tofsee | 00d2de40ab21c023cf7f8bba0707492e9500dc80c94a45855463b4c5c39ac563

General

Target

b71016f0a0d06dec97931344d33e03fa.exe
Size

13.7MB
MD5

b71016f0a0d06dec97931344d33e03fa
SHA1

d67939051d1a7f9225da1c0a0237122f68e2b91b
SHA256

00d2de40ab21c023cf7f8bba0707492e9500dc80c94a45855463b4c5c39ac563
SHA512

9d802af5bd7e302d2eea368c0eafa689e3f1a7adcc3ad19a1fc393c945684efb18ee4e4f62834c1ae966d1ddc657fa2817743243a494d12169cad4b8a29820a5
SSDEEP

49152:dR8888888888888888888888888888888888888888888888888888888888888n:

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.6

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1252	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\imzehkqa\ImagePath = "C:\\Windows\\SysWOW64\\imzehkqa\\txiaelms.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	b71016f0a0d06dec97931344d33e03fa.exe

Deletes itself 1 IoCs

pid	Process
1432	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
4416	txiaelms.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4416 set thread context of 1432	4416	txiaelms.exe	112

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4560	sc.exe
2904	sc.exe
3984	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1392	2596	WerFault.exe	87
2424	4416	WerFault.exe	103

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 2376	2596	b71016f0a0d06dec97931344d33e03fa.exe	91
PID 2596 wrote to memory of 2376	2596	b71016f0a0d06dec97931344d33e03fa.exe	91
PID 2596 wrote to memory of 2376	2596	b71016f0a0d06dec97931344d33e03fa.exe	91
PID 2596 wrote to memory of 4960	2596	b71016f0a0d06dec97931344d33e03fa.exe	93
PID 2596 wrote to memory of 4960	2596	b71016f0a0d06dec97931344d33e03fa.exe	93
PID 2596 wrote to memory of 4960	2596	b71016f0a0d06dec97931344d33e03fa.exe	93
PID 2596 wrote to memory of 4560	2596	b71016f0a0d06dec97931344d33e03fa.exe	95
PID 2596 wrote to memory of 4560	2596	b71016f0a0d06dec97931344d33e03fa.exe	95
PID 2596 wrote to memory of 4560	2596	b71016f0a0d06dec97931344d33e03fa.exe	95
PID 2596 wrote to memory of 2904	2596	b71016f0a0d06dec97931344d33e03fa.exe	97
PID 2596 wrote to memory of 2904	2596	b71016f0a0d06dec97931344d33e03fa.exe	97
PID 2596 wrote to memory of 2904	2596	b71016f0a0d06dec97931344d33e03fa.exe	97
PID 2596 wrote to memory of 3984	2596	b71016f0a0d06dec97931344d33e03fa.exe	101
PID 2596 wrote to memory of 3984	2596	b71016f0a0d06dec97931344d33e03fa.exe	101
PID 2596 wrote to memory of 3984	2596	b71016f0a0d06dec97931344d33e03fa.exe	101
PID 2596 wrote to memory of 1252	2596	b71016f0a0d06dec97931344d33e03fa.exe	104
PID 2596 wrote to memory of 1252	2596	b71016f0a0d06dec97931344d33e03fa.exe	104
PID 2596 wrote to memory of 1252	2596	b71016f0a0d06dec97931344d33e03fa.exe	104
PID 4416 wrote to memory of 1432	4416	txiaelms.exe	112
PID 4416 wrote to memory of 1432	4416	txiaelms.exe	112
PID 4416 wrote to memory of 1432	4416	txiaelms.exe	112
PID 4416 wrote to memory of 1432	4416	txiaelms.exe	112
PID 4416 wrote to memory of 1432	4416	txiaelms.exe	112

C:\Users\Admin\AppData\Local\Temp\b71016f0a0d06dec97931344d33e03fa.exe
"C:\Users\Admin\AppData\Local\Temp\b71016f0a0d06dec97931344d33e03fa.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\imzehkqa\
  2⤵
  PID:2376
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\txiaelms.exe" C:\Windows\SysWOW64\imzehkqa\
  2⤵
  PID:4960
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create imzehkqa binPath= "C:\Windows\SysWOW64\imzehkqa\txiaelms.exe /d\"C:\Users\Admin\AppData\Local\Temp\b71016f0a0d06dec97931344d33e03fa.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:4560
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description imzehkqa "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2904
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start imzehkqa
  2⤵
  - Launches sc.exe
  PID:3984
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:1252
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2596 -s 1196
  2⤵
  - Program crash
  PID:1392

C:\Windows\SysWOW64\imzehkqa\txiaelms.exe
C:\Windows\SysWOW64\imzehkqa\txiaelms.exe /d"C:\Users\Admin\AppData\Local\Temp\b71016f0a0d06dec97931344d33e03fa.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  PID:1432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4416 -s 536
  2⤵
  - Program crash
  PID:2424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2596 -ip 2596
1⤵
PID:2216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4416 -ip 4416
1⤵
PID:540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\txiaelms.exe

Filesize
14.0MB

MD5
eb7536183480f82c2bbf85687d4d2f4d

SHA1
3371f81c10cbc99fad22ab6e80c7a623037e5bbe

SHA256
4d4bc9e3b70b39dfcec3d0134d3936d352b05fa42378aa6b6c50492e6fb719b3

SHA512
947977c2b7ba9cfc39ce5504c3eeec9cbc8ad03e53374af8798ed4f7ba0bc69540ae352e5163bf2b698b5787fa0ccc057bde43345d0c44001ea93ac52343fe21

Download Submit
C:\Windows\SysWOW64\imzehkqa\txiaelms.exe

Filesize
7.6MB

MD5
333af68eeffa2e82529bd8df13f2a8fa

SHA1
498648806e2169aa031f55d1116b9e86ff5a3492

SHA256
c1446a814fbdf89df626eecbb09a5a6241565311b85807f1e08a1a420f09e695

SHA512
695308bd45219c458c979006354ecc35c9bf2633473c05cbb2ec288e5962b5baa4d7c2270973b027ce59531748206ca926b8df6c8d5d49bd30199b10b7defe4a

Download Submit
memory/1432-14-0x0000000000C70000-0x0000000000C85000-memory.dmp

Filesize
84KB

Download
memory/1432-11-0x0000000000C70000-0x0000000000C85000-memory.dmp

Filesize
84KB

Download
memory/1432-18-0x0000000000C70000-0x0000000000C85000-memory.dmp

Filesize
84KB

Download
memory/1432-16-0x0000000000C70000-0x0000000000C85000-memory.dmp

Filesize
84KB

Download
memory/1432-19-0x0000000000C70000-0x0000000000C85000-memory.dmp

Filesize
84KB

Download
memory/2596-4-0x0000000000400000-0x000000000323C000-memory.dmp

Filesize
46.2MB

Download
memory/2596-2-0x0000000004E40000-0x0000000004E53000-memory.dmp

Filesize
76KB

Download
memory/2596-7-0x0000000000400000-0x000000000323C000-memory.dmp

Filesize
46.2MB

Download
memory/2596-8-0x0000000004E40000-0x0000000004E53000-memory.dmp

Filesize
76KB

Download
memory/2596-1-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4416-10-0x00000000032F0000-0x00000000033F0000-memory.dmp

Filesize
1024KB

Download
memory/4416-15-0x0000000000400000-0x000000000323C000-memory.dmp

Filesize
46.2MB

Download
memory/4416-17-0x0000000000400000-0x000000000323C000-memory.dmp

Filesize
46.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads