tofsee | ec6cb6839b9f41de8bf5c13b3fc33f2dbe6aff2f3aeaf15710e6103178163626

Analysis

max time kernel
146s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
23/01/2024, 21:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

709aeebaf05fbde308ee29dfeade658b.exe
Size

11.9MB
MD5

709aeebaf05fbde308ee29dfeade658b
SHA1

cf5f760457ab894dfefc9adbe2dd4d0888f5e1e1
SHA256

ec6cb6839b9f41de8bf5c13b3fc33f2dbe6aff2f3aeaf15710e6103178163626
SHA512

315066aec9d179cc9eb46da5e26dbca82289b9457d9ee0b5c37c93516e12443c94c9da7550a2e104d497544b511c02ed40718b8d7aead9f055b744d6f8c20fe7
SSDEEP

24576:DCKmbpaVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVt:xI

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\gyilwagc = "0"	svchost.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
2564	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\gyilwagc\ImagePath = "C:\\Windows\\SysWOW64\\gyilwagc\\hqkphgbx.exe"	svchost.exe

Deletes itself 1 IoCs

pid	Process
2536	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
3012	hqkphgbx.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3012 set thread context of 2536	3012	hqkphgbx.exe	41

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2760	sc.exe
2696	sc.exe
2656	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 3020	2460	709aeebaf05fbde308ee29dfeade658b.exe	29
PID 2460 wrote to memory of 3020	2460	709aeebaf05fbde308ee29dfeade658b.exe	29
PID 2460 wrote to memory of 3020	2460	709aeebaf05fbde308ee29dfeade658b.exe	29
PID 2460 wrote to memory of 3020	2460	709aeebaf05fbde308ee29dfeade658b.exe	29
PID 2460 wrote to memory of 2392	2460	709aeebaf05fbde308ee29dfeade658b.exe	30
PID 2460 wrote to memory of 2392	2460	709aeebaf05fbde308ee29dfeade658b.exe	30
PID 2460 wrote to memory of 2392	2460	709aeebaf05fbde308ee29dfeade658b.exe	30
PID 2460 wrote to memory of 2392	2460	709aeebaf05fbde308ee29dfeade658b.exe	30
PID 2460 wrote to memory of 2760	2460	709aeebaf05fbde308ee29dfeade658b.exe	33
PID 2460 wrote to memory of 2760	2460	709aeebaf05fbde308ee29dfeade658b.exe	33
PID 2460 wrote to memory of 2760	2460	709aeebaf05fbde308ee29dfeade658b.exe	33
PID 2460 wrote to memory of 2760	2460	709aeebaf05fbde308ee29dfeade658b.exe	33
PID 2460 wrote to memory of 2696	2460	709aeebaf05fbde308ee29dfeade658b.exe	35
PID 2460 wrote to memory of 2696	2460	709aeebaf05fbde308ee29dfeade658b.exe	35
PID 2460 wrote to memory of 2696	2460	709aeebaf05fbde308ee29dfeade658b.exe	35
PID 2460 wrote to memory of 2696	2460	709aeebaf05fbde308ee29dfeade658b.exe	35
PID 2460 wrote to memory of 2656	2460	709aeebaf05fbde308ee29dfeade658b.exe	36
PID 2460 wrote to memory of 2656	2460	709aeebaf05fbde308ee29dfeade658b.exe	36
PID 2460 wrote to memory of 2656	2460	709aeebaf05fbde308ee29dfeade658b.exe	36
PID 2460 wrote to memory of 2656	2460	709aeebaf05fbde308ee29dfeade658b.exe	36
PID 2460 wrote to memory of 2564	2460	709aeebaf05fbde308ee29dfeade658b.exe	40
PID 2460 wrote to memory of 2564	2460	709aeebaf05fbde308ee29dfeade658b.exe	40
PID 2460 wrote to memory of 2564	2460	709aeebaf05fbde308ee29dfeade658b.exe	40
PID 2460 wrote to memory of 2564	2460	709aeebaf05fbde308ee29dfeade658b.exe	40
PID 3012 wrote to memory of 2536	3012	hqkphgbx.exe	41
PID 3012 wrote to memory of 2536	3012	hqkphgbx.exe	41
PID 3012 wrote to memory of 2536	3012	hqkphgbx.exe	41
PID 3012 wrote to memory of 2536	3012	hqkphgbx.exe	41
PID 3012 wrote to memory of 2536	3012	hqkphgbx.exe	41
PID 3012 wrote to memory of 2536	3012	hqkphgbx.exe	41

C:\Users\Admin\AppData\Local\Temp\709aeebaf05fbde308ee29dfeade658b.exe
"C:\Users\Admin\AppData\Local\Temp\709aeebaf05fbde308ee29dfeade658b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\gyilwagc\
  2⤵
  PID:3020
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\hqkphgbx.exe" C:\Windows\SysWOW64\gyilwagc\
  2⤵
  PID:2392
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create gyilwagc binPath= "C:\Windows\SysWOW64\gyilwagc\hqkphgbx.exe /d\"C:\Users\Admin\AppData\Local\Temp\709aeebaf05fbde308ee29dfeade658b.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:2760
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description gyilwagc "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2696
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start gyilwagc
  2⤵
  - Launches sc.exe
  PID:2656
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:2564

C:\Windows\SysWOW64\gyilwagc\hqkphgbx.exe
C:\Windows\SysWOW64\gyilwagc\hqkphgbx.exe /d"C:\Users\Admin\AppData\Local\Temp\709aeebaf05fbde308ee29dfeade658b.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Windows security bypass
  - Sets service image path in registry
  - Deletes itself
  PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hqkphgbx.exe

Filesize
3.2MB

MD5
57624614958bcf2f361d3364be42a2ab

SHA1
1d7467657ac33c43fd6eebfadf8ea1f52ac6e1e1

SHA256
4ce9fda5e2885a3189111fe0abfbec442361c21c5155742d0bf9e4438c761c17

SHA512
fdb59895afb7318be4363eafcc7f2af56182606577bfde281f5a63bb5d75e0fbd98e401d8f85be28edc7c0e5c8f2f99f6646313646f494044f1df2e5b301d3b1

Download Submit
C:\Windows\SysWOW64\gyilwagc\hqkphgbx.exe

Filesize
703KB

MD5
9104194a35805a7cde29cd7a2a4300d7

SHA1
1677dc9ac7e8461b00c3cdc3f0ed0ee476107c07

SHA256
22e96a1d1ec3f462be6dd88b4f90a82986d61dd0639dcf495ca87f960c826dc8

SHA512
66ef8e72ddb61326630e327066fd7fb9b941f16785d1a01327b1a131f4cdd57b20c719bd3cfec4e885f9d805dddc5dba6c67548551c456cf243a5871096a3cbc

Download Submit
memory/2460-1-0x00000000037B0000-0x00000000038B0000-memory.dmp

Filesize
1024KB

Download
memory/2460-3-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download
memory/2460-5-0x0000000000400000-0x0000000003629000-memory.dmp

Filesize
50.2MB

Download
memory/2460-6-0x0000000000400000-0x0000000003629000-memory.dmp

Filesize
50.2MB

Download
memory/2460-14-0x00000000037B0000-0x00000000038B0000-memory.dmp

Filesize
1024KB

Download
memory/2536-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2536-10-0x00000000000C0000-0x00000000000D5000-memory.dmp

Filesize
84KB

Download
memory/2536-13-0x00000000000C0000-0x00000000000D5000-memory.dmp

Filesize
84KB

Download
memory/2536-20-0x00000000000C0000-0x00000000000D5000-memory.dmp

Filesize
84KB

Download
memory/2536-18-0x00000000000C0000-0x00000000000D5000-memory.dmp

Filesize
84KB

Download
memory/2536-21-0x00000000000C0000-0x00000000000D5000-memory.dmp

Filesize
84KB

Download
memory/2536-22-0x00000000000C0000-0x00000000000D5000-memory.dmp

Filesize
84KB

Download
memory/3012-9-0x0000000003700000-0x0000000003800000-memory.dmp

Filesize
1024KB

Download
memory/3012-19-0x0000000000400000-0x0000000003629000-memory.dmp

Filesize
50.2MB

Download
memory/3012-17-0x0000000000400000-0x0000000003629000-memory.dmp

Filesize
50.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads