tofsee | 3d26d7945dfd585794694aad848b1f47e1cb538a2926f49eb06752de44cba8c0

Analysis

max time kernel
0s
max time network
45s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2024, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
528785c4b432b56e5981a04c02cd9196.exe
Size 324KB
Sample240111-e2fzcseeel
SHA256 3d26d7945dfd585794694aad848b1f47e1cb538a2926f49eb06752de44cba8c0
MD5 528785c4b432b56e5981a04c02cd9196
SHA1 0cd589f194ce10afb22414c0da7c098e02317fca
SHA512 612635fa4b7307e1417070254a0df54b4b8f1775e839a59f30b0a35963c9ffc2b2afbc8d087947e014b10204d61cb68da3fdd9698794f05fc820f61d1d710d1e
SSDEEP 6144:1klWoo9zHeW6bL4G+105jK5Q5eLRriDvIY:jB9zHI0G+1OD5eLRriDvv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

defeatwax.ru
refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
5008	netsh.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4900	sc.exe
5000	sc.exe
3820	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2228	1240	WerFault.exe	14
1176	4884	WerFault.exe	67

C:\Users\Admin\AppData\Local\Temp\528785c4b432b56e5981a04c02cd9196.exe
"C:\Users\Admin\AppData\Local\Temp\528785c4b432b56e5981a04c02cd9196.exe"
1⤵
PID:1240
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\iplevlcc\
  2⤵
  PID:3044
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\zmiygnis.exe" C:\Windows\SysWOW64\iplevlcc\
  2⤵
  PID:1084
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create iplevlcc binPath= "C:\Windows\SysWOW64\iplevlcc\zmiygnis.exe /d\"C:\Users\Admin\AppData\Local\Temp\528785c4b432b56e5981a04c02cd9196.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:4900
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description iplevlcc "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:5000
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start iplevlcc
  2⤵
  - Launches sc.exe
  PID:3820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 780
  2⤵
  - Program crash
  PID:2228
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:5008

C:\Windows\SysWOW64\iplevlcc\zmiygnis.exe
C:\Windows\SysWOW64\iplevlcc\zmiygnis.exe /d"C:\Users\Admin\AppData\Local\Temp\528785c4b432b56e5981a04c02cd9196.exe"
1⤵
PID:4884
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:1244
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 540
  2⤵
  - Program crash
  PID:1176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4884 -ip 4884
1⤵
PID:4128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1240 -ip 1240
1⤵
PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

zmiygnis.exe

Path C:\Users\Admin\AppData\Local\Temp\zmiygnis.exe
Size 22KB
SHA256 cda5e5e9a12df3a705d0a0c8b3dd4dc2eb5da780568b9521bd2db3cffaafde2b
MD5 d65d1b54dabf38ddfb9a78e54c9ab775
SHA1 8c7c9a8a789ff12e6617178c27e841f5cc3d45bf
SHA512 552b0c0d0f07b9ded892a1dc3866905422118e31d8ea3081e0b6712bdd38aa61a3ae90ad33cbee2e1b800e4be72ef86ed5ab005bef1058a9f77bd5fabe813334
SSDEEP 384:+NTd/fUw61hlcoXis+ZRDlHFZrfrz+HVotB25/d0GBYDBvKDAr0KX2:+NTd3Uw8hlB0ZmHVoCBSGBYxKkNG
MD5 SHA1 SHA512 SSDEEP

Submit Download

zmiygnis.exe

Path C:\Windows\SysWOW64\iplevlcc\zmiygnis.exe
Size 30KB
SHA256 8fff80405bd33d590cbffb23ba8156124f836b2a5c448e7d0a25fb84302bf3ac
MD5 6dbbba1cfc3757fe4ae586f4bf8bbb4e
SHA1 b0c8a6fb3348280e96a72dc8512676fa147fb519
SHA512 d63277d1eec6e332251ba6ffdba680b980ead91432d65e7e2ce5de3461a61626889a8160a79486d577beeb1699991af1fcfc72ab055e07fdb724203a1d974b03
SSDEEP 768:+NTd3Uw8hlB0ZmHVoCBSGBYxKkNdtw1ch4:+XklvJLE1t4ch4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1240-2-0x0000000004E60000-0x0000000004E73000-memory.dmp

Download

memory/1240-1-0x00000000034B0000-0x00000000035B0000-memory.dmp

Download

memory/1240-4-0x0000000000400000-0x000000000324C000-memory.dmp

Download

memory/1240-15-0x0000000000400000-0x000000000324C000-memory.dmp

Download

memory/1244-16-0x0000000000E60000-0x0000000000E75000-memory.dmp

Download

memory/1244-8-0x0000000000E60000-0x0000000000E75000-memory.dmp

Download

memory/1244-17-0x0000000000E60000-0x0000000000E75000-memory.dmp

Download

memory/1244-18-0x0000000000E60000-0x0000000000E75000-memory.dmp

Download

memory/1244-19-0x0000000000E60000-0x0000000000E75000-memory.dmp

Download

memory/4884-14-0x0000000000400000-0x000000000324C000-memory.dmp

Download

memory/4884-10-0x00000000032D0000-0x00000000032E3000-memory.dmp

Download

memory/4884-9-0x00000000034F0000-0x00000000035F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads