tofsee | dab7a0e23822f9014969fb8a9ec8e27c947e7542ef63b0508b34ee6156757875

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-03-2024 10:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c05cd0f67349fcf3ec9623331ff98469.exe
Size

338KB
MD5

c05cd0f67349fcf3ec9623331ff98469
SHA1

d3d3e7403a28809a427a09a5143ca1f4964b3205
SHA256

dab7a0e23822f9014969fb8a9ec8e27c947e7542ef63b0508b34ee6156757875
SHA512

9c8431a355b72b89f37b5a94c9c95b120c021df3cf8cdb556ccc262ae56a1cb00c025b20915e8b4628c49499d82ef397bb59007e1ea3809de7b80e37377b7069
SSDEEP

6144:dWgNDwgPQcb3+CW948kKmiRZrvdw/GY2mVRkOF:hNMgPQcbuCWOKmUH+GC

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

defeatwax.ru

refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\ryqtmse = "0"	svchost.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1340	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ryqtmse\ImagePath = "C:\\Windows\\SysWOW64\\ryqtmse\\nwmabpek.exe"	svchost.exe

Deletes itself 1 IoCs

pid	Process
2988	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2560	nwmabpek.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2560 set thread context of 2988	2560	nwmabpek.exe	41

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2552	sc.exe
2580	sc.exe
2848	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2548	2512	c05cd0f67349fcf3ec9623331ff98469.exe	28
PID 2512 wrote to memory of 2548	2512	c05cd0f67349fcf3ec9623331ff98469.exe	28
PID 2512 wrote to memory of 2548	2512	c05cd0f67349fcf3ec9623331ff98469.exe	28
PID 2512 wrote to memory of 2548	2512	c05cd0f67349fcf3ec9623331ff98469.exe	28
PID 2512 wrote to memory of 2576	2512	c05cd0f67349fcf3ec9623331ff98469.exe	30
PID 2512 wrote to memory of 2576	2512	c05cd0f67349fcf3ec9623331ff98469.exe	30
PID 2512 wrote to memory of 2576	2512	c05cd0f67349fcf3ec9623331ff98469.exe	30
PID 2512 wrote to memory of 2576	2512	c05cd0f67349fcf3ec9623331ff98469.exe	30
PID 2512 wrote to memory of 2552	2512	c05cd0f67349fcf3ec9623331ff98469.exe	32
PID 2512 wrote to memory of 2552	2512	c05cd0f67349fcf3ec9623331ff98469.exe	32
PID 2512 wrote to memory of 2552	2512	c05cd0f67349fcf3ec9623331ff98469.exe	32
PID 2512 wrote to memory of 2552	2512	c05cd0f67349fcf3ec9623331ff98469.exe	32
PID 2512 wrote to memory of 2580	2512	c05cd0f67349fcf3ec9623331ff98469.exe	34
PID 2512 wrote to memory of 2580	2512	c05cd0f67349fcf3ec9623331ff98469.exe	34
PID 2512 wrote to memory of 2580	2512	c05cd0f67349fcf3ec9623331ff98469.exe	34
PID 2512 wrote to memory of 2580	2512	c05cd0f67349fcf3ec9623331ff98469.exe	34
PID 2512 wrote to memory of 2848	2512	c05cd0f67349fcf3ec9623331ff98469.exe	36
PID 2512 wrote to memory of 2848	2512	c05cd0f67349fcf3ec9623331ff98469.exe	36
PID 2512 wrote to memory of 2848	2512	c05cd0f67349fcf3ec9623331ff98469.exe	36
PID 2512 wrote to memory of 2848	2512	c05cd0f67349fcf3ec9623331ff98469.exe	36
PID 2512 wrote to memory of 1340	2512	c05cd0f67349fcf3ec9623331ff98469.exe	39
PID 2512 wrote to memory of 1340	2512	c05cd0f67349fcf3ec9623331ff98469.exe	39
PID 2512 wrote to memory of 1340	2512	c05cd0f67349fcf3ec9623331ff98469.exe	39
PID 2512 wrote to memory of 1340	2512	c05cd0f67349fcf3ec9623331ff98469.exe	39
PID 2560 wrote to memory of 2988	2560	nwmabpek.exe	41
PID 2560 wrote to memory of 2988	2560	nwmabpek.exe	41
PID 2560 wrote to memory of 2988	2560	nwmabpek.exe	41
PID 2560 wrote to memory of 2988	2560	nwmabpek.exe	41
PID 2560 wrote to memory of 2988	2560	nwmabpek.exe	41
PID 2560 wrote to memory of 2988	2560	nwmabpek.exe	41

C:\Users\Admin\AppData\Local\Temp\c05cd0f67349fcf3ec9623331ff98469.exe
"C:\Users\Admin\AppData\Local\Temp\c05cd0f67349fcf3ec9623331ff98469.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ryqtmse\
  2⤵
  PID:2548
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\nwmabpek.exe" C:\Windows\SysWOW64\ryqtmse\
  2⤵
  PID:2576
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create ryqtmse binPath= "C:\Windows\SysWOW64\ryqtmse\nwmabpek.exe /d\"C:\Users\Admin\AppData\Local\Temp\c05cd0f67349fcf3ec9623331ff98469.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:2552
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description ryqtmse "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2580
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start ryqtmse
  2⤵
  - Launches sc.exe
  PID:2848
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:1340

C:\Windows\SysWOW64\ryqtmse\nwmabpek.exe
C:\Windows\SysWOW64\ryqtmse\nwmabpek.exe /d"C:\Users\Admin\AppData\Local\Temp\c05cd0f67349fcf3ec9623331ff98469.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Windows security bypass
  - Sets service image path in registry
  - Deletes itself
  PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nwmabpek.exe

Filesize
5.2MB

MD5
ad25470d5ac25c44605e4d5098c2ec25

SHA1
8d7663763ef26b2468b1bfc0aabb0f6d550d7a61

SHA256
b1002baadf5bcdfde9c23a79359ce7b8ca21ce742b91e622836688e916ebdc12

SHA512
655bf388bd7bbe4d1e354d7315a77b7f0f2fbff60c789ff8844bc9005456daedb925ae3f45da0e4e3957702b345d5dbc1d5e856e23cdc51fcd47d4e60fab624d

Download Submit
C:\Windows\SysWOW64\ryqtmse\nwmabpek.exe

Filesize
6.3MB

MD5
d98c67f9ea65f83984460300112ec69f

SHA1
108ac2437e7f39b79921a14359f3ede12fc4233a

SHA256
703c8449773164b9d31a0afae552f9da197155ebc32fc471c52ecb09941e35d3

SHA512
1bad8b41c1c7ef7b2a42b05128e21c46ce4a4676c66877b7ae8f9f159516c115af620e1bdb66b8fe8f8c85d4983c2116b155587a44cae8532324162534646fc6

Download Submit
memory/2512-2-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download
memory/2512-4-0x0000000000400000-0x0000000003250000-memory.dmp

Filesize
46.3MB

Download
memory/2512-8-0x0000000003380000-0x0000000003480000-memory.dmp

Filesize
1024KB

Download
memory/2512-10-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download
memory/2512-7-0x0000000000400000-0x0000000003250000-memory.dmp

Filesize
46.3MB

Download
memory/2512-1-0x0000000003380000-0x0000000003480000-memory.dmp

Filesize
1024KB

Download
memory/2560-16-0x0000000000400000-0x0000000003250000-memory.dmp

Filesize
46.3MB

Download
memory/2560-12-0x0000000003420000-0x0000000003520000-memory.dmp

Filesize
1024KB

Download
memory/2560-20-0x0000000000400000-0x0000000003250000-memory.dmp

Filesize
46.3MB

Download
memory/2988-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2988-19-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2988-15-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2988-11-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2988-21-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2988-22-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2988-23-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads