tofsee | d40f3920eaedc398fc0f26a2c962699770456248f92ee283e93a4a7d66714bc9

Analysis

max time kernel
144s
max time network
117s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/01/2024, 02:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

71346afaab6cddf7dc69b9c35f75b56f.exe
Size

11.3MB
MD5

71346afaab6cddf7dc69b9c35f75b56f
SHA1

f755c5b0307d7a3a6a0a14391de4eb73c270869e
SHA256

d40f3920eaedc398fc0f26a2c962699770456248f92ee283e93a4a7d66714bc9
SHA512

1a5674e015d67c3d8dc3c690fc81c82e60b2bc5cfb78e815ce3219937541ba7c9bcb21eaf7fb08e3994ab98be456acd58a9c646120f6f97d072b734d6e522b0f
SSDEEP

49152:Kj5555555555555555555555555555555555555555555555555555555555555p:

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\ltptaoky = "0"	svchost.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
2708	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ltptaoky\ImagePath = "C:\\Windows\\SysWOW64\\ltptaoky\\huilnnly.exe"	svchost.exe

Deletes itself 1 IoCs

pid	Process
2796	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2924	huilnnly.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2924 set thread context of 2796	2924	huilnnly.exe	39

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2392	sc.exe
2876	sc.exe
2884	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 616	1700	71346afaab6cddf7dc69b9c35f75b56f.exe	28
PID 1700 wrote to memory of 616	1700	71346afaab6cddf7dc69b9c35f75b56f.exe	28
PID 1700 wrote to memory of 616	1700	71346afaab6cddf7dc69b9c35f75b56f.exe	28
PID 1700 wrote to memory of 616	1700	71346afaab6cddf7dc69b9c35f75b56f.exe	28
PID 1700 wrote to memory of 1812	1700	71346afaab6cddf7dc69b9c35f75b56f.exe	30
PID 1700 wrote to memory of 1812	1700	71346afaab6cddf7dc69b9c35f75b56f.exe	30
PID 1700 wrote to memory of 1812	1700	71346afaab6cddf7dc69b9c35f75b56f.exe	30
PID 1700 wrote to memory of 1812	1700	71346afaab6cddf7dc69b9c35f75b56f.exe	30
PID 1700 wrote to memory of 2392	1700	71346afaab6cddf7dc69b9c35f75b56f.exe	33
PID 1700 wrote to memory of 2392	1700	71346afaab6cddf7dc69b9c35f75b56f.exe	33
PID 1700 wrote to memory of 2392	1700	71346afaab6cddf7dc69b9c35f75b56f.exe	33
PID 1700 wrote to memory of 2392	1700	71346afaab6cddf7dc69b9c35f75b56f.exe	33
PID 1700 wrote to memory of 2876	1700	71346afaab6cddf7dc69b9c35f75b56f.exe	35
PID 1700 wrote to memory of 2876	1700	71346afaab6cddf7dc69b9c35f75b56f.exe	35
PID 1700 wrote to memory of 2876	1700	71346afaab6cddf7dc69b9c35f75b56f.exe	35
PID 1700 wrote to memory of 2876	1700	71346afaab6cddf7dc69b9c35f75b56f.exe	35
PID 1700 wrote to memory of 2884	1700	71346afaab6cddf7dc69b9c35f75b56f.exe	36
PID 1700 wrote to memory of 2884	1700	71346afaab6cddf7dc69b9c35f75b56f.exe	36
PID 1700 wrote to memory of 2884	1700	71346afaab6cddf7dc69b9c35f75b56f.exe	36
PID 1700 wrote to memory of 2884	1700	71346afaab6cddf7dc69b9c35f75b56f.exe	36
PID 2924 wrote to memory of 2796	2924	huilnnly.exe	39
PID 2924 wrote to memory of 2796	2924	huilnnly.exe	39
PID 2924 wrote to memory of 2796	2924	huilnnly.exe	39
PID 2924 wrote to memory of 2796	2924	huilnnly.exe	39
PID 2924 wrote to memory of 2796	2924	huilnnly.exe	39
PID 2924 wrote to memory of 2796	2924	huilnnly.exe	39
PID 1700 wrote to memory of 2708	1700	71346afaab6cddf7dc69b9c35f75b56f.exe	41
PID 1700 wrote to memory of 2708	1700	71346afaab6cddf7dc69b9c35f75b56f.exe	41
PID 1700 wrote to memory of 2708	1700	71346afaab6cddf7dc69b9c35f75b56f.exe	41
PID 1700 wrote to memory of 2708	1700	71346afaab6cddf7dc69b9c35f75b56f.exe	41

C:\Users\Admin\AppData\Local\Temp\71346afaab6cddf7dc69b9c35f75b56f.exe
"C:\Users\Admin\AppData\Local\Temp\71346afaab6cddf7dc69b9c35f75b56f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ltptaoky\
  2⤵
  PID:616
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\huilnnly.exe" C:\Windows\SysWOW64\ltptaoky\
  2⤵
  PID:1812
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create ltptaoky binPath= "C:\Windows\SysWOW64\ltptaoky\huilnnly.exe /d\"C:\Users\Admin\AppData\Local\Temp\71346afaab6cddf7dc69b9c35f75b56f.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:2392
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description ltptaoky "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2876
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start ltptaoky
  2⤵
  - Launches sc.exe
  PID:2884
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:2708

C:\Windows\SysWOW64\ltptaoky\huilnnly.exe
C:\Windows\SysWOW64\ltptaoky\huilnnly.exe /d"C:\Users\Admin\AppData\Local\Temp\71346afaab6cddf7dc69b9c35f75b56f.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Windows security bypass
  - Sets service image path in registry
  - Deletes itself
  PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\huilnnly.exe

Filesize
5.6MB

MD5
56c3e091420850b6711c5003297f7637

SHA1
451069fc9280ab629b1f3e7009dff9af3e8fa54c

SHA256
161b26fc3820391ffc8fe0e8b7e20113bbf4c888d22a20f6485ad40f31f6b906

SHA512
2b6372919f0fb71a759ba68ba2b94daffefb59816b60d14645dd81e13d28900b5206aa7378afce420625e278d47658b0aeaafaec34bf216a14b2d9b9702d978a

Download Submit
C:\Windows\SysWOW64\ltptaoky\huilnnly.exe

Filesize
2.3MB

MD5
1c7c5d4c65664514f62bb4a09912c305

SHA1
72782cb7091d64312b483d109bfa4b0b54f26f50

SHA256
5f653e2200b76605172c0482c713fed6bc505f98382f85f6f319f3e3a3069018

SHA512
eae5bfa34383db4e5bb7fe1ed5e71433e15b2aa9c94922c52a593a8ef9787e020ff3160ab3a7e3d9ea0cc0a48f63f455edab8f942ca49780c1521a0acc351cff

Download Submit
memory/1700-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1700-3-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1700-2-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1700-1-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1700-18-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2796-10-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2796-13-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2796-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2796-17-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2796-19-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2796-20-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2796-21-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2924-8-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2924-14-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2924-7-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads