tofsee | de494f831e0bd64f50fc2143048f4f6dd45022dc7af90cf4b24bf403f643d205

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/02/2024, 06:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86243e91464f24b8668659fa90e5b1d8.exe
Size

13.8MB
MD5

86243e91464f24b8668659fa90e5b1d8
SHA1

0445bb92c4d8e636340f6efa2b7fb8ca60f60233
SHA256

de494f831e0bd64f50fc2143048f4f6dd45022dc7af90cf4b24bf403f643d205
SHA512

0b7181d19002a82e708bde60808a14affe39ac312a8339fe47a351ec4d751a18d0bec7d826efe9967dd7b1fd9353907e91f1d7411f5b8fd21904dee8cb5f2e9d
SSDEEP

24576:8lxdvCcpOKCtBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBd:8lzOR

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

defeatwax.ru

refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\xngdxsxt = "0"	svchost.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2944	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\xngdxsxt\ImagePath = "C:\\Windows\\SysWOW64\\xngdxsxt\\xkkihivv.exe"	svchost.exe

Deletes itself 1 IoCs

pid	Process
2552	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2720	xkkihivv.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2720 set thread context of 2552	2720	xkkihivv.exe	41

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2668	sc.exe
2760	sc.exe
2564	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 3068	2208	86243e91464f24b8668659fa90e5b1d8.exe	28
PID 2208 wrote to memory of 3068	2208	86243e91464f24b8668659fa90e5b1d8.exe	28
PID 2208 wrote to memory of 3068	2208	86243e91464f24b8668659fa90e5b1d8.exe	28
PID 2208 wrote to memory of 3068	2208	86243e91464f24b8668659fa90e5b1d8.exe	28
PID 2208 wrote to memory of 2452	2208	86243e91464f24b8668659fa90e5b1d8.exe	30
PID 2208 wrote to memory of 2452	2208	86243e91464f24b8668659fa90e5b1d8.exe	30
PID 2208 wrote to memory of 2452	2208	86243e91464f24b8668659fa90e5b1d8.exe	30
PID 2208 wrote to memory of 2452	2208	86243e91464f24b8668659fa90e5b1d8.exe	30
PID 2208 wrote to memory of 2668	2208	86243e91464f24b8668659fa90e5b1d8.exe	32
PID 2208 wrote to memory of 2668	2208	86243e91464f24b8668659fa90e5b1d8.exe	32
PID 2208 wrote to memory of 2668	2208	86243e91464f24b8668659fa90e5b1d8.exe	32
PID 2208 wrote to memory of 2668	2208	86243e91464f24b8668659fa90e5b1d8.exe	32
PID 2208 wrote to memory of 2760	2208	86243e91464f24b8668659fa90e5b1d8.exe	34
PID 2208 wrote to memory of 2760	2208	86243e91464f24b8668659fa90e5b1d8.exe	34
PID 2208 wrote to memory of 2760	2208	86243e91464f24b8668659fa90e5b1d8.exe	34
PID 2208 wrote to memory of 2760	2208	86243e91464f24b8668659fa90e5b1d8.exe	34
PID 2208 wrote to memory of 2564	2208	86243e91464f24b8668659fa90e5b1d8.exe	36
PID 2208 wrote to memory of 2564	2208	86243e91464f24b8668659fa90e5b1d8.exe	36
PID 2208 wrote to memory of 2564	2208	86243e91464f24b8668659fa90e5b1d8.exe	36
PID 2208 wrote to memory of 2564	2208	86243e91464f24b8668659fa90e5b1d8.exe	36
PID 2208 wrote to memory of 2944	2208	86243e91464f24b8668659fa90e5b1d8.exe	39
PID 2208 wrote to memory of 2944	2208	86243e91464f24b8668659fa90e5b1d8.exe	39
PID 2208 wrote to memory of 2944	2208	86243e91464f24b8668659fa90e5b1d8.exe	39
PID 2208 wrote to memory of 2944	2208	86243e91464f24b8668659fa90e5b1d8.exe	39
PID 2720 wrote to memory of 2552	2720	xkkihivv.exe	41
PID 2720 wrote to memory of 2552	2720	xkkihivv.exe	41
PID 2720 wrote to memory of 2552	2720	xkkihivv.exe	41
PID 2720 wrote to memory of 2552	2720	xkkihivv.exe	41
PID 2720 wrote to memory of 2552	2720	xkkihivv.exe	41
PID 2720 wrote to memory of 2552	2720	xkkihivv.exe	41

C:\Users\Admin\AppData\Local\Temp\86243e91464f24b8668659fa90e5b1d8.exe
"C:\Users\Admin\AppData\Local\Temp\86243e91464f24b8668659fa90e5b1d8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\xngdxsxt\
  2⤵
  PID:3068
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\xkkihivv.exe" C:\Windows\SysWOW64\xngdxsxt\
  2⤵
  PID:2452
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create xngdxsxt binPath= "C:\Windows\SysWOW64\xngdxsxt\xkkihivv.exe /d\"C:\Users\Admin\AppData\Local\Temp\86243e91464f24b8668659fa90e5b1d8.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:2668
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description xngdxsxt "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2760
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start xngdxsxt
  2⤵
  - Launches sc.exe
  PID:2564
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:2944

C:\Windows\SysWOW64\xngdxsxt\xkkihivv.exe
C:\Windows\SysWOW64\xngdxsxt\xkkihivv.exe /d"C:\Users\Admin\AppData\Local\Temp\86243e91464f24b8668659fa90e5b1d8.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Windows security bypass
  - Sets service image path in registry
  - Deletes itself
  PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\xkkihivv.exe

Filesize
13.8MB

MD5
45ea732ab5af4875c15f649831a3a8cb

SHA1
a63873f48be2efcac16b0664156b9d82656fc172

SHA256
2209291dce4d4ae9a0b00aed90b0c879275034ee0478b9926711a102dc305227

SHA512
0f5691bea20a341302f1fc0b840fcb2a1d3211bff6ffb82ad534861030ed8251f81d0fc0e3c437c799adee58e622a9a6b3bc752d47fc397e34f72b25b30079b9

Download Submit
memory/2208-1-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/2208-3-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2208-4-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download
memory/2208-8-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2552-14-0x00000000000D0000-0x00000000000E5000-memory.dmp

Filesize
84KB

Download
memory/2552-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2552-11-0x00000000000D0000-0x00000000000E5000-memory.dmp

Filesize
84KB

Download
memory/2552-18-0x00000000000D0000-0x00000000000E5000-memory.dmp

Filesize
84KB

Download
memory/2552-19-0x00000000000D0000-0x00000000000E5000-memory.dmp

Filesize
84KB

Download
memory/2552-20-0x00000000000D0000-0x00000000000E5000-memory.dmp

Filesize
84KB

Download
memory/2720-10-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2720-9-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/2720-16-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads