tofsee | 9a7d1c75db1c6a45407cfee700b515f8866a5d36012915ca4b028c826d3fd1eb

Analysis

max time kernel
145s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18-01-2024 21:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6617e9a8363999e8395893f828eb8ad6.exe
Size

10.8MB
MD5

6617e9a8363999e8395893f828eb8ad6
SHA1

e8b84e24166d6eafa499bbbaabb08a042acc1e6f
SHA256

9a7d1c75db1c6a45407cfee700b515f8866a5d36012915ca4b028c826d3fd1eb
SHA512

ffe17a0c95dac47a10b560a88c6474bd1146d0638b1e43da1e46b36b47cda56103207992169505cb510f8419722062418560f0e01ca93f8e69e5a72dd3a0e89a
SSDEEP

196608:6vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv:

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

defeatwax.ru

refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\ybiryvhu = "0"	svchost.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
3044	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ybiryvhu\ImagePath = "C:\\Windows\\SysWOW64\\ybiryvhu\\dvaahztx.exe"	svchost.exe

Deletes itself 1 IoCs

pid	Process
2688	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2772	dvaahztx.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2772 set thread context of 2688	2772	dvaahztx.exe	41

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2136	sc.exe
2756	sc.exe
2876	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 1284	2372	6617e9a8363999e8395893f828eb8ad6.exe	28
PID 2372 wrote to memory of 1284	2372	6617e9a8363999e8395893f828eb8ad6.exe	28
PID 2372 wrote to memory of 1284	2372	6617e9a8363999e8395893f828eb8ad6.exe	28
PID 2372 wrote to memory of 1284	2372	6617e9a8363999e8395893f828eb8ad6.exe	28
PID 2372 wrote to memory of 2760	2372	6617e9a8363999e8395893f828eb8ad6.exe	30
PID 2372 wrote to memory of 2760	2372	6617e9a8363999e8395893f828eb8ad6.exe	30
PID 2372 wrote to memory of 2760	2372	6617e9a8363999e8395893f828eb8ad6.exe	30
PID 2372 wrote to memory of 2760	2372	6617e9a8363999e8395893f828eb8ad6.exe	30
PID 2372 wrote to memory of 2136	2372	6617e9a8363999e8395893f828eb8ad6.exe	32
PID 2372 wrote to memory of 2136	2372	6617e9a8363999e8395893f828eb8ad6.exe	32
PID 2372 wrote to memory of 2136	2372	6617e9a8363999e8395893f828eb8ad6.exe	32
PID 2372 wrote to memory of 2136	2372	6617e9a8363999e8395893f828eb8ad6.exe	32
PID 2372 wrote to memory of 2756	2372	6617e9a8363999e8395893f828eb8ad6.exe	34
PID 2372 wrote to memory of 2756	2372	6617e9a8363999e8395893f828eb8ad6.exe	34
PID 2372 wrote to memory of 2756	2372	6617e9a8363999e8395893f828eb8ad6.exe	34
PID 2372 wrote to memory of 2756	2372	6617e9a8363999e8395893f828eb8ad6.exe	34
PID 2372 wrote to memory of 2876	2372	6617e9a8363999e8395893f828eb8ad6.exe	37
PID 2372 wrote to memory of 2876	2372	6617e9a8363999e8395893f828eb8ad6.exe	37
PID 2372 wrote to memory of 2876	2372	6617e9a8363999e8395893f828eb8ad6.exe	37
PID 2372 wrote to memory of 2876	2372	6617e9a8363999e8395893f828eb8ad6.exe	37
PID 2372 wrote to memory of 3044	2372	6617e9a8363999e8395893f828eb8ad6.exe	39
PID 2372 wrote to memory of 3044	2372	6617e9a8363999e8395893f828eb8ad6.exe	39
PID 2372 wrote to memory of 3044	2372	6617e9a8363999e8395893f828eb8ad6.exe	39
PID 2372 wrote to memory of 3044	2372	6617e9a8363999e8395893f828eb8ad6.exe	39
PID 2772 wrote to memory of 2688	2772	dvaahztx.exe	41
PID 2772 wrote to memory of 2688	2772	dvaahztx.exe	41
PID 2772 wrote to memory of 2688	2772	dvaahztx.exe	41
PID 2772 wrote to memory of 2688	2772	dvaahztx.exe	41
PID 2772 wrote to memory of 2688	2772	dvaahztx.exe	41
PID 2772 wrote to memory of 2688	2772	dvaahztx.exe	41

C:\Users\Admin\AppData\Local\Temp\6617e9a8363999e8395893f828eb8ad6.exe
"C:\Users\Admin\AppData\Local\Temp\6617e9a8363999e8395893f828eb8ad6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ybiryvhu\
  2⤵
  PID:1284
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\dvaahztx.exe" C:\Windows\SysWOW64\ybiryvhu\
  2⤵
  PID:2760
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create ybiryvhu binPath= "C:\Windows\SysWOW64\ybiryvhu\dvaahztx.exe /d\"C:\Users\Admin\AppData\Local\Temp\6617e9a8363999e8395893f828eb8ad6.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:2136
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description ybiryvhu "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2756
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start ybiryvhu
  2⤵
  - Launches sc.exe
  PID:2876
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:3044

C:\Windows\SysWOW64\ybiryvhu\dvaahztx.exe
C:\Windows\SysWOW64\ybiryvhu\dvaahztx.exe /d"C:\Users\Admin\AppData\Local\Temp\6617e9a8363999e8395893f828eb8ad6.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Windows security bypass
  - Sets service image path in registry
  - Deletes itself
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dvaahztx.exe

Filesize
9.2MB

MD5
d852a3a6d76510f2316ee25257ce4d2c

SHA1
3cb5a3354f167f562bb93d8a7e188056070884a7

SHA256
c4c2e9a63a85270e69b6f55c87ae88d4df121beeaf3a68ee9d856a7c203d6de5

SHA512
bc893a2e8c065d0ff8ac12df9c2d4837d8f4a5fc4ddcc4a068b90a1869c87c167dca414c8dcdc5a184386ab2acc3dc6c7116317a92ea9b7a132aa1334cb446da

Download Submit
C:\Windows\SysWOW64\ybiryvhu\dvaahztx.exe

Filesize
512KB

MD5
c39c388bd4b909e5323590446febc90c

SHA1
dea46a63da30feb1ef3f942785083eb39347e4cb

SHA256
28ef9c763d038dc543acf98682206fccab22f74ff3e3a4b2a1eecd64247796d2

SHA512
c1b184910043b6ecc70c3fd837a37a548584d0ca2b751a5fadc425865346358761da11e88ec507ec386308c90631c1cf02478f17256748c919bf799aec031fc1

Download Submit
memory/2372-1-0x0000000002DE0000-0x0000000002EE0000-memory.dmp

Filesize
1024KB

Download
memory/2372-3-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download
memory/2372-4-0x0000000000400000-0x0000000002C6D000-memory.dmp

Filesize
40.4MB

Download
memory/2372-8-0x0000000000400000-0x0000000002C6D000-memory.dmp

Filesize
40.4MB

Download
memory/2688-13-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2688-9-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2688-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2688-18-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2688-20-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2688-21-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2772-10-0x00000000002B0000-0x00000000003B0000-memory.dmp

Filesize
1024KB

Download
memory/2772-16-0x0000000000400000-0x0000000002C6D000-memory.dmp

Filesize
40.4MB

Download
memory/2772-19-0x0000000000400000-0x0000000002C6D000-memory.dmp

Filesize
40.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads