tofsee | e0e94c3fafd615c50c084cf4d72bb8f98495ad99ec2408289ae47322748120f7

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 18:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f36423b40d7a0bbc75a9d05f0e324e72.exe
Size

13.2MB
MD5

f36423b40d7a0bbc75a9d05f0e324e72
SHA1

31f80e7d1cea645b288db9835c5e52b23fa103b2
SHA256

e0e94c3fafd615c50c084cf4d72bb8f98495ad99ec2408289ae47322748120f7
SHA512

fc6118271567c7697b09d7c0ef7acc50cd1867768fd06302533f96b83009c3f7f566813f20f555d628a9d2fc7c9756ca0115f32d534add97c8c66a03ed48b7a7
SSDEEP

3072:Fdi8DS3tA2awlaR7/NDzFx2l0oHgBpMKwVTORO2j4UCtXGPjsjmw+V0+V0+V0+V+:a8DiApRRDzFxk0oHOpfws6Uprgp

Score

10^/10

tofsee evasion persistence trojan upx

Malware Config

Extracted

Family

tofsee

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\wukeqhnr = "0"	svchost.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
2824	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wukeqhnr\ImagePath = "C:\\Windows\\SysWOW64\\wukeqhnr\\dfagzmw.exe"	svchost.exe

Deletes itself 1 IoCs

pid	Process
2588	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2704	dfagzmw.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000b000000014ab3-4.dat	upx
behavioral1/files/0x000b000000014ab3-7.dat	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2704 set thread context of 2588	2704	dfagzmw.exe	41

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2720	sc.exe
2828	sc.exe
2832	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2368	2092	f36423b40d7a0bbc75a9d05f0e324e72.exe	28
PID 2092 wrote to memory of 2368	2092	f36423b40d7a0bbc75a9d05f0e324e72.exe	28
PID 2092 wrote to memory of 2368	2092	f36423b40d7a0bbc75a9d05f0e324e72.exe	28
PID 2092 wrote to memory of 2368	2092	f36423b40d7a0bbc75a9d05f0e324e72.exe	28
PID 2092 wrote to memory of 2776	2092	f36423b40d7a0bbc75a9d05f0e324e72.exe	30
PID 2092 wrote to memory of 2776	2092	f36423b40d7a0bbc75a9d05f0e324e72.exe	30
PID 2092 wrote to memory of 2776	2092	f36423b40d7a0bbc75a9d05f0e324e72.exe	30
PID 2092 wrote to memory of 2776	2092	f36423b40d7a0bbc75a9d05f0e324e72.exe	30
PID 2092 wrote to memory of 2720	2092	f36423b40d7a0bbc75a9d05f0e324e72.exe	32
PID 2092 wrote to memory of 2720	2092	f36423b40d7a0bbc75a9d05f0e324e72.exe	32
PID 2092 wrote to memory of 2720	2092	f36423b40d7a0bbc75a9d05f0e324e72.exe	32
PID 2092 wrote to memory of 2720	2092	f36423b40d7a0bbc75a9d05f0e324e72.exe	32
PID 2092 wrote to memory of 2828	2092	f36423b40d7a0bbc75a9d05f0e324e72.exe	35
PID 2092 wrote to memory of 2828	2092	f36423b40d7a0bbc75a9d05f0e324e72.exe	35
PID 2092 wrote to memory of 2828	2092	f36423b40d7a0bbc75a9d05f0e324e72.exe	35
PID 2092 wrote to memory of 2828	2092	f36423b40d7a0bbc75a9d05f0e324e72.exe	35
PID 2092 wrote to memory of 2832	2092	f36423b40d7a0bbc75a9d05f0e324e72.exe	36
PID 2092 wrote to memory of 2832	2092	f36423b40d7a0bbc75a9d05f0e324e72.exe	36
PID 2092 wrote to memory of 2832	2092	f36423b40d7a0bbc75a9d05f0e324e72.exe	36
PID 2092 wrote to memory of 2832	2092	f36423b40d7a0bbc75a9d05f0e324e72.exe	36
PID 2092 wrote to memory of 2824	2092	f36423b40d7a0bbc75a9d05f0e324e72.exe	38
PID 2092 wrote to memory of 2824	2092	f36423b40d7a0bbc75a9d05f0e324e72.exe	38
PID 2092 wrote to memory of 2824	2092	f36423b40d7a0bbc75a9d05f0e324e72.exe	38
PID 2092 wrote to memory of 2824	2092	f36423b40d7a0bbc75a9d05f0e324e72.exe	38
PID 2704 wrote to memory of 2588	2704	dfagzmw.exe	41
PID 2704 wrote to memory of 2588	2704	dfagzmw.exe	41
PID 2704 wrote to memory of 2588	2704	dfagzmw.exe	41
PID 2704 wrote to memory of 2588	2704	dfagzmw.exe	41
PID 2704 wrote to memory of 2588	2704	dfagzmw.exe	41
PID 2704 wrote to memory of 2588	2704	dfagzmw.exe	41

C:\Users\Admin\AppData\Local\Temp\f36423b40d7a0bbc75a9d05f0e324e72.exe
"C:\Users\Admin\AppData\Local\Temp\f36423b40d7a0bbc75a9d05f0e324e72.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\wukeqhnr\
  2⤵
  PID:2368
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\dfagzmw.exe" C:\Windows\SysWOW64\wukeqhnr\
  2⤵
  PID:2776
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create wukeqhnr binPath= "C:\Windows\SysWOW64\wukeqhnr\dfagzmw.exe /d\"C:\Users\Admin\AppData\Local\Temp\f36423b40d7a0bbc75a9d05f0e324e72.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:2720
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description wukeqhnr "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2828
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start wukeqhnr
  2⤵
  - Launches sc.exe
  PID:2832
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:2824

C:\Windows\SysWOW64\wukeqhnr\dfagzmw.exe
C:\Windows\SysWOW64\wukeqhnr\dfagzmw.exe /d"C:\Users\Admin\AppData\Local\Temp\f36423b40d7a0bbc75a9d05f0e324e72.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Windows security bypass
  - Sets service image path in registry
  - Deletes itself
  PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dfagzmw.exe

Filesize
5.5MB

MD5
46fee72523e06aae6287c74d7771b0c6

SHA1
d44d62c41388a538fe266929096b79a06fb50893

SHA256
13b3de73ac190f6a729b39ee0c2c903871472228a8204f544195723c1efd172f

SHA512
fe2f6faad57dbdc1c96e957f3c8bb2b6861f7179bb85b5748184548b22cc5cecc39f07f3c4c087268445dfb22b01485db8c46040746190431b28b80a6b21cbf0

Download Submit
C:\Windows\SysWOW64\wukeqhnr\dfagzmw.exe

Filesize
216KB

MD5
5b6e28ca78c5c1b41dbdacdb83fdae48

SHA1
4c5cb22b90ae9f80541eeff7d9aac030d5e8502a

SHA256
26d49bf52baabffec54cf92e7686c1fdc15a2d0093f47eb55ee8979007efdb59

SHA512
0f754efeda786fd012cff9a6dc06ba1f293d587c5d3c5c5846e84f5f91b11675759b234b6a073a34bf92d338c492c0223ebb037dff420d5c28e8fcb8e8b1d278

Download Submit
memory/2092-1-0x0000000005250000-0x0000000005350000-memory.dmp

Filesize
1024KB

Download
memory/2092-2-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download
memory/2092-5-0x0000000000400000-0x0000000005169000-memory.dmp

Filesize
77.4MB

Download
memory/2092-6-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download
memory/2588-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2588-13-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2588-10-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2588-18-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2588-19-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2588-20-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2704-9-0x00000000002B0000-0x00000000003B0000-memory.dmp

Filesize
1024KB

Download
memory/2704-16-0x0000000000400000-0x0000000005169000-memory.dmp

Filesize
77.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads