tofsee | c3639689bd22abc6ad8605e9ed27aa0192f4790ab8de15520a69e7cf7f745fc7

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/02/2024, 18:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9d9bb6cc7e182958073cd1a65e73530.exe
Size

15.0MB
MD5

a9d9bb6cc7e182958073cd1a65e73530
SHA1

8782e15e4ef851b36f6697604c2425f216cd3071
SHA256

c3639689bd22abc6ad8605e9ed27aa0192f4790ab8de15520a69e7cf7f745fc7
SHA512

cc49fe964c43937e0e041748f273b77a3c7cf333d6609b5a8877590b6573867244077482793b5665d703e7108398e6219c175d7a5f12fadf83da2ab19d3ece16
SSDEEP

6144:vHCbMTTkphQW/uoIuOB9u9dwEImeaDdYft:abMnkpKW8uko9Cm2f

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

defeatwax.ru

refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\dgwrcptt = "0"	svchost.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2528	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\dgwrcptt\ImagePath = "C:\\Windows\\SysWOW64\\dgwrcptt\\rmwznyyg.exe"	svchost.exe

Deletes itself 1 IoCs

pid	Process
2508	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2988	rmwznyyg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2988 set thread context of 2508	2988	rmwznyyg.exe	41

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1388	sc.exe
2940	sc.exe
2896	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 2304	1412	a9d9bb6cc7e182958073cd1a65e73530.exe	28
PID 1412 wrote to memory of 2304	1412	a9d9bb6cc7e182958073cd1a65e73530.exe	28
PID 1412 wrote to memory of 2304	1412	a9d9bb6cc7e182958073cd1a65e73530.exe	28
PID 1412 wrote to memory of 2304	1412	a9d9bb6cc7e182958073cd1a65e73530.exe	28
PID 1412 wrote to memory of 2824	1412	a9d9bb6cc7e182958073cd1a65e73530.exe	30
PID 1412 wrote to memory of 2824	1412	a9d9bb6cc7e182958073cd1a65e73530.exe	30
PID 1412 wrote to memory of 2824	1412	a9d9bb6cc7e182958073cd1a65e73530.exe	30
PID 1412 wrote to memory of 2824	1412	a9d9bb6cc7e182958073cd1a65e73530.exe	30
PID 1412 wrote to memory of 1388	1412	a9d9bb6cc7e182958073cd1a65e73530.exe	32
PID 1412 wrote to memory of 1388	1412	a9d9bb6cc7e182958073cd1a65e73530.exe	32
PID 1412 wrote to memory of 1388	1412	a9d9bb6cc7e182958073cd1a65e73530.exe	32
PID 1412 wrote to memory of 1388	1412	a9d9bb6cc7e182958073cd1a65e73530.exe	32
PID 1412 wrote to memory of 2940	1412	a9d9bb6cc7e182958073cd1a65e73530.exe	34
PID 1412 wrote to memory of 2940	1412	a9d9bb6cc7e182958073cd1a65e73530.exe	34
PID 1412 wrote to memory of 2940	1412	a9d9bb6cc7e182958073cd1a65e73530.exe	34
PID 1412 wrote to memory of 2940	1412	a9d9bb6cc7e182958073cd1a65e73530.exe	34
PID 1412 wrote to memory of 2896	1412	a9d9bb6cc7e182958073cd1a65e73530.exe	36
PID 1412 wrote to memory of 2896	1412	a9d9bb6cc7e182958073cd1a65e73530.exe	36
PID 1412 wrote to memory of 2896	1412	a9d9bb6cc7e182958073cd1a65e73530.exe	36
PID 1412 wrote to memory of 2896	1412	a9d9bb6cc7e182958073cd1a65e73530.exe	36
PID 1412 wrote to memory of 2528	1412	a9d9bb6cc7e182958073cd1a65e73530.exe	39
PID 1412 wrote to memory of 2528	1412	a9d9bb6cc7e182958073cd1a65e73530.exe	39
PID 1412 wrote to memory of 2528	1412	a9d9bb6cc7e182958073cd1a65e73530.exe	39
PID 1412 wrote to memory of 2528	1412	a9d9bb6cc7e182958073cd1a65e73530.exe	39
PID 2988 wrote to memory of 2508	2988	rmwznyyg.exe	41
PID 2988 wrote to memory of 2508	2988	rmwznyyg.exe	41
PID 2988 wrote to memory of 2508	2988	rmwznyyg.exe	41
PID 2988 wrote to memory of 2508	2988	rmwznyyg.exe	41
PID 2988 wrote to memory of 2508	2988	rmwznyyg.exe	41
PID 2988 wrote to memory of 2508	2988	rmwznyyg.exe	41

C:\Users\Admin\AppData\Local\Temp\a9d9bb6cc7e182958073cd1a65e73530.exe
"C:\Users\Admin\AppData\Local\Temp\a9d9bb6cc7e182958073cd1a65e73530.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\dgwrcptt\
  2⤵
  PID:2304
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\rmwznyyg.exe" C:\Windows\SysWOW64\dgwrcptt\
  2⤵
  PID:2824
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create dgwrcptt binPath= "C:\Windows\SysWOW64\dgwrcptt\rmwznyyg.exe /d\"C:\Users\Admin\AppData\Local\Temp\a9d9bb6cc7e182958073cd1a65e73530.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:1388
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description dgwrcptt "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2940
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start dgwrcptt
  2⤵
  - Launches sc.exe
  PID:2896
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:2528

C:\Windows\SysWOW64\dgwrcptt\rmwznyyg.exe
C:\Windows\SysWOW64\dgwrcptt\rmwznyyg.exe /d"C:\Users\Admin\AppData\Local\Temp\a9d9bb6cc7e182958073cd1a65e73530.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Windows security bypass
  - Sets service image path in registry
  - Deletes itself
  PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rmwznyyg.exe

Filesize
5.6MB

MD5
312ec5e6b2ef47744ef990c9077ebefe

SHA1
8bb269cbe3595614d3738ec7efc44b08feab7635

SHA256
55da18c46c704650a5be98fdbb8ad073a4cfcf630c87cd40b606e29c270bc0b6

SHA512
de53539efa40d5ffc1ebfc9a78388f2224ae6f7dd0c76178ca1f13e843711427801dbaa409bce994c2a8d9a7c8e001e7fc31b1c3c4e70f9c5d2e2b9fd2a6896f

Download Submit
C:\Windows\SysWOW64\dgwrcptt\rmwznyyg.exe

Filesize
723KB

MD5
586dffb63304be5be15a6d3ba027ee42

SHA1
010972a40f869c7cfe9aab825874654df62e0055

SHA256
89e6a03cf1afc953cf0425422ef1a7b1d00dd8cf71f28a60de1a68585bb11a31

SHA512
7816bdcda2bbc8ba68697dddb365f4347cc8b9619d0dbe1d57961da5081b3114df81517c0988c070924e509fc71371757ef65e41ee7317b30f7100287e8c0199

Download Submit
memory/1412-1-0x0000000000630000-0x0000000000730000-memory.dmp

Filesize
1024KB

Download
memory/1412-3-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1412-4-0x0000000000230000-0x0000000000243000-memory.dmp

Filesize
76KB

Download
memory/1412-8-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2508-11-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2508-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2508-14-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2508-19-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2508-20-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2508-21-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2988-10-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2988-9-0x00000000002B0000-0x00000000003B0000-memory.dmp

Filesize
1024KB

Download
memory/2988-15-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads