tofsee | 60dd47adecfac5a2efbb3b52ef50b0d8b3418f2aa240bb0318506bcb8bd29ffc

General

Target

4e7e10a9215ce25b621b2e7381cea3fc.exe
Size

12.2MB
MD5

4e7e10a9215ce25b621b2e7381cea3fc
SHA1

c283ae34f3edfc369fa4bdb44866dcb406e627d7
SHA256

60dd47adecfac5a2efbb3b52ef50b0d8b3418f2aa240bb0318506bcb8bd29ffc
SHA512

7e83eb21fc6594e07ea58d649d0e7757a77609443add91fbe9345350cf46bcb8d4f84097d6e17868a3b616455b6d44057c02f0bf32cd56e91a54c64ce0562bb8
SSDEEP

98304:VNWUlllllllllllllllllllllllllllllllllllllllllllllllllllllllllll7:TW

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
1192	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mewsnxjg\ImagePath = "C:\\Windows\\SysWOW64\\mewsnxjg\\iijupqow.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	4e7e10a9215ce25b621b2e7381cea3fc.exe

Deletes itself 1 IoCs

pid	Process
1856	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2560	iijupqow.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2560 set thread context of 1856	2560	iijupqow.exe	109

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1956	sc.exe
2888	sc.exe
4472	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 4928	1532	4e7e10a9215ce25b621b2e7381cea3fc.exe	93
PID 1532 wrote to memory of 4928	1532	4e7e10a9215ce25b621b2e7381cea3fc.exe	93
PID 1532 wrote to memory of 4928	1532	4e7e10a9215ce25b621b2e7381cea3fc.exe	93
PID 1532 wrote to memory of 2672	1532	4e7e10a9215ce25b621b2e7381cea3fc.exe	95
PID 1532 wrote to memory of 2672	1532	4e7e10a9215ce25b621b2e7381cea3fc.exe	95
PID 1532 wrote to memory of 2672	1532	4e7e10a9215ce25b621b2e7381cea3fc.exe	95
PID 1532 wrote to memory of 1956	1532	4e7e10a9215ce25b621b2e7381cea3fc.exe	98
PID 1532 wrote to memory of 1956	1532	4e7e10a9215ce25b621b2e7381cea3fc.exe	98
PID 1532 wrote to memory of 1956	1532	4e7e10a9215ce25b621b2e7381cea3fc.exe	98
PID 1532 wrote to memory of 2888	1532	4e7e10a9215ce25b621b2e7381cea3fc.exe	100
PID 1532 wrote to memory of 2888	1532	4e7e10a9215ce25b621b2e7381cea3fc.exe	100
PID 1532 wrote to memory of 2888	1532	4e7e10a9215ce25b621b2e7381cea3fc.exe	100
PID 1532 wrote to memory of 4472	1532	4e7e10a9215ce25b621b2e7381cea3fc.exe	101
PID 1532 wrote to memory of 4472	1532	4e7e10a9215ce25b621b2e7381cea3fc.exe	101
PID 1532 wrote to memory of 4472	1532	4e7e10a9215ce25b621b2e7381cea3fc.exe	101
PID 1532 wrote to memory of 1192	1532	4e7e10a9215ce25b621b2e7381cea3fc.exe	103
PID 1532 wrote to memory of 1192	1532	4e7e10a9215ce25b621b2e7381cea3fc.exe	103
PID 1532 wrote to memory of 1192	1532	4e7e10a9215ce25b621b2e7381cea3fc.exe	103
PID 2560 wrote to memory of 1856	2560	iijupqow.exe	109
PID 2560 wrote to memory of 1856	2560	iijupqow.exe	109
PID 2560 wrote to memory of 1856	2560	iijupqow.exe	109
PID 2560 wrote to memory of 1856	2560	iijupqow.exe	109
PID 2560 wrote to memory of 1856	2560	iijupqow.exe	109

C:\Users\Admin\AppData\Local\Temp\4e7e10a9215ce25b621b2e7381cea3fc.exe
"C:\Users\Admin\AppData\Local\Temp\4e7e10a9215ce25b621b2e7381cea3fc.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\mewsnxjg\
  2⤵
  PID:4928
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\iijupqow.exe" C:\Windows\SysWOW64\mewsnxjg\
  2⤵
  PID:2672
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create mewsnxjg binPath= "C:\Windows\SysWOW64\mewsnxjg\iijupqow.exe /d\"C:\Users\Admin\AppData\Local\Temp\4e7e10a9215ce25b621b2e7381cea3fc.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:1956
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description mewsnxjg "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2888
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start mewsnxjg
  2⤵
  - Launches sc.exe
  PID:4472
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:1192

C:\Windows\SysWOW64\mewsnxjg\iijupqow.exe
C:\Windows\SysWOW64\mewsnxjg\iijupqow.exe /d"C:\Users\Admin\AppData\Local\Temp\4e7e10a9215ce25b621b2e7381cea3fc.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  PID:1856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\iijupqow.exe

Filesize
499KB

MD5
8f5ec55dac6a976344635f0b5a8d2738

SHA1
24619a710158850eb85f34624fcf5b0cf0f4c5a5

SHA256
9b99ab15da9d086e9710f3609dfbb2739e37d079b8c355b91f7b5ce85782c9eb

SHA512
c12a498f6c5a44d2b6b3a522b59a8b47bc668763cf547dbf01086798a165191f6aeaf1edf8f0664f093800ae9c6f588a5066ba7719a819c3216e56872844c57d

Download Submit
C:\Windows\SysWOW64\mewsnxjg\iijupqow.exe

Filesize
6.3MB

MD5
c0ca1b828afe184d648b685f034bac53

SHA1
19b94c7a79e86b106fd71d24426178cf1dc5e0c3

SHA256
82bc288310ce9e6cd4301bf3086d9935cb6943d09496fb6c081e7a42dd5994b7

SHA512
2fe3d47df456273b73360a08a06e66ca0486f2bacd1c3f9a9661ea1d02bb6b618e454304bd3f79fa5f5bde2fa567f7cddf9b08b8cd85f2e8f2a0057bf2c045d4

Download Submit
memory/1532-11-0x0000000000400000-0x00000000036CD000-memory.dmp

Filesize
50.8MB

Download
memory/1532-4-0x0000000000400000-0x00000000036CD000-memory.dmp

Filesize
50.8MB

Download
memory/1532-6-0x0000000000400000-0x00000000036CD000-memory.dmp

Filesize
50.8MB

Download
memory/1532-7-0x0000000003740000-0x0000000003840000-memory.dmp

Filesize
1024KB

Download
memory/1532-9-0x0000000005410000-0x0000000005423000-memory.dmp

Filesize
76KB

Download
memory/1532-2-0x0000000005410000-0x0000000005423000-memory.dmp

Filesize
76KB

Download
memory/1532-1-0x0000000003740000-0x0000000003840000-memory.dmp

Filesize
1024KB

Download
memory/1856-21-0x0000000000140000-0x0000000000155000-memory.dmp

Filesize
84KB

Download
memory/1856-16-0x0000000000140000-0x0000000000155000-memory.dmp

Filesize
84KB

Download
memory/1856-22-0x0000000000140000-0x0000000000155000-memory.dmp

Filesize
84KB

Download
memory/1856-23-0x0000000000140000-0x0000000000155000-memory.dmp

Filesize
84KB

Download
memory/2560-15-0x0000000000400000-0x00000000036CD000-memory.dmp

Filesize
50.8MB

Download
memory/2560-14-0x00000000039F0000-0x0000000003AF0000-memory.dmp

Filesize
1024KB

Download
memory/2560-18-0x0000000000400000-0x00000000036CD000-memory.dmp

Filesize
50.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads