tofsee | 5af0aac227cd17b019af639e20df262c7ff0d3f561a6f6fef8a8c45809bc1392

General

Target

a9feacf3b92c06c15f8c2181b6893135.exe
Size

11.6MB
MD5

a9feacf3b92c06c15f8c2181b6893135
SHA1

cae7b834ec1293dae4974e7334a518082025208e
SHA256

5af0aac227cd17b019af639e20df262c7ff0d3f561a6f6fef8a8c45809bc1392
SHA512

eab6ab9c2c6675ccc14abba1461822493b1cd3304728023c542e9c1efc50d3381fbd3563d29411edd5267135da678fcbcdb6c96663f6cab47c613ba62854f594
SSDEEP

49152:ij5555555555555555555555555555555555555555555555555555555555555l:

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4240	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\qjjowfgn\ImagePath = "C:\\Windows\\SysWOW64\\qjjowfgn\\wryvurno.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation	a9feacf3b92c06c15f8c2181b6893135.exe

Deletes itself 1 IoCs

pid	Process
2976	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
400	wryvurno.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 400 set thread context of 2976	400	wryvurno.exe	105

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2368	sc.exe
1840	sc.exe
4924	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 1924	4552	a9feacf3b92c06c15f8c2181b6893135.exe	90
PID 4552 wrote to memory of 1924	4552	a9feacf3b92c06c15f8c2181b6893135.exe	90
PID 4552 wrote to memory of 1924	4552	a9feacf3b92c06c15f8c2181b6893135.exe	90
PID 4552 wrote to memory of 4700	4552	a9feacf3b92c06c15f8c2181b6893135.exe	92
PID 4552 wrote to memory of 4700	4552	a9feacf3b92c06c15f8c2181b6893135.exe	92
PID 4552 wrote to memory of 4700	4552	a9feacf3b92c06c15f8c2181b6893135.exe	92
PID 4552 wrote to memory of 2368	4552	a9feacf3b92c06c15f8c2181b6893135.exe	96
PID 4552 wrote to memory of 2368	4552	a9feacf3b92c06c15f8c2181b6893135.exe	96
PID 4552 wrote to memory of 2368	4552	a9feacf3b92c06c15f8c2181b6893135.exe	96
PID 4552 wrote to memory of 1840	4552	a9feacf3b92c06c15f8c2181b6893135.exe	97
PID 4552 wrote to memory of 1840	4552	a9feacf3b92c06c15f8c2181b6893135.exe	97
PID 4552 wrote to memory of 1840	4552	a9feacf3b92c06c15f8c2181b6893135.exe	97
PID 4552 wrote to memory of 4924	4552	a9feacf3b92c06c15f8c2181b6893135.exe	99
PID 4552 wrote to memory of 4924	4552	a9feacf3b92c06c15f8c2181b6893135.exe	99
PID 4552 wrote to memory of 4924	4552	a9feacf3b92c06c15f8c2181b6893135.exe	99
PID 4552 wrote to memory of 4240	4552	a9feacf3b92c06c15f8c2181b6893135.exe	101
PID 4552 wrote to memory of 4240	4552	a9feacf3b92c06c15f8c2181b6893135.exe	101
PID 4552 wrote to memory of 4240	4552	a9feacf3b92c06c15f8c2181b6893135.exe	101
PID 400 wrote to memory of 2976	400	wryvurno.exe	105
PID 400 wrote to memory of 2976	400	wryvurno.exe	105
PID 400 wrote to memory of 2976	400	wryvurno.exe	105
PID 400 wrote to memory of 2976	400	wryvurno.exe	105
PID 400 wrote to memory of 2976	400	wryvurno.exe	105

C:\Users\Admin\AppData\Local\Temp\a9feacf3b92c06c15f8c2181b6893135.exe
"C:\Users\Admin\AppData\Local\Temp\a9feacf3b92c06c15f8c2181b6893135.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\qjjowfgn\
  2⤵
  PID:1924
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\wryvurno.exe" C:\Windows\SysWOW64\qjjowfgn\
  2⤵
  PID:4700
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create qjjowfgn binPath= "C:\Windows\SysWOW64\qjjowfgn\wryvurno.exe /d\"C:\Users\Admin\AppData\Local\Temp\a9feacf3b92c06c15f8c2181b6893135.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:2368
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description qjjowfgn "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:1840
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start qjjowfgn
  2⤵
  - Launches sc.exe
  PID:4924
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:4240

C:\Windows\SysWOW64\qjjowfgn\wryvurno.exe
C:\Windows\SysWOW64\qjjowfgn\wryvurno.exe /d"C:\Users\Admin\AppData\Local\Temp\a9feacf3b92c06c15f8c2181b6893135.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:400
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\wryvurno.exe

Filesize
12.5MB

MD5
e3c2ac93ef7df5a568d7a37b891cf74e

SHA1
c64ac7d5c3fabcdd4bdff7fbb2be4eff7717382f

SHA256
2775d6259516d3846a932b0a9bf0dc0068090b01ca569861056753005c3416f2

SHA512
b277f60c42f0558c74fdab7267ae7b2c3d7861b512f499c88cbf7303adb0fa6238cfa9bc69fd4b818b5c3467b5d7c8354638a12f6547d321da7b54b43fa4c5d3

Download Submit
C:\Windows\SysWOW64\qjjowfgn\wryvurno.exe

Filesize
4.4MB

MD5
b2a806cdfdb4f00db6424b8ae7aa787f

SHA1
97cb46d787787185a40a35d9568fe857fe85167a

SHA256
163b89a9aed4f4b83cf8502f2388a65ab8af38eb27337dd8be8fc2e84f3788fa

SHA512
bc4d47b5c5d9e5fffee4272a239a5d75272e41a5e806f6f508b614915239035dc87d302dad1970165c98496fbc64714ec30aa06646d25211b1286f57e1627db4

Download Submit
memory/400-11-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/400-8-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2976-10-0x0000000000C90000-0x0000000000CA5000-memory.dmp

Filesize
84KB

Download
memory/2976-14-0x0000000000C90000-0x0000000000CA5000-memory.dmp

Filesize
84KB

Download
memory/2976-15-0x0000000000C90000-0x0000000000CA5000-memory.dmp

Filesize
84KB

Download
memory/2976-16-0x0000000000C90000-0x0000000000CA5000-memory.dmp

Filesize
84KB

Download
memory/2976-17-0x0000000000C90000-0x0000000000CA5000-memory.dmp

Filesize
84KB

Download
memory/4552-3-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/4552-2-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4552-6-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4552-1-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/4552-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads