tofsee | ca7daa04cff8ceabef6dfdb5fcc5fefc3fc457f16aa21e50b75d99450f23c53c

Analysis

max time kernel
146s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
15/01/2024, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5c992d65f6bd11e548f836f1121d11dd.exe
Size 12.9MB
Sample240115-kc8wqsdeb9
SHA256 ca7daa04cff8ceabef6dfdb5fcc5fefc3fc457f16aa21e50b75d99450f23c53c
MD5 5c992d65f6bd11e548f836f1121d11dd
SHA1 779c6c0ffcf590ce0c3fabf0cc80c92380d0ca07
SHA512 d4865e63675e5ef4dff8574743d00f61629b61d83d899923747e3d2861a41a4fca659eeff9985dd506f4728bab3ca8f4a8a25f8a48d336d8bb7d805f004bf90b
SSDEEP 49152:dj5555555555555555555555555555555555555555555555555555555555555x:
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

43.231.4.7
lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
2256	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mfzjmsib\ImagePath = "C:\\Windows\\SysWOW64\\mfzjmsib\\ihtpueob.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	5c992d65f6bd11e548f836f1121d11dd.exe

Deletes itself 1 IoCs

pid	Process
692	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
1576	ihtpueob.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1576 set thread context of 692	1576	ihtpueob.exe	104

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
948	sc.exe
1984	sc.exe
1044	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3596 wrote to memory of 4736	3596	5c992d65f6bd11e548f836f1121d11dd.exe	86
PID 3596 wrote to memory of 4736	3596	5c992d65f6bd11e548f836f1121d11dd.exe	86
PID 3596 wrote to memory of 4736	3596	5c992d65f6bd11e548f836f1121d11dd.exe	86
PID 3596 wrote to memory of 2716	3596	5c992d65f6bd11e548f836f1121d11dd.exe	89
PID 3596 wrote to memory of 2716	3596	5c992d65f6bd11e548f836f1121d11dd.exe	89
PID 3596 wrote to memory of 2716	3596	5c992d65f6bd11e548f836f1121d11dd.exe	89
PID 3596 wrote to memory of 1984	3596	5c992d65f6bd11e548f836f1121d11dd.exe	91
PID 3596 wrote to memory of 1984	3596	5c992d65f6bd11e548f836f1121d11dd.exe	91
PID 3596 wrote to memory of 1984	3596	5c992d65f6bd11e548f836f1121d11dd.exe	91
PID 3596 wrote to memory of 1044	3596	5c992d65f6bd11e548f836f1121d11dd.exe	95
PID 3596 wrote to memory of 1044	3596	5c992d65f6bd11e548f836f1121d11dd.exe	95
PID 3596 wrote to memory of 1044	3596	5c992d65f6bd11e548f836f1121d11dd.exe	95
PID 3596 wrote to memory of 948	3596	5c992d65f6bd11e548f836f1121d11dd.exe	97
PID 3596 wrote to memory of 948	3596	5c992d65f6bd11e548f836f1121d11dd.exe	97
PID 3596 wrote to memory of 948	3596	5c992d65f6bd11e548f836f1121d11dd.exe	97
PID 3596 wrote to memory of 2256	3596	5c992d65f6bd11e548f836f1121d11dd.exe	100
PID 3596 wrote to memory of 2256	3596	5c992d65f6bd11e548f836f1121d11dd.exe	100
PID 3596 wrote to memory of 2256	3596	5c992d65f6bd11e548f836f1121d11dd.exe	100
PID 1576 wrote to memory of 692	1576	ihtpueob.exe	104
PID 1576 wrote to memory of 692	1576	ihtpueob.exe	104
PID 1576 wrote to memory of 692	1576	ihtpueob.exe	104
PID 1576 wrote to memory of 692	1576	ihtpueob.exe	104
PID 1576 wrote to memory of 692	1576	ihtpueob.exe	104

C:\Users\Admin\AppData\Local\Temp\5c992d65f6bd11e548f836f1121d11dd.exe
"C:\Users\Admin\AppData\Local\Temp\5c992d65f6bd11e548f836f1121d11dd.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3596
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\mfzjmsib\
  2⤵
  PID:4736
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ihtpueob.exe" C:\Windows\SysWOW64\mfzjmsib\
  2⤵
  PID:2716
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create mfzjmsib binPath= "C:\Windows\SysWOW64\mfzjmsib\ihtpueob.exe /d\"C:\Users\Admin\AppData\Local\Temp\5c992d65f6bd11e548f836f1121d11dd.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:1984
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description mfzjmsib "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:1044
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start mfzjmsib
  2⤵
  - Launches sc.exe
  PID:948
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:2256

C:\Windows\SysWOW64\mfzjmsib\ihtpueob.exe
C:\Windows\SysWOW64\mfzjmsib\ihtpueob.exe /d"C:\Users\Admin\AppData\Local\Temp\5c992d65f6bd11e548f836f1121d11dd.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  PID:692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ihtpueob.exe

Path C:\Users\Admin\AppData\Local\Temp\ihtpueob.exe
Size 14.7MB
SHA256 1484acd3753f7781033748755b41356e64378299e7d995c8b7fd8e49ad8c2d97
MD5 824d7e7887e2c138a6012411555152bf
SHA1 9918adb3704539b6507712eb3d93c918fb640269
SHA512 c0c5e9e9f59c0f75dafc8e847c3343f4d5438c4970d9fd0829a834b2bb5f59da2678156d1aa82545274a6877ed0a74177f4dcf6225108bdf64aee9e8b6f0e7fc
SSDEEP 49152:Hj5555555555555555555555555555555555555555555555555555555555555p:
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/692-11-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/692-18-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/692-17-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/692-16-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/692-15-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/1576-14-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/1576-9-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

Download

memory/1576-8-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/3596-0-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/3596-6-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/3596-1-0x0000000002160000-0x0000000002161000-memory.dmp

Download

memory/3596-3-0x0000000002170000-0x0000000002171000-memory.dmp

Download

memory/3596-2-0x0000000000400000-0x000000000041E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads