tofsee | 2c8b3688a091e5e4e73e451122e85f0e552e7721c1963208031a03574bd97429

Analysis

max time kernel
144s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
15/01/2024, 01:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5bbbb8d6a54d686b060d239a323c2127.exe
Size 12.4MB
Sample240115-bgrzcafdc4
SHA256 2c8b3688a091e5e4e73e451122e85f0e552e7721c1963208031a03574bd97429
MD5 5bbbb8d6a54d686b060d239a323c2127
SHA1 8ca22413afbeadfe1a03304441819f002734088c
SHA512 cf1c83e5cee760eb2cf495ba4460ce2b4c2fb451c328652aafbea93e15a208bb30219fcc0992206608e4a35c7eb42ccd138e6c4e965956f9ab2f11b8ad8a27d4
SSDEEP 49152:DHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHn:
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

43.231.4.6
lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
412	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\dqdxzzur\ImagePath = "C:\\Windows\\SysWOW64\\dqdxzzur\\pqwfqmai.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	5bbbb8d6a54d686b060d239a323c2127.exe

Deletes itself 1 IoCs

pid	Process
1228	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
1160	pqwfqmai.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1160 set thread context of 1228	1160	pqwfqmai.exe	113

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1116	sc.exe
2488	sc.exe
4504	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1824	824	WerFault.exe	87
5032	1160	WerFault.exe	104

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 3844	824	5bbbb8d6a54d686b060d239a323c2127.exe	92
PID 824 wrote to memory of 3844	824	5bbbb8d6a54d686b060d239a323c2127.exe	92
PID 824 wrote to memory of 3844	824	5bbbb8d6a54d686b060d239a323c2127.exe	92
PID 824 wrote to memory of 4656	824	5bbbb8d6a54d686b060d239a323c2127.exe	95
PID 824 wrote to memory of 4656	824	5bbbb8d6a54d686b060d239a323c2127.exe	95
PID 824 wrote to memory of 4656	824	5bbbb8d6a54d686b060d239a323c2127.exe	95
PID 824 wrote to memory of 1116	824	5bbbb8d6a54d686b060d239a323c2127.exe	98
PID 824 wrote to memory of 1116	824	5bbbb8d6a54d686b060d239a323c2127.exe	98
PID 824 wrote to memory of 1116	824	5bbbb8d6a54d686b060d239a323c2127.exe	98
PID 824 wrote to memory of 2488	824	5bbbb8d6a54d686b060d239a323c2127.exe	100
PID 824 wrote to memory of 2488	824	5bbbb8d6a54d686b060d239a323c2127.exe	100
PID 824 wrote to memory of 2488	824	5bbbb8d6a54d686b060d239a323c2127.exe	100
PID 824 wrote to memory of 4504	824	5bbbb8d6a54d686b060d239a323c2127.exe	102
PID 824 wrote to memory of 4504	824	5bbbb8d6a54d686b060d239a323c2127.exe	102
PID 824 wrote to memory of 4504	824	5bbbb8d6a54d686b060d239a323c2127.exe	102
PID 824 wrote to memory of 412	824	5bbbb8d6a54d686b060d239a323c2127.exe	105
PID 824 wrote to memory of 412	824	5bbbb8d6a54d686b060d239a323c2127.exe	105
PID 824 wrote to memory of 412	824	5bbbb8d6a54d686b060d239a323c2127.exe	105
PID 1160 wrote to memory of 1228	1160	pqwfqmai.exe	113
PID 1160 wrote to memory of 1228	1160	pqwfqmai.exe	113
PID 1160 wrote to memory of 1228	1160	pqwfqmai.exe	113
PID 1160 wrote to memory of 1228	1160	pqwfqmai.exe	113
PID 1160 wrote to memory of 1228	1160	pqwfqmai.exe	113

C:\Users\Admin\AppData\Local\Temp\5bbbb8d6a54d686b060d239a323c2127.exe
"C:\Users\Admin\AppData\Local\Temp\5bbbb8d6a54d686b060d239a323c2127.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:824
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\dqdxzzur\
  2⤵
  PID:3844
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\pqwfqmai.exe" C:\Windows\SysWOW64\dqdxzzur\
  2⤵
  PID:4656
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create dqdxzzur binPath= "C:\Windows\SysWOW64\dqdxzzur\pqwfqmai.exe /d\"C:\Users\Admin\AppData\Local\Temp\5bbbb8d6a54d686b060d239a323c2127.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:1116
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description dqdxzzur "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2488
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start dqdxzzur
  2⤵
  - Launches sc.exe
  PID:4504
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:412
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 824 -s 656
  2⤵
  - Program crash
  PID:1824

C:\Windows\SysWOW64\dqdxzzur\pqwfqmai.exe
C:\Windows\SysWOW64\dqdxzzur\pqwfqmai.exe /d"C:\Users\Admin\AppData\Local\Temp\5bbbb8d6a54d686b060d239a323c2127.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  PID:1228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 556
  2⤵
  - Program crash
  PID:5032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 824 -ip 824
1⤵
PID:3824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1160 -ip 1160
1⤵
PID:3616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pqwfqmai.exe

Path C:\Users\Admin\AppData\Local\Temp\pqwfqmai.exe
Size 5.6MB
SHA256 ff16254e25fbe8cffe6f7c86eae6be0c809925826ca630b9eeabe38c72d82140
MD5 daa1a1e8e0fbc63e7aea7098e6cd928b
SHA1 174257a950af3433a32084431ec4372c6c4fc6ad
SHA512 e654dbe8d6941a5328f5e2bb08307d300ea22b164010b7053d905b588cfbfca3aaeb5da1af8d66bdf6da7d16e21ae7a49d95b1f10ddfef813e526c2e9a85391c
SSDEEP 49152:cHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHn:
MD5 SHA1 SHA512 SSDEEP

Submit Download

pqwfqmai.exe

Path C:\Windows\SysWOW64\dqdxzzur\pqwfqmai.exe
Size 13.2MB
SHA256 b8cb3eff22bb7770d074972926f99dd2ae46172acedb76b29269de108535a069
MD5 6ab118bb6e71e15c4e5e36a2948fadb6
SHA1 d4f727d24a22d32adef9edfbc36816215d2e9be2
SHA512 a940b1b0577d6da6dd21fb9700dedc9d53c206b1d9a010ac359398eca1f2c8ca32f272d61dd8c780490dd70b793883d0921ec628e404b9b306b2891dee11604b
SSDEEP 49152:cHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHn:
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/824-9-0x0000000000D70000-0x0000000000D83000-memory.dmp

Download

memory/824-4-0x0000000000400000-0x0000000000C19000-memory.dmp

Download

memory/824-2-0x0000000000D70000-0x0000000000D83000-memory.dmp

Download

memory/824-7-0x0000000000400000-0x0000000000C19000-memory.dmp

Download

memory/824-1-0x0000000000F00000-0x0000000001000000-memory.dmp

Download

memory/1160-11-0x0000000000F20000-0x0000000001020000-memory.dmp

Download

memory/1160-13-0x0000000000400000-0x0000000000C19000-memory.dmp

Download

memory/1160-17-0x0000000000400000-0x0000000000C19000-memory.dmp

Download

memory/1228-12-0x0000000000190000-0x00000000001A5000-memory.dmp

Download

memory/1228-16-0x0000000000190000-0x00000000001A5000-memory.dmp

Download

memory/1228-18-0x0000000000190000-0x00000000001A5000-memory.dmp

Download

memory/1228-19-0x0000000000190000-0x00000000001A5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads