tofsee | 2506360adfcecd45ae92155363fdaadd0d3fa888942cb1a3dc6251c05317726b

Analysis

max time kernel
148s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
15/01/2024, 05:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5c377c45c77ff6a4746edfac21e2c069.exe
Size 11.5MB
Sample240115-ftl13saaam
SHA256 2506360adfcecd45ae92155363fdaadd0d3fa888942cb1a3dc6251c05317726b
MD5 5c377c45c77ff6a4746edfac21e2c069
SHA1 53cdb3538fbd9111031bfa5286fd4908a0b2ba8f
SHA512 7bf7e437b3aa39684723d8f4771c9f35d009925de9575acb449e4d649a949ea46b411b536e3ce6bf75b4e530a6349babbdb30edaf87eae4a5ed08b669261a5a5
SSDEEP 49152:/O2iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii6:/O
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

43.231.4.6
lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
744	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ibyayczw\ImagePath = "C:\\Windows\\SysWOW64\\ibyayczw\\cwybutt.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	5c377c45c77ff6a4746edfac21e2c069.exe

Deletes itself 1 IoCs

pid	Process
3728	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
3568	cwybutt.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3568 set thread context of 3728	3568	cwybutt.exe	117

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4844	sc.exe
2720	sc.exe
4464	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
808	3404	WerFault.exe	58
1196	3568	WerFault.exe	109

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 640	3404	5c377c45c77ff6a4746edfac21e2c069.exe	93
PID 3404 wrote to memory of 640	3404	5c377c45c77ff6a4746edfac21e2c069.exe	93
PID 3404 wrote to memory of 640	3404	5c377c45c77ff6a4746edfac21e2c069.exe	93
PID 3404 wrote to memory of 2012	3404	5c377c45c77ff6a4746edfac21e2c069.exe	100
PID 3404 wrote to memory of 2012	3404	5c377c45c77ff6a4746edfac21e2c069.exe	100
PID 3404 wrote to memory of 2012	3404	5c377c45c77ff6a4746edfac21e2c069.exe	100
PID 3404 wrote to memory of 4844	3404	5c377c45c77ff6a4746edfac21e2c069.exe	102
PID 3404 wrote to memory of 4844	3404	5c377c45c77ff6a4746edfac21e2c069.exe	102
PID 3404 wrote to memory of 4844	3404	5c377c45c77ff6a4746edfac21e2c069.exe	102
PID 3404 wrote to memory of 2720	3404	5c377c45c77ff6a4746edfac21e2c069.exe	105
PID 3404 wrote to memory of 2720	3404	5c377c45c77ff6a4746edfac21e2c069.exe	105
PID 3404 wrote to memory of 2720	3404	5c377c45c77ff6a4746edfac21e2c069.exe	105
PID 3404 wrote to memory of 4464	3404	5c377c45c77ff6a4746edfac21e2c069.exe	108
PID 3404 wrote to memory of 4464	3404	5c377c45c77ff6a4746edfac21e2c069.exe	108
PID 3404 wrote to memory of 4464	3404	5c377c45c77ff6a4746edfac21e2c069.exe	108
PID 3404 wrote to memory of 744	3404	5c377c45c77ff6a4746edfac21e2c069.exe	112
PID 3404 wrote to memory of 744	3404	5c377c45c77ff6a4746edfac21e2c069.exe	112
PID 3404 wrote to memory of 744	3404	5c377c45c77ff6a4746edfac21e2c069.exe	112
PID 3568 wrote to memory of 3728	3568	cwybutt.exe	117
PID 3568 wrote to memory of 3728	3568	cwybutt.exe	117
PID 3568 wrote to memory of 3728	3568	cwybutt.exe	117
PID 3568 wrote to memory of 3728	3568	cwybutt.exe	117
PID 3568 wrote to memory of 3728	3568	cwybutt.exe	117

C:\Users\Admin\AppData\Local\Temp\5c377c45c77ff6a4746edfac21e2c069.exe
"C:\Users\Admin\AppData\Local\Temp\5c377c45c77ff6a4746edfac21e2c069.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ibyayczw\
  2⤵
  PID:640
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\cwybutt.exe" C:\Windows\SysWOW64\ibyayczw\
  2⤵
  PID:2012
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create ibyayczw binPath= "C:\Windows\SysWOW64\ibyayczw\cwybutt.exe /d\"C:\Users\Admin\AppData\Local\Temp\5c377c45c77ff6a4746edfac21e2c069.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:4844
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description ibyayczw "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2720
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start ibyayczw
  2⤵
  - Launches sc.exe
  PID:4464
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 1224
  2⤵
  - Program crash
  PID:808

C:\Windows\SysWOW64\ibyayczw\cwybutt.exe
C:\Windows\SysWOW64\ibyayczw\cwybutt.exe /d"C:\Users\Admin\AppData\Local\Temp\5c377c45c77ff6a4746edfac21e2c069.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3568 -s 516
  2⤵
  - Program crash
  PID:1196
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  PID:3728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3404 -ip 3404
1⤵
PID:3204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3568 -ip 3568
1⤵
PID:1540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cwybutt.exe

Path C:\Users\Admin\AppData\Local\Temp\cwybutt.exe
Size 1.4MB
SHA256 c04770ebf530951f6ee0fed3a3579d84c96d7b711eaba832ac716e307ca744d2
MD5 e137abac417d6f61f2dfb89141a53037
SHA1 4e2a7739288f811bd8915c5dd75e85dd2db0b62c
SHA512 9a5679acb5e7de6594329825e09639987f6a319973b58a9f789249b9b840efb6b6e30d6c90e5c5fc567497ff97e80d213d3bb970ca4414413bc95942887f5517
SSDEEP 24576:zXqNccO4niiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiif:uO2iiiiiiiiiiiiiiiiiiiiiiiiiiiiC
MD5 SHA1 SHA512 SSDEEP

Submit Download

cwybutt.exe

Path C:\Windows\SysWOW64\ibyayczw\cwybutt.exe
Size 2.3MB
SHA256 0d68d6339b88f94ec95ff98b2db29f7b31297c7b135889e4df5fa4629691e932
MD5 47c34ef1ad533f2c29f8ebd81bf38ba8
SHA1 02564b9f44322347fcaf9d8edefebd251d127039
SHA512 1fb47be07b0977c4ca3d49375736d2f61269b0b0a5bdf1f6534d327cd0ffaffd9029f5370196a6ab50ed84e1b79f951577376ac9597cc110ba4729e9b36abbe4
SSDEEP 49152:uO2iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiC:uO
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3404-7-0x0000000000400000-0x00000000008E9000-memory.dmp

Download

memory/3404-4-0x0000000000400000-0x00000000008E9000-memory.dmp

Download

memory/3404-2-0x0000000000B90000-0x0000000000BA3000-memory.dmp

Download

memory/3404-8-0x0000000000B90000-0x0000000000BA3000-memory.dmp

Download

memory/3404-1-0x0000000000BE0000-0x0000000000CE0000-memory.dmp

Download

memory/3568-12-0x0000000000990000-0x0000000000A90000-memory.dmp

Download

memory/3568-14-0x0000000000400000-0x00000000008E9000-memory.dmp

Download

memory/3728-10-0x0000000000C00000-0x0000000000C15000-memory.dmp

Download

memory/3728-15-0x0000000000C00000-0x0000000000C15000-memory.dmp

Download

memory/3728-17-0x0000000000C00000-0x0000000000C15000-memory.dmp

Download

memory/3728-16-0x0000000000C00000-0x0000000000C15000-memory.dmp

Download

memory/3728-19-0x0000000000C00000-0x0000000000C15000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads