tofsee | b2801e0865e24eadff5080c1cd3833d47b74e77dfbd58054cdb982d392a0b5b1

General

Target

4b0bc920b6d76b4dfc2c3fd430785b87.exe
Size

11.0MB
MD5

4b0bc920b6d76b4dfc2c3fd430785b87
SHA1

d42e0b3d8e55f6f53ef87ac9fab2b6a6c3c91df0
SHA256

b2801e0865e24eadff5080c1cd3833d47b74e77dfbd58054cdb982d392a0b5b1
SHA512

4edbd0753f2afb747468538d8a4eb17c436cddcc7ce4988dc9f176716d32a95328e1ee528a4d0b0bcc3ca91885620d19c147fa06b34f207481d691ccb1d56ab6
SSDEEP

49152:XNS3S3S3S3S3S3S3S3S3S3S3S3S3S3S3S3S3S3S3S3S3S3S3S3S3S3S3S3S3S3SC:X

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
1580	netsh.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2740	sc.exe
2800	sc.exe
2820	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2112	2104	4b0bc920b6d76b4dfc2c3fd430785b87.exe	29
PID 2104 wrote to memory of 2112	2104	4b0bc920b6d76b4dfc2c3fd430785b87.exe	29
PID 2104 wrote to memory of 2112	2104	4b0bc920b6d76b4dfc2c3fd430785b87.exe	29
PID 2104 wrote to memory of 2112	2104	4b0bc920b6d76b4dfc2c3fd430785b87.exe	29

C:\Users\Admin\AppData\Local\Temp\4b0bc920b6d76b4dfc2c3fd430785b87.exe
"C:\Users\Admin\AppData\Local\Temp\4b0bc920b6d76b4dfc2c3fd430785b87.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\xeoexgwn\
  2⤵
  PID:2112
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\fioixitz.exe" C:\Windows\SysWOW64\xeoexgwn\
  2⤵
  PID:2372
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create xeoexgwn binPath= "C:\Windows\SysWOW64\xeoexgwn\fioixitz.exe /d\"C:\Users\Admin\AppData\Local\Temp\4b0bc920b6d76b4dfc2c3fd430785b87.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:2740
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description xeoexgwn "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2800
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start xeoexgwn
  2⤵
  - Launches sc.exe
  PID:2820
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:1580

C:\Windows\SysWOW64\xeoexgwn\fioixitz.exe
C:\Windows\SysWOW64\xeoexgwn\fioixitz.exe /d"C:\Users\Admin\AppData\Local\Temp\4b0bc920b6d76b4dfc2c3fd430785b87.exe"
1⤵
PID:2932
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fioixitz.exe

Filesize
21KB

MD5
c341ad9af0ca40bf9870d821285680ad

SHA1
bb0fb029906c97cf65399257d7e52b06ae5397d8

SHA256
9b01bfbfed2a927ff6f4068d162a69c83746ba551a86269f9dee15336e745421

SHA512
ee350527cdeb01aab897014204d2f35a6674d88f67925ee7abc2ab5a1ac07d128942ffa3ad3ae01a01a3be27ec3312972b635cb536620c2057093008e21aa775

Download Submit
C:\Windows\SysWOW64\xeoexgwn\fioixitz.exe

Filesize
12KB

MD5
f910aa25613a0f7bd52718318549bb22

SHA1
4de1fe5ac1b76ec47ad87f9162afdbd25657c96e

SHA256
438e808b8b34e188e30be376cca3c15f518d37dad38e0418b7a20594f649fbd8

SHA512
a7066517b536aa3d1f5e2ddbb735948371575512d98c5488c5e478a1a5798cab3c54f5a1f727ebc8709d731bb6952c3078b626707351c09e66d01e80ac85f05c

Download Submit
memory/320-8-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/320-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/320-17-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/320-18-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/320-19-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/320-11-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2104-1-0x00000000002B0000-0x00000000003B0000-memory.dmp

Filesize
1024KB

Download
memory/2104-6-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2104-3-0x00000000001B0000-0x00000000001C3000-memory.dmp

Filesize
76KB

Download
memory/2932-12-0x00000000002D0000-0x00000000003D0000-memory.dmp

Filesize
1024KB

Download
memory/2932-14-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads