tofsee | efe6315675eb2edf1a85c046a80ca2e6e3624645af08edefb1d591a2953172ba

Analysis

max time kernel
3s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 00:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4a3af3aac56c286482902df1c358e861.exe
Size 14.5MB
Sample240108-bb9bfahdcq
SHA256 efe6315675eb2edf1a85c046a80ca2e6e3624645af08edefb1d591a2953172ba
MD5 4a3af3aac56c286482902df1c358e861
SHA1 cd32addb29dd700ce6b5b7ca2102139a84babcd3
SHA512 95df7ec7dec511892a090ca0975dc5e56ea20751b6e30c6053b01e2a4723ac010cdc856ab915da54fc17bd0cb2bac2d7190e0e1267935aa89bf29e558338e057
SSDEEP 24576:RG8888888888888888888888888888888888888888888888888888888888888o:
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

defeatwax.ru
refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
2384	netsh.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3060	sc.exe
1604	sc.exe
468	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3900	4020	WerFault.exe	15
1744	3092	WerFault.exe	106

C:\Users\Admin\AppData\Local\Temp\4a3af3aac56c286482902df1c358e861.exe
"C:\Users\Admin\AppData\Local\Temp\4a3af3aac56c286482902df1c358e861.exe"
1⤵
PID:4020
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\tnrblsoq\
  2⤵
  PID:920
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\wrgqvasq.exe" C:\Windows\SysWOW64\tnrblsoq\
  2⤵
  PID:1340
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create tnrblsoq binPath= "C:\Windows\SysWOW64\tnrblsoq\wrgqvasq.exe /d\"C:\Users\Admin\AppData\Local\Temp\4a3af3aac56c286482902df1c358e861.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:3060
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description tnrblsoq "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:1604
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start tnrblsoq
  2⤵
  - Launches sc.exe
  PID:468
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:2384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 1204
  2⤵
  - Program crash
  PID:3900

C:\Windows\SysWOW64\tnrblsoq\wrgqvasq.exe
C:\Windows\SysWOW64\tnrblsoq\wrgqvasq.exe /d"C:\Users\Admin\AppData\Local\Temp\4a3af3aac56c286482902df1c358e861.exe"
1⤵
PID:3092
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:3240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 536
  2⤵
  - Program crash
  PID:1744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4020 -ip 4020
1⤵
PID:4648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3092 -ip 3092
1⤵
PID:1948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wrgqvasq.exe

Path C:\Users\Admin\AppData\Local\Temp\wrgqvasq.exe
Size 21KB
SHA256 861d6d6cdff883effcd2d3284c28b5fcce3b1c3361404edb5181c5f58b674507
MD5 bbbf74fb1d293af1cd771fd375d13971
SHA1 95a8d8dac2e5191ad8ba8a2d3537b585592c307e
SHA512 4b9c400ed9b857dae7d6fa9ee562808988f5d129956c7e4d57cbfb4dfd7ef5e415fa98734bd563ccbc8ca5e69d15951a66d413196bffcc5361082db35a47b738
SSDEEP 384:Rx4iVVj6VvUPvxMLOFIuIGeTB9kzbT4OFj62dwCM+pBOHmR2w:L4g56VvUnxM9uIGeTAUObOGf
MD5 SHA1 SHA512 SSDEEP

Submit Download

wrgqvasq.exe

Path C:\Windows\SysWOW64\tnrblsoq\wrgqvasq.exe
Size 17KB
SHA256 41b3b2867b067761d39ed0ed3eb504497efa5f9f0113f915386b937b9079fd49
MD5 0e81932a85b1b7b7e78701ad97b38899
SHA1 bfe016fb9ebdab159f643263628133a87153a074
SHA512 5dffa3d054a7860329f6a23c57375c8836c348e39fdcbeea9277ffe03111b380e66c6e8f14110e9279b34e5f47b882f914331c0945478cd4968187d2057e8b24
SSDEEP 384:Rx4iVVj6VvUPvxMLOFIuIGeTB9kzbT4OFj62dt:L4g56VvUnxM9uIGeTAx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3092-17-0x0000000000400000-0x0000000002CB9000-memory.dmp

Download

memory/3092-12-0x0000000002E60000-0x0000000002F60000-memory.dmp

Download

memory/3240-16-0x00000000012D0000-0x00000000012E5000-memory.dmp

Download

memory/3240-14-0x00000000012D0000-0x00000000012E5000-memory.dmp

Download

memory/3240-18-0x00000000012D0000-0x00000000012E5000-memory.dmp

Download

memory/3240-10-0x00000000012D0000-0x00000000012E5000-memory.dmp

Download

memory/3240-19-0x00000000012D0000-0x00000000012E5000-memory.dmp

Download

memory/4020-9-0x0000000002E20000-0x0000000002E33000-memory.dmp

Download

memory/4020-8-0x0000000000400000-0x0000000002CB9000-memory.dmp

Download

memory/4020-4-0x0000000000400000-0x0000000002CB9000-memory.dmp

Download

memory/4020-2-0x0000000002E20000-0x0000000002E33000-memory.dmp

Download

memory/4020-1-0x0000000002EA0000-0x0000000002FA0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads