Analysis

  • max time kernel
    150s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/03/2024, 01:05

General

  • Target

    b6202f30b837ad0025da86ecf9f5f1c9.exe

  • Size

    12.6MB

  • MD5

    b6202f30b837ad0025da86ecf9f5f1c9

  • SHA1

    ac922759c8dde66341dd92f557c828b894aa0cfb

  • SHA256

    b6768d16dbabafc1d9d07cdd065c875522cce0b6ee493187ba984e3e87b0aece

  • SHA512

    ddf185d38b0ad7b7c8a69c27830c388ef3d20a3430cea4aecdeeae857b5d9209be4fda62d06b91b2018cd1d9f52f521fc95c5f9989ba4c54bd6f21bc4ebac527

  • SSDEEP

    12288:ZRXQK44fy6111111111111111111111111111111111111111111111111111111:ZRx2

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Creates new service(s) 1 TTPs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 22 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b6202f30b837ad0025da86ecf9f5f1c9.exe
    "C:\Users\Admin\AppData\Local\Temp\b6202f30b837ad0025da86ecf9f5f1c9.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4932
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 596
      2⤵
      • Program crash
      PID:1620
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 724
      2⤵
      • Program crash
      PID:3608
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 724
      2⤵
      • Program crash
      PID:2784
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 824
      2⤵
      • Program crash
      PID:4984
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 812
      2⤵
      • Program crash
      PID:1712
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 976
      2⤵
      • Program crash
      PID:4500
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 988
      2⤵
      • Program crash
      PID:5028
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 824
      2⤵
      • Program crash
      PID:1876
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\iferdxve\
      2⤵
        PID:1248
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 912
        2⤵
        • Program crash
        PID:2780
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 580
        2⤵
        • Program crash
        PID:4980
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\qmeebqpd.exe" C:\Windows\SysWOW64\iferdxve\
        2⤵
          PID:4460
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 1224
          2⤵
          • Program crash
          PID:2244
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 1196
          2⤵
          • Program crash
          PID:3956
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create iferdxve binPath= "C:\Windows\SysWOW64\iferdxve\qmeebqpd.exe /d\"C:\Users\Admin\AppData\Local\Temp\b6202f30b837ad0025da86ecf9f5f1c9.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:572
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 1276
          2⤵
          • Program crash
          PID:4324
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 1288
          2⤵
          • Program crash
          PID:3604
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description iferdxve "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:3620
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 1344
          2⤵
          • Program crash
          PID:2112
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 1256
          2⤵
          • Program crash
          PID:5024
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start iferdxve
          2⤵
          • Launches sc.exe
          PID:1236
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 1296
          2⤵
          • Program crash
          PID:4628
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 588
          2⤵
          • Program crash
          PID:3740
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:868
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 1036
          2⤵
          • Program crash
          PID:4732
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4932 -ip 4932
        1⤵
          PID:4608
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4932 -ip 4932
          1⤵
            PID:3472
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4932 -ip 4932
            1⤵
              PID:2676
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4932 -ip 4932
              1⤵
                PID:4740
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4932 -ip 4932
                1⤵
                  PID:4636
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4932 -ip 4932
                  1⤵
                    PID:3356
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4932 -ip 4932
                    1⤵
                      PID:2836
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4932 -ip 4932
                      1⤵
                        PID:5048
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4932 -ip 4932
                        1⤵
                          PID:1976
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4932 -ip 4932
                          1⤵
                            PID:2012
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4932 -ip 4932
                            1⤵
                              PID:1764
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4932 -ip 4932
                              1⤵
                                PID:3980
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4932 -ip 4932
                                1⤵
                                  PID:556
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4932 -ip 4932
                                  1⤵
                                    PID:1884
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4932 -ip 4932
                                    1⤵
                                      PID:116
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4932 -ip 4932
                                      1⤵
                                        PID:3428
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4932 -ip 4932
                                        1⤵
                                          PID:1852
                                        • C:\Windows\SysWOW64\iferdxve\qmeebqpd.exe
                                          C:\Windows\SysWOW64\iferdxve\qmeebqpd.exe /d"C:\Users\Admin\AppData\Local\Temp\b6202f30b837ad0025da86ecf9f5f1c9.exe"
                                          1⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetThreadContext
                                          • Suspicious use of WriteProcessMemory
                                          PID:4872
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 524
                                            2⤵
                                            • Program crash
                                            PID:1836
                                          • C:\Windows\SysWOW64\svchost.exe
                                            svchost.exe
                                            2⤵
                                            • Sets service image path in registry
                                            • Deletes itself
                                            PID:1612
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 532
                                            2⤵
                                            • Program crash
                                            PID:3568
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 568
                                            2⤵
                                            • Program crash
                                            PID:1888
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4932 -ip 4932
                                          1⤵
                                            PID:1956
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4932 -ip 4932
                                            1⤵
                                              PID:232
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4872 -ip 4872
                                              1⤵
                                                PID:468
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4872 -ip 4872
                                                1⤵
                                                  PID:1764
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4872 -ip 4872
                                                  1⤵
                                                    PID:3928

                                                  Network

                                                  MITRE ATT&CK Enterprise v15

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • C:\Users\Admin\AppData\Local\Temp\qmeebqpd.exe

                                                    Filesize

                                                    10.3MB

                                                    MD5

                                                    2e0e424c4a700fb8797bfbc8f2cdb338

                                                    SHA1

                                                    6b02e7ae370abb0853e8c357211c047a794f6324

                                                    SHA256

                                                    5db817993ffbdf931b750fb3fa408f1238d21da7422b0c9750a4d34ac1a67fcc

                                                    SHA512

                                                    26e7bc05a5498844553e7834371c81d91fb1bb209801cf21b74bdfc755a0edf121355f582c93cf4ec6d1cc8e74b184a6e50e19fceba587899211a22cdd0fc1ef

                                                  • C:\Windows\SysWOW64\iferdxve\qmeebqpd.exe

                                                    Filesize

                                                    7.1MB

                                                    MD5

                                                    469f3d88bd8bcd180aaa91a5e10d46cd

                                                    SHA1

                                                    b0ec8d3d5fdbe473b70984e60274f21da7dd7ff9

                                                    SHA256

                                                    88f32e147e340b151f876517183ffebc1e5df84e54f9e6daf8fa3470e1b6f81e

                                                    SHA512

                                                    e5a1b27bcb4d8882f65c4301fead16e2e91dfbd3d3ca6b0d8a1187b99d777a98582f17ce3ca1b87ef29ae9eebb8432ea13d9fb1f067282aa589aed5302a62fcb

                                                  • memory/1612-12-0x0000000000E70000-0x0000000000E85000-memory.dmp

                                                    Filesize

                                                    84KB

                                                  • memory/1612-15-0x0000000000E70000-0x0000000000E85000-memory.dmp

                                                    Filesize

                                                    84KB

                                                  • memory/1612-16-0x0000000000E70000-0x0000000000E85000-memory.dmp

                                                    Filesize

                                                    84KB

                                                  • memory/1612-18-0x0000000000E70000-0x0000000000E85000-memory.dmp

                                                    Filesize

                                                    84KB

                                                  • memory/1612-19-0x0000000000E70000-0x0000000000E85000-memory.dmp

                                                    Filesize

                                                    84KB

                                                  • memory/4872-10-0x0000000003620000-0x0000000003720000-memory.dmp

                                                    Filesize

                                                    1024KB

                                                  • memory/4872-11-0x0000000000400000-0x0000000003359000-memory.dmp

                                                    Filesize

                                                    47.3MB

                                                  • memory/4872-17-0x0000000000400000-0x0000000003359000-memory.dmp

                                                    Filesize

                                                    47.3MB

                                                  • memory/4932-4-0x0000000000400000-0x0000000003359000-memory.dmp

                                                    Filesize

                                                    47.3MB

                                                  • memory/4932-2-0x00000000001C0000-0x00000000001D3000-memory.dmp

                                                    Filesize

                                                    76KB

                                                  • memory/4932-7-0x0000000000400000-0x0000000003359000-memory.dmp

                                                    Filesize

                                                    47.3MB

                                                  • memory/4932-8-0x00000000001C0000-0x00000000001D3000-memory.dmp

                                                    Filesize

                                                    76KB

                                                  • memory/4932-1-0x0000000003510000-0x0000000003610000-memory.dmp

                                                    Filesize

                                                    1024KB