tofsee | 60dd47adecfac5a2efbb3b52ef50b0d8b3418f2aa240bb0318506bcb8bd29ffc

General

Target

4e7e10a9215ce25b621b2e7381cea3fc.exe
Size

12.2MB
MD5

4e7e10a9215ce25b621b2e7381cea3fc
SHA1

c283ae34f3edfc369fa4bdb44866dcb406e627d7
SHA256

60dd47adecfac5a2efbb3b52ef50b0d8b3418f2aa240bb0318506bcb8bd29ffc
SHA512

7e83eb21fc6594e07ea58d649d0e7757a77609443add91fbe9345350cf46bcb8d4f84097d6e17868a3b616455b6d44057c02f0bf32cd56e91a54c64ce0562bb8
SSDEEP

98304:VNWUlllllllllllllllllllllllllllllllllllllllllllllllllllllllllll7:TW

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
2668	netsh.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2568	sc.exe
2028	sc.exe
2392	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2928	2864	4e7e10a9215ce25b621b2e7381cea3fc.exe	30
PID 2864 wrote to memory of 2928	2864	4e7e10a9215ce25b621b2e7381cea3fc.exe	30
PID 2864 wrote to memory of 2928	2864	4e7e10a9215ce25b621b2e7381cea3fc.exe	30
PID 2864 wrote to memory of 2928	2864	4e7e10a9215ce25b621b2e7381cea3fc.exe	30
PID 2864 wrote to memory of 2740	2864	4e7e10a9215ce25b621b2e7381cea3fc.exe	32
PID 2864 wrote to memory of 2740	2864	4e7e10a9215ce25b621b2e7381cea3fc.exe	32
PID 2864 wrote to memory of 2740	2864	4e7e10a9215ce25b621b2e7381cea3fc.exe	32
PID 2864 wrote to memory of 2740	2864	4e7e10a9215ce25b621b2e7381cea3fc.exe	32
PID 2864 wrote to memory of 2568	2864	4e7e10a9215ce25b621b2e7381cea3fc.exe	35
PID 2864 wrote to memory of 2568	2864	4e7e10a9215ce25b621b2e7381cea3fc.exe	35
PID 2864 wrote to memory of 2568	2864	4e7e10a9215ce25b621b2e7381cea3fc.exe	35
PID 2864 wrote to memory of 2568	2864	4e7e10a9215ce25b621b2e7381cea3fc.exe	35

C:\Users\Admin\AppData\Local\Temp\4e7e10a9215ce25b621b2e7381cea3fc.exe
"C:\Users\Admin\AppData\Local\Temp\4e7e10a9215ce25b621b2e7381cea3fc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\qumxqmz\
  2⤵
  PID:2928
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\omvwfbqm.exe" C:\Windows\SysWOW64\qumxqmz\
  2⤵
  PID:2740
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create qumxqmz binPath= "C:\Windows\SysWOW64\qumxqmz\omvwfbqm.exe /d\"C:\Users\Admin\AppData\Local\Temp\4e7e10a9215ce25b621b2e7381cea3fc.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:2568
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description qumxqmz "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2028
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start qumxqmz
  2⤵
  - Launches sc.exe
  PID:2392
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:2668

C:\Windows\SysWOW64\qumxqmz\omvwfbqm.exe
C:\Windows\SysWOW64\qumxqmz\omvwfbqm.exe /d"C:\Users\Admin\AppData\Local\Temp\4e7e10a9215ce25b621b2e7381cea3fc.exe"
1⤵
PID:2932
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\omvwfbqm.exe

Filesize
894KB

MD5
696e383bd46ed8ca5991c6f4cf3371f4

SHA1
c5b4e129fe9793e0fde0db92a9a79509ab83181e

SHA256
98a90fd4616aa5c13d43ae5e4087a18ea45b3ee8e26d7abf7eb332801306dbb4

SHA512
e7ffc9b4e54ab4c114258233daaa99edc50b77caefe51ae403b8c6d3377eaae1bc7fddee917d9db05167eea77ef9e0d7da775762f434847744a9ab9428c9644a

Download Submit
memory/108-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/108-14-0x00000000000C0000-0x00000000000D5000-memory.dmp

Filesize
84KB

Download
memory/108-11-0x00000000000C0000-0x00000000000D5000-memory.dmp

Filesize
84KB

Download
memory/2864-1-0x0000000000290000-0x0000000000390000-memory.dmp

Filesize
1024KB

Download
memory/2864-2-0x00000000001B0000-0x00000000001C3000-memory.dmp

Filesize
76KB

Download
memory/2864-4-0x0000000000400000-0x00000000036CD000-memory.dmp

Filesize
50.8MB

Download
memory/2864-7-0x00000000001B0000-0x00000000001C3000-memory.dmp

Filesize
76KB

Download
memory/2864-6-0x0000000000400000-0x00000000036CD000-memory.dmp

Filesize
50.8MB

Download
memory/2932-10-0x0000000000290000-0x0000000000390000-memory.dmp

Filesize
1024KB

Download
memory/2932-17-0x0000000000400000-0x00000000036CD000-memory.dmp

Filesize
50.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads