tofsee | 74868d600acb1c900eb7643f849d64b4e029a0417d091b1833672bbc0eaf49a1

General

Target

6744b518ec9ccb2012bdbf736c7e187a.exe
Size

13.2MB
MD5

6744b518ec9ccb2012bdbf736c7e187a
SHA1

2d1197901aca6e7e331319a57ac3eeaf15245731
SHA256

74868d600acb1c900eb7643f849d64b4e029a0417d091b1833672bbc0eaf49a1
SHA512

d3b84833a751b58d70d3e590df0982c5965d8cfa81bfcce9eeca47dff42355201dc30d396a7ea69ec49823ee874c29ed4bf97a069aeabfe393e45bebc2cd2f77
SSDEEP

49152:NgMtttttttttttttttttttttttttttttttttttttttttttttttttttttttttttt1:N

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
1068	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ycjpqvtx\ImagePath = "C:\\Windows\\SysWOW64\\ycjpqvtx\\owlpcajj.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	6744b518ec9ccb2012bdbf736c7e187a.exe

Deletes itself 1 IoCs

pid	Process
3624	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2008	owlpcajj.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2008 set thread context of 3624	2008	owlpcajj.exe	109

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3264	sc.exe
4032	sc.exe
3784	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4880	364	WerFault.exe	84
1164	2008	WerFault.exe	102

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 2304	364	6744b518ec9ccb2012bdbf736c7e187a.exe	88
PID 364 wrote to memory of 2304	364	6744b518ec9ccb2012bdbf736c7e187a.exe	88
PID 364 wrote to memory of 2304	364	6744b518ec9ccb2012bdbf736c7e187a.exe	88
PID 364 wrote to memory of 2356	364	6744b518ec9ccb2012bdbf736c7e187a.exe	92
PID 364 wrote to memory of 2356	364	6744b518ec9ccb2012bdbf736c7e187a.exe	92
PID 364 wrote to memory of 2356	364	6744b518ec9ccb2012bdbf736c7e187a.exe	92
PID 364 wrote to memory of 3784	364	6744b518ec9ccb2012bdbf736c7e187a.exe	94
PID 364 wrote to memory of 3784	364	6744b518ec9ccb2012bdbf736c7e187a.exe	94
PID 364 wrote to memory of 3784	364	6744b518ec9ccb2012bdbf736c7e187a.exe	94
PID 364 wrote to memory of 3264	364	6744b518ec9ccb2012bdbf736c7e187a.exe	98
PID 364 wrote to memory of 3264	364	6744b518ec9ccb2012bdbf736c7e187a.exe	98
PID 364 wrote to memory of 3264	364	6744b518ec9ccb2012bdbf736c7e187a.exe	98
PID 364 wrote to memory of 4032	364	6744b518ec9ccb2012bdbf736c7e187a.exe	100
PID 364 wrote to memory of 4032	364	6744b518ec9ccb2012bdbf736c7e187a.exe	100
PID 364 wrote to memory of 4032	364	6744b518ec9ccb2012bdbf736c7e187a.exe	100
PID 364 wrote to memory of 1068	364	6744b518ec9ccb2012bdbf736c7e187a.exe	105
PID 364 wrote to memory of 1068	364	6744b518ec9ccb2012bdbf736c7e187a.exe	105
PID 364 wrote to memory of 1068	364	6744b518ec9ccb2012bdbf736c7e187a.exe	105
PID 2008 wrote to memory of 3624	2008	owlpcajj.exe	109
PID 2008 wrote to memory of 3624	2008	owlpcajj.exe	109
PID 2008 wrote to memory of 3624	2008	owlpcajj.exe	109
PID 2008 wrote to memory of 3624	2008	owlpcajj.exe	109
PID 2008 wrote to memory of 3624	2008	owlpcajj.exe	109

C:\Users\Admin\AppData\Local\Temp\6744b518ec9ccb2012bdbf736c7e187a.exe
"C:\Users\Admin\AppData\Local\Temp\6744b518ec9ccb2012bdbf736c7e187a.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:364
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ycjpqvtx\
  2⤵
  PID:2304
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\owlpcajj.exe" C:\Windows\SysWOW64\ycjpqvtx\
  2⤵
  PID:2356
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create ycjpqvtx binPath= "C:\Windows\SysWOW64\ycjpqvtx\owlpcajj.exe /d\"C:\Users\Admin\AppData\Local\Temp\6744b518ec9ccb2012bdbf736c7e187a.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:3784
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description ycjpqvtx "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:3264
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start ycjpqvtx
  2⤵
  - Launches sc.exe
  PID:4032
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:1068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 364 -s 656
  2⤵
  - Program crash
  PID:4880

C:\Windows\SysWOW64\ycjpqvtx\owlpcajj.exe
C:\Windows\SysWOW64\ycjpqvtx\owlpcajj.exe /d"C:\Users\Admin\AppData\Local\Temp\6744b518ec9ccb2012bdbf736c7e187a.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  PID:3624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 520
  2⤵
  - Program crash
  PID:1164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 364 -ip 364
1⤵
PID:3984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2008 -ip 2008
1⤵
PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\owlpcajj.exe

Filesize
13.0MB

MD5
eeecca62f22f035068f29dfa7e2ba566

SHA1
34d1385237ca686f13b1379457ab3c53c2f57fcc

SHA256
15fed14ae0846bbf4b902f3128e694a71c580e3bdfdea2b94f99b659158ec91d

SHA512
60c506e34dfd494dcc7fce75997141d727a1019414485a673aed542ac5d21d5ed721096dd37838910d8584ac6f2759bc41d6a6721dc2dc50eefd69c626f8a900

Download Submit
C:\Windows\SysWOW64\ycjpqvtx\owlpcajj.exe

Filesize
3.2MB

MD5
b75573fe06c7315fd169a529c9bdf207

SHA1
3b04aa32ab6c2dcfa7215c76dd124f856e6ac6d7

SHA256
519a4f613d52ed889d93ed564d3a9a00f22f5b3a91a2b6546cad854527fa4314

SHA512
1fd87c18a0124d714bf673cbb26cebab1d76084c1c6ff0cf28c8b181a15c3140e70aff834e5a179ec674d007b0b118afc7f63952913c92e258fae453e2e1d40b

Download Submit
memory/364-8-0x0000000000710000-0x0000000000723000-memory.dmp

Filesize
76KB

Download
memory/364-3-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/364-2-0x0000000000710000-0x0000000000723000-memory.dmp

Filesize
76KB

Download
memory/364-7-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/364-1-0x0000000000770000-0x0000000000870000-memory.dmp

Filesize
1024KB

Download
memory/2008-10-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/2008-12-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2008-17-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/3624-11-0x0000000000740000-0x0000000000755000-memory.dmp

Filesize
84KB

Download
memory/3624-16-0x0000000000740000-0x0000000000755000-memory.dmp

Filesize
84KB

Download
memory/3624-18-0x0000000000740000-0x0000000000755000-memory.dmp

Filesize
84KB

Download
memory/3624-19-0x0000000000740000-0x0000000000755000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads