Analysis

  • max time kernel
    147s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/01/2024, 22:06

General

  • Target

    7e201f6d24fb8268d2e4ba7d0e2b3e67.exe

  • Size

    11.7MB

  • MD5

    7e201f6d24fb8268d2e4ba7d0e2b3e67

  • SHA1

    e443a234b26eac5eb753af89b35898799801c717

  • SHA256

    cb69feca957e765d0dd33ba69c7e17266641ead5805fb04f6d84232b6b796bf9

  • SHA512

    e1d1e191cd7fe8a02c2df7c68763f6245a8126eae1814522eac220834cec4230a76af476cb3cba5e8f0c89c4bab97309a00fe6eb02e3f0f269bdf211d89e28ae

  • SSDEEP

    3072:uBNmFjaoPAa5LqiM8h2pj3gKTf8dl4ghaF5+P9H:CwjaoB5LqiLh+j3gMfTCBl

Malware Config

Extracted

Family

tofsee

C2

176.111.174.19

defeatwax.ru

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Creates new service(s) 1 TTPs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7e201f6d24fb8268d2e4ba7d0e2b3e67.exe
    "C:\Users\Admin\AppData\Local\Temp\7e201f6d24fb8268d2e4ba7d0e2b3e67.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1368
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\kadyeeiz\
      2⤵
        PID:1224
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\gsebkir.exe" C:\Windows\SysWOW64\kadyeeiz\
        2⤵
          PID:4864
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create kadyeeiz binPath= "C:\Windows\SysWOW64\kadyeeiz\gsebkir.exe /d\"C:\Users\Admin\AppData\Local\Temp\7e201f6d24fb8268d2e4ba7d0e2b3e67.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:1316
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description kadyeeiz "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:3096
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start kadyeeiz
          2⤵
          • Launches sc.exe
          PID:1472
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:4764
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 572
          2⤵
          • Program crash
          PID:2056
      • C:\Windows\SysWOW64\kadyeeiz\gsebkir.exe
        C:\Windows\SysWOW64\kadyeeiz\gsebkir.exe /d"C:\Users\Admin\AppData\Local\Temp\7e201f6d24fb8268d2e4ba7d0e2b3e67.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2312
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          2⤵
          • Sets service image path in registry
          • Deletes itself
          PID:3476
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 544
          2⤵
          • Program crash
          PID:3604
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1368 -ip 1368
        1⤵
          PID:1112
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2312 -ip 2312
          1⤵
            PID:4396

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\gsebkir.exe

            Filesize

            14.2MB

            MD5

            cac6acd7087665dd31db9fa8b774a421

            SHA1

            6e2d00928ce094cbac743be930e25c8a6db11f8a

            SHA256

            67d219947afae025cd873229abc0759815fd425ff76148b25f55aa3a32e6cfe7

            SHA512

            4ee826493a13020cede46c394c5c3f10e87337d533b5d82a513576cd52106a734b1eae2787142eec0a9cd3c4c14bfe3d5bb7f8648b58035797b45d85858d2c1c

          • memory/1368-10-0x0000000002EA0000-0x0000000002EB3000-memory.dmp

            Filesize

            76KB

          • memory/1368-2-0x0000000002EA0000-0x0000000002EB3000-memory.dmp

            Filesize

            76KB

          • memory/1368-6-0x0000000000400000-0x0000000002BF4000-memory.dmp

            Filesize

            40.0MB

          • memory/1368-9-0x0000000000400000-0x0000000002BF4000-memory.dmp

            Filesize

            40.0MB

          • memory/1368-1-0x0000000002EF0000-0x0000000002FF0000-memory.dmp

            Filesize

            1024KB

          • memory/1368-4-0x0000000000400000-0x0000000002BF4000-memory.dmp

            Filesize

            40.0MB

          • memory/2312-16-0x0000000000400000-0x0000000002BF4000-memory.dmp

            Filesize

            40.0MB

          • memory/2312-11-0x0000000002E10000-0x0000000002F10000-memory.dmp

            Filesize

            1024KB

          • memory/2312-19-0x0000000000400000-0x0000000002BF4000-memory.dmp

            Filesize

            40.0MB

          • memory/3476-12-0x0000000000CE0000-0x0000000000CF5000-memory.dmp

            Filesize

            84KB

          • memory/3476-18-0x0000000000CE0000-0x0000000000CF5000-memory.dmp

            Filesize

            84KB

          • memory/3476-17-0x0000000000CE0000-0x0000000000CF5000-memory.dmp

            Filesize

            84KB

          • memory/3476-15-0x0000000000CE0000-0x0000000000CF5000-memory.dmp

            Filesize

            84KB

          • memory/3476-20-0x0000000000CE0000-0x0000000000CF5000-memory.dmp

            Filesize

            84KB