tofsee | 97226e55b0b223c1f897564afdb575582da1f493a7e2a44765fd2883c887b25a

Analysis

max time kernel
3s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 19:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5140d127b1646f1e0c743bc089dcdd11.exe
Size 14.7MB
Sample240110-xyg2csecgl
SHA256 97226e55b0b223c1f897564afdb575582da1f493a7e2a44765fd2883c887b25a
MD5 5140d127b1646f1e0c743bc089dcdd11
SHA1 617215fc6f317f28f720ae32890e5655e72c0246
SHA512 027646ca100d40773f29a48a39ba54521d22f850064e66608faabcca1ccfbc894df70cd1bd5cca777229a2628e2f6d5de1e83ec7691b604f2738d53d1a07e3dd
SSDEEP 49152:eBpQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQH:
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

43.231.4.6
lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
1636	netsh.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2204	sc.exe
2604	sc.exe
2716	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2368	2980	5140d127b1646f1e0c743bc089dcdd11.exe	29
PID 2980 wrote to memory of 2368	2980	5140d127b1646f1e0c743bc089dcdd11.exe	29
PID 2980 wrote to memory of 2368	2980	5140d127b1646f1e0c743bc089dcdd11.exe	29
PID 2980 wrote to memory of 2368	2980	5140d127b1646f1e0c743bc089dcdd11.exe	29
PID 2980 wrote to memory of 1552	2980	5140d127b1646f1e0c743bc089dcdd11.exe	31
PID 2980 wrote to memory of 1552	2980	5140d127b1646f1e0c743bc089dcdd11.exe	31
PID 2980 wrote to memory of 1552	2980	5140d127b1646f1e0c743bc089dcdd11.exe	31
PID 2980 wrote to memory of 1552	2980	5140d127b1646f1e0c743bc089dcdd11.exe	31

C:\Users\Admin\AppData\Local\Temp\5140d127b1646f1e0c743bc089dcdd11.exe
"C:\Users\Admin\AppData\Local\Temp\5140d127b1646f1e0c743bc089dcdd11.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\aibcnxup\
  2⤵
  PID:2368
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\wgbwnngm.exe" C:\Windows\SysWOW64\aibcnxup\
  2⤵
  PID:1552
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create aibcnxup binPath= "C:\Windows\SysWOW64\aibcnxup\wgbwnngm.exe /d\"C:\Users\Admin\AppData\Local\Temp\5140d127b1646f1e0c743bc089dcdd11.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:2204
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description aibcnxup "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2604
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start aibcnxup
  2⤵
  - Launches sc.exe
  PID:2716
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:1636

C:\Windows\SysWOW64\aibcnxup\wgbwnngm.exe
C:\Windows\SysWOW64\aibcnxup\wgbwnngm.exe /d"C:\Users\Admin\AppData\Local\Temp\5140d127b1646f1e0c743bc089dcdd11.exe"
1⤵
PID:2868
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wgbwnngm.exe

Path C:\Users\Admin\AppData\Local\Temp\wgbwnngm.exe
Size 112KB
SHA256 3c0543ac0804746f8794e42e5985baf7a255d6c9d24558328aeb610f7d461403
MD5 1a3eedc81fdbbba857d475387df03780
SHA1 f8836c190bf83a71150ebf65345cb9c2f5d53e9e
SHA512 aadf15c01d2844c40e539e95b09bc41fb8da30b468fa3d8092baac25a7672d4688d786881748790a0089e672ac6e9f3c1df121b8943bc26db1adf7c7bacfa33c
SSDEEP 1536:TA6d8wFMpZTZmQmZk6f3K1oA6zFRYTgFCrTOsp1N9j5FGMfK+b0+s3A:TAI81zTZgfa1oXRc0Cfp1N9aMi+IX3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

wgbwnngm.exe

Path C:\Windows\SysWOW64\aibcnxup\wgbwnngm.exe
Size 151KB
SHA256 8e4a25783539f32ad775d0d833e0cb639a03e5f649772fdee766ccab61b8da60
MD5 80276d3c76f4c350332aac4ce81dc235
SHA1 7bb4b829b9bfa9c41bffc3a9806948101fa156b9
SHA512 71b79f4b33d8f31237bcf2b5cb9466d797f397da977be0820ed2dc98807ceef770c3da06bd051de2f3fd67855e42bf019fb9fb27bb7a8b0b851192e50306cf64
SSDEEP 3072:TAI81zTZgfa1oXRc0Cfp1N9aMi+IX3lesgkuO6GUAC:EII6S1oXRcjPN9aHX3bRflO
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2628-10-0x0000000000080000-0x0000000000095000-memory.dmp

Download

memory/2628-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2628-13-0x0000000000080000-0x0000000000095000-memory.dmp

Download

memory/2628-19-0x0000000000080000-0x0000000000095000-memory.dmp

Download

memory/2628-20-0x0000000000080000-0x0000000000095000-memory.dmp

Download

memory/2628-21-0x0000000000080000-0x0000000000095000-memory.dmp

Download

memory/2868-9-0x00000000032C0000-0x00000000033C0000-memory.dmp

Download

memory/2868-15-0x0000000000400000-0x000000000323B000-memory.dmp

Download

memory/2868-17-0x0000000000400000-0x000000000323B000-memory.dmp

Download

memory/2980-1-0x00000000032D0000-0x00000000033D0000-memory.dmp

Download

memory/2980-4-0x0000000000400000-0x000000000323B000-memory.dmp

Download

memory/2980-7-0x0000000000400000-0x000000000323B000-memory.dmp

Download

memory/2980-3-0x0000000000220000-0x0000000000233000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads