tofsee | fff317394bef4b1ab9b56e4800937ba2fae0a86246655b4a965bfc3bb69db40d

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/02/2024, 17:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a9b14697b3b40f1c18fe966196728673.exe
Size 10.9MB
Sample240227-vjkslaee83
SHA256 fff317394bef4b1ab9b56e4800937ba2fae0a86246655b4a965bfc3bb69db40d
MD5 a9b14697b3b40f1c18fe966196728673
SHA1 ecf099f8f08d74e7cf1ef00f05a41a656bb2cfaf
SHA512 0933a354a8532664e8d61b8a8a779b9cb64c25ff686f1be3b0528207cb7df46eb76dafef3bf7801b3a055e0b7ae4aecda7d17704338892cc6758b1ba07b93ee0
SSDEEP 24576:wcmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmf:w
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

defeatwax.ru
refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
316	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\irjhhidy\ImagePath = "C:\\Windows\\SysWOW64\\irjhhidy\\gyhpmzlf.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation	a9b14697b3b40f1c18fe966196728673.exe

Deletes itself 1 IoCs

pid	Process
3372	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
5004	gyhpmzlf.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5004 set thread context of 3372	5004	gyhpmzlf.exe	103

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2560	sc.exe
3620	sc.exe
2536	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4580	1076	WerFault.exe	84
2360	5004	WerFault.exe	98

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 4268	1076	a9b14697b3b40f1c18fe966196728673.exe	86
PID 1076 wrote to memory of 4268	1076	a9b14697b3b40f1c18fe966196728673.exe	86
PID 1076 wrote to memory of 4268	1076	a9b14697b3b40f1c18fe966196728673.exe	86
PID 1076 wrote to memory of 3408	1076	a9b14697b3b40f1c18fe966196728673.exe	89
PID 1076 wrote to memory of 3408	1076	a9b14697b3b40f1c18fe966196728673.exe	89
PID 1076 wrote to memory of 3408	1076	a9b14697b3b40f1c18fe966196728673.exe	89
PID 1076 wrote to memory of 3620	1076	a9b14697b3b40f1c18fe966196728673.exe	91
PID 1076 wrote to memory of 3620	1076	a9b14697b3b40f1c18fe966196728673.exe	91
PID 1076 wrote to memory of 3620	1076	a9b14697b3b40f1c18fe966196728673.exe	91
PID 1076 wrote to memory of 2536	1076	a9b14697b3b40f1c18fe966196728673.exe	93
PID 1076 wrote to memory of 2536	1076	a9b14697b3b40f1c18fe966196728673.exe	93
PID 1076 wrote to memory of 2536	1076	a9b14697b3b40f1c18fe966196728673.exe	93
PID 1076 wrote to memory of 2560	1076	a9b14697b3b40f1c18fe966196728673.exe	96
PID 1076 wrote to memory of 2560	1076	a9b14697b3b40f1c18fe966196728673.exe	96
PID 1076 wrote to memory of 2560	1076	a9b14697b3b40f1c18fe966196728673.exe	96
PID 1076 wrote to memory of 316	1076	a9b14697b3b40f1c18fe966196728673.exe	99
PID 1076 wrote to memory of 316	1076	a9b14697b3b40f1c18fe966196728673.exe	99
PID 1076 wrote to memory of 316	1076	a9b14697b3b40f1c18fe966196728673.exe	99
PID 5004 wrote to memory of 3372	5004	gyhpmzlf.exe	103
PID 5004 wrote to memory of 3372	5004	gyhpmzlf.exe	103
PID 5004 wrote to memory of 3372	5004	gyhpmzlf.exe	103
PID 5004 wrote to memory of 3372	5004	gyhpmzlf.exe	103
PID 5004 wrote to memory of 3372	5004	gyhpmzlf.exe	103

C:\Users\Admin\AppData\Local\Temp\a9b14697b3b40f1c18fe966196728673.exe
"C:\Users\Admin\AppData\Local\Temp\a9b14697b3b40f1c18fe966196728673.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\irjhhidy\
  2⤵
  PID:4268
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\gyhpmzlf.exe" C:\Windows\SysWOW64\irjhhidy\
  2⤵
  PID:3408
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create irjhhidy binPath= "C:\Windows\SysWOW64\irjhhidy\gyhpmzlf.exe /d\"C:\Users\Admin\AppData\Local\Temp\a9b14697b3b40f1c18fe966196728673.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:3620
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description irjhhidy "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2536
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start irjhhidy
  2⤵
  - Launches sc.exe
  PID:2560
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:316
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1076 -s 1036
  2⤵
  - Program crash
  PID:4580

C:\Windows\SysWOW64\irjhhidy\gyhpmzlf.exe
C:\Windows\SysWOW64\irjhhidy\gyhpmzlf.exe /d"C:\Users\Admin\AppData\Local\Temp\a9b14697b3b40f1c18fe966196728673.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  PID:3372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 520
  2⤵
  - Program crash
  PID:2360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1076 -ip 1076
1⤵
PID:4916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5004 -ip 5004
1⤵
PID:3512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gyhpmzlf.exe

Path C:\Users\Admin\AppData\Local\Temp\gyhpmzlf.exe
Size 12.9MB
SHA256 1d0ceeef43fb8b68e86d6f6fddf57b56629f35873f024073bb42730fff658cc9
MD5 b772123450ae8a3924c423df8be7f7d9
SHA1 d35e52be251b8695ebaa8c1f5d387c2f2fce1ce5
SHA512 e63bf7a32dc9ea7eea7900f329b87d8f6153ca405f56dcf92e8cd1c0c53548ffd9a7d698bfd44d6b20bacc3cef0f971c4784b1c9f94213894e0c6fed978965c2
SSDEEP 24576:ncmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmm:nS
MD5 SHA1 SHA512 SSDEEP

Submit Download

gyhpmzlf.exe

Path C:\Windows\SysWOW64\irjhhidy\gyhpmzlf.exe
Size 7.8MB
SHA256 c8465ddc4e46bd1d9afd6617fe96cacee09749425312df3310033e0d1d1c5257
MD5 0c2a28a4038183a428e9733d28425510
SHA1 76a5839ef78426dae1cc64a9817acb0c93112e9e
SHA512 504ecdda0ce1bd5b541a30bce33ea2755c6af7d01788bdb2b66fc995364a7ee07e62317323ebd6ed06c54563d421ec8623c2c4046a2c38281bec2270f7e56a87
SSDEEP 24576:ncmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmxmc:nA
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1076-9-0x0000000002D40000-0x0000000002D53000-memory.dmp

Download

memory/1076-4-0x0000000000400000-0x0000000002C6D000-memory.dmp

Download

memory/1076-2-0x0000000002D40000-0x0000000002D53000-memory.dmp

Download

memory/1076-8-0x0000000000400000-0x0000000002C6D000-memory.dmp

Download

memory/1076-1-0x0000000002D80000-0x0000000002E80000-memory.dmp

Download

memory/3372-11-0x00000000009D0000-0x00000000009E5000-memory.dmp

Download

memory/3372-14-0x00000000009D0000-0x00000000009E5000-memory.dmp

Download

memory/3372-16-0x00000000009D0000-0x00000000009E5000-memory.dmp

Download

memory/3372-18-0x00000000009D0000-0x00000000009E5000-memory.dmp

Download

memory/3372-19-0x00000000009D0000-0x00000000009E5000-memory.dmp

Download

memory/5004-10-0x0000000002F80000-0x0000000003080000-memory.dmp

Download

memory/5004-17-0x0000000000400000-0x0000000002C6D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads