tofsee | 216c4de57aae07cd4a677efd02183dc2709a6e096575d9b6fee861fd4217203f

General

Target

bc0db50e394ee39b57a709b77f5e280a.exe
Size

13.3MB
MD5

bc0db50e394ee39b57a709b77f5e280a
SHA1

784fc1303bafbce76bf0b02da9d814605a84e79f
SHA256

216c4de57aae07cd4a677efd02183dc2709a6e096575d9b6fee861fd4217203f
SHA512

764d067f4d1e8906b1a4f5337cd665514e0f61afb24c18c4b1593503744dd34fb6029d1182a15ed85ca906ed9da06d6dc5c1cef59eb861d4f2790c5073e43dd3
SSDEEP

49152:fj5555555555555555555555555555555555555555555555555555555555555Z:

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1944	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wofdrdwj\ImagePath = "C:\\Windows\\SysWOW64\\wofdrdwj\\vannqpfk.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	bc0db50e394ee39b57a709b77f5e280a.exe

Deletes itself 1 IoCs

pid	Process
2352	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
1076	vannqpfk.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1076 set thread context of 2352	1076	vannqpfk.exe	117

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
688	sc.exe
3988	sc.exe
1792	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 384	1948	bc0db50e394ee39b57a709b77f5e280a.exe	104
PID 1948 wrote to memory of 384	1948	bc0db50e394ee39b57a709b77f5e280a.exe	104
PID 1948 wrote to memory of 384	1948	bc0db50e394ee39b57a709b77f5e280a.exe	104
PID 1948 wrote to memory of 4292	1948	bc0db50e394ee39b57a709b77f5e280a.exe	106
PID 1948 wrote to memory of 4292	1948	bc0db50e394ee39b57a709b77f5e280a.exe	106
PID 1948 wrote to memory of 4292	1948	bc0db50e394ee39b57a709b77f5e280a.exe	106
PID 1948 wrote to memory of 688	1948	bc0db50e394ee39b57a709b77f5e280a.exe	108
PID 1948 wrote to memory of 688	1948	bc0db50e394ee39b57a709b77f5e280a.exe	108
PID 1948 wrote to memory of 688	1948	bc0db50e394ee39b57a709b77f5e280a.exe	108
PID 1948 wrote to memory of 3988	1948	bc0db50e394ee39b57a709b77f5e280a.exe	110
PID 1948 wrote to memory of 3988	1948	bc0db50e394ee39b57a709b77f5e280a.exe	110
PID 1948 wrote to memory of 3988	1948	bc0db50e394ee39b57a709b77f5e280a.exe	110
PID 1948 wrote to memory of 1792	1948	bc0db50e394ee39b57a709b77f5e280a.exe	112
PID 1948 wrote to memory of 1792	1948	bc0db50e394ee39b57a709b77f5e280a.exe	112
PID 1948 wrote to memory of 1792	1948	bc0db50e394ee39b57a709b77f5e280a.exe	112
PID 1948 wrote to memory of 1944	1948	bc0db50e394ee39b57a709b77f5e280a.exe	114
PID 1948 wrote to memory of 1944	1948	bc0db50e394ee39b57a709b77f5e280a.exe	114
PID 1948 wrote to memory of 1944	1948	bc0db50e394ee39b57a709b77f5e280a.exe	114
PID 1076 wrote to memory of 2352	1076	vannqpfk.exe	117
PID 1076 wrote to memory of 2352	1076	vannqpfk.exe	117
PID 1076 wrote to memory of 2352	1076	vannqpfk.exe	117
PID 1076 wrote to memory of 2352	1076	vannqpfk.exe	117
PID 1076 wrote to memory of 2352	1076	vannqpfk.exe	117

C:\Users\Admin\AppData\Local\Temp\bc0db50e394ee39b57a709b77f5e280a.exe
"C:\Users\Admin\AppData\Local\Temp\bc0db50e394ee39b57a709b77f5e280a.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\wofdrdwj\
  2⤵
  PID:384
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\vannqpfk.exe" C:\Windows\SysWOW64\wofdrdwj\
  2⤵
  PID:4292
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create wofdrdwj binPath= "C:\Windows\SysWOW64\wofdrdwj\vannqpfk.exe /d\"C:\Users\Admin\AppData\Local\Temp\bc0db50e394ee39b57a709b77f5e280a.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:688
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description wofdrdwj "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:3988
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start wofdrdwj
  2⤵
  - Launches sc.exe
  PID:1792
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:1944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2824 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:4596

C:\Windows\SysWOW64\wofdrdwj\vannqpfk.exe
C:\Windows\SysWOW64\wofdrdwj\vannqpfk.exe /d"C:\Users\Admin\AppData\Local\Temp\bc0db50e394ee39b57a709b77f5e280a.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\vannqpfk.exe

Filesize
13.7MB

MD5
d949cffe5e3692b8ee1a9fec7a37be27

SHA1
469ccc0d10b71a0caf851b7c43a012af09a8c7e2

SHA256
ddb8e4575c2dde9a56292a1d2d903d31ef1754cfeba86668dcc36d644e1b96ef

SHA512
9b269a6ae0e73f0ba9d3c6c3a202edd6a23791e7430e8d0b6389669207374ddd87f0dc641cfe7b9a941dc60c183878623a379dfea6f3f7e2a5b3d88809bf82e9

Download Submit
memory/1076-16-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1076-13-0x0000000000430000-0x0000000000431000-memory.dmp

Filesize
4KB

Download
memory/1076-12-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1948-5-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1948-6-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1948-7-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/1948-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1948-10-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1948-3-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/1948-1-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/1948-2-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2352-15-0x0000000000450000-0x0000000000465000-memory.dmp

Filesize
84KB

Download
memory/2352-18-0x0000000000450000-0x0000000000465000-memory.dmp

Filesize
84KB

Download
memory/2352-20-0x0000000000450000-0x0000000000465000-memory.dmp

Filesize
84KB

Download
memory/2352-21-0x0000000000450000-0x0000000000465000-memory.dmp

Filesize
84KB

Download
memory/2352-22-0x0000000000450000-0x0000000000465000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads