tofsee | 9590e3335bec08bbe68bd9a93fa6c15afb09fa74ea88921e4065fa45515b7b43

General

Target

74f0a558023ce9f1abd783e5607a855e.exe
Size

12.9MB
MD5

74f0a558023ce9f1abd783e5607a855e
SHA1

4a7bf8f987afa17c687723e2e644202ee5dc8733
SHA256

9590e3335bec08bbe68bd9a93fa6c15afb09fa74ea88921e4065fa45515b7b43
SHA512

235a016a678077987941cab392cfd1ec0cac76c7eae5ce20d4eff7d1b197901b306a9cc112624bacd94ffffcf87333018e02eb132d0a45a77c3c1dfa200254c2
SSDEEP

49152:bckGb2222222222222222222222222222222222222222222222222222222222H:bck

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\mgbmzqng = "0"	svchost.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

2548 netsh.exe

pid	process
2548	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\mgbmzqng\ImagePath = "C:\\Windows\\SysWOW64\\mgbmzqng\\jrgkxvee.exe"	svchost.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

2724 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

jrgkxvee.exe

pid process

2560 jrgkxvee.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

jrgkxvee.exe

description pid process target process

PID 2560 set thread context of 2724 2560 jrgkxvee.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

2792 sc.exe
2776 sc.exe
2984 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2724	svchost.exe

pid	process
2560	jrgkxvee.exe

description	pid	process	target process
PID 2560 set thread context of 2724	2560	jrgkxvee.exe	svchost.exe

pid	process
2792	sc.exe
2776	sc.exe
2984	sc.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

74f0a558023ce9f1abd783e5607a855e.exejrgkxvee.exe

description	pid	process	target process
PID 1572 wrote to memory of 2624	1572	74f0a558023ce9f1abd783e5607a855e.exe	cmd.exe
PID 1572 wrote to memory of 2624	1572	74f0a558023ce9f1abd783e5607a855e.exe	cmd.exe
PID 1572 wrote to memory of 2624	1572	74f0a558023ce9f1abd783e5607a855e.exe	cmd.exe
PID 1572 wrote to memory of 2624	1572	74f0a558023ce9f1abd783e5607a855e.exe	cmd.exe
PID 1572 wrote to memory of 2676	1572	74f0a558023ce9f1abd783e5607a855e.exe	cmd.exe
PID 1572 wrote to memory of 2676	1572	74f0a558023ce9f1abd783e5607a855e.exe	cmd.exe
PID 1572 wrote to memory of 2676	1572	74f0a558023ce9f1abd783e5607a855e.exe	cmd.exe
PID 1572 wrote to memory of 2676	1572	74f0a558023ce9f1abd783e5607a855e.exe	cmd.exe
PID 1572 wrote to memory of 2792	1572	74f0a558023ce9f1abd783e5607a855e.exe	sc.exe
PID 1572 wrote to memory of 2792	1572	74f0a558023ce9f1abd783e5607a855e.exe	sc.exe
PID 1572 wrote to memory of 2792	1572	74f0a558023ce9f1abd783e5607a855e.exe	sc.exe
PID 1572 wrote to memory of 2792	1572	74f0a558023ce9f1abd783e5607a855e.exe	sc.exe
PID 1572 wrote to memory of 2776	1572	74f0a558023ce9f1abd783e5607a855e.exe	sc.exe
PID 1572 wrote to memory of 2776	1572	74f0a558023ce9f1abd783e5607a855e.exe	sc.exe
PID 1572 wrote to memory of 2776	1572	74f0a558023ce9f1abd783e5607a855e.exe	sc.exe
PID 1572 wrote to memory of 2776	1572	74f0a558023ce9f1abd783e5607a855e.exe	sc.exe
PID 1572 wrote to memory of 2984	1572	74f0a558023ce9f1abd783e5607a855e.exe	sc.exe
PID 1572 wrote to memory of 2984	1572	74f0a558023ce9f1abd783e5607a855e.exe	sc.exe
PID 1572 wrote to memory of 2984	1572	74f0a558023ce9f1abd783e5607a855e.exe	sc.exe
PID 1572 wrote to memory of 2984	1572	74f0a558023ce9f1abd783e5607a855e.exe	sc.exe
PID 2560 wrote to memory of 2724	2560	jrgkxvee.exe	svchost.exe
PID 2560 wrote to memory of 2724	2560	jrgkxvee.exe	svchost.exe
PID 2560 wrote to memory of 2724	2560	jrgkxvee.exe	svchost.exe
PID 2560 wrote to memory of 2724	2560	jrgkxvee.exe	svchost.exe
PID 2560 wrote to memory of 2724	2560	jrgkxvee.exe	svchost.exe
PID 2560 wrote to memory of 2724	2560	jrgkxvee.exe	svchost.exe
PID 1572 wrote to memory of 2548	1572	74f0a558023ce9f1abd783e5607a855e.exe	netsh.exe
PID 1572 wrote to memory of 2548	1572	74f0a558023ce9f1abd783e5607a855e.exe	netsh.exe
PID 1572 wrote to memory of 2548	1572	74f0a558023ce9f1abd783e5607a855e.exe	netsh.exe
PID 1572 wrote to memory of 2548	1572	74f0a558023ce9f1abd783e5607a855e.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\74f0a558023ce9f1abd783e5607a855e.exe
"C:\Users\Admin\AppData\Local\Temp\74f0a558023ce9f1abd783e5607a855e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1572

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\mgbmzqng\
2⤵
PID:2624

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\jrgkxvee.exe" C:\Windows\SysWOW64\mgbmzqng\
2⤵
PID:2676

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create mgbmzqng binPath= "C:\Windows\SysWOW64\mgbmzqng\jrgkxvee.exe /d\"C:\Users\Admin\AppData\Local\Temp\74f0a558023ce9f1abd783e5607a855e.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:2792

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description mgbmzqng "wifi internet conection"
2⤵
- Launches sc.exe
PID:2776

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start mgbmzqng
2⤵
- Launches sc.exe
PID:2984

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:2548

C:\Windows\SysWOW64\mgbmzqng\jrgkxvee.exe
C:\Windows\SysWOW64\mgbmzqng\jrgkxvee.exe /d"C:\Users\Admin\AppData\Local\Temp\74f0a558023ce9f1abd783e5607a855e.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2560

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify System Firewall

1

T1562.004

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\jrgkxvee.exe
Filesize
14.6MB

MD5
a2796a7024c5bad21212278a3e99cb4d

SHA1
75f371a0da99d6d3842c41ce318b2bd08d614515

SHA256
90ffa12326c6f3fcd33b96e89af3d986cfb1e6823f01c3121c66b5a1c81685c5

SHA512
08c9b8c5ba5964fe63d43e5d01fcfdd00eea74e90775fd29c36443f14b03a9d32744c3294fb12cfc9457e9353c9630b64c496eddbc1529b7f8c1ee0e5cbc9e7e

Download Submit
memory/1572-1-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1572-3-0x0000000000020000-0x0000000000033000-memory.dmp

Filesize
76KB

Download
memory/1572-4-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1572-16-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2560-13-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2560-11-0x00000000005B0000-0x00000000006B0000-memory.dmp

Filesize
1024KB

Download
memory/2560-14-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2724-12-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2724-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2724-8-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2724-19-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2724-20-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2724-21-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads