-memory.dmp

Download

memory/2724-16-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2724-15-0x00000000004B0000-0x00000000005B0000-memory.dmp

Download

memory/2724-19-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2968-1-0x0000000000680000-0x0000000000780000-memory.dmp

Download

memory/2968-8-0x00000000005D0000-0x00000000005E3000-memory.dmp

Download

memory/2968-18-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2968-6-0x0000000000680000-0x0000000000780000-memory.dmp

Download

memory/2968-5-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2968-3-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2968-2-0x00000000005D0000-0x00000000005E3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads