Analysis

  • max time kernel
    148s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    13/03/2024, 01:49

General

  • Target

    c4a9c28cd43849f4627561bca275779e.exe

  • Size

    11.5MB

  • MD5

    c4a9c28cd43849f4627561bca275779e

  • SHA1

    83f463f883f83ef8de44c85b69daf1484a4952b9

  • SHA256

    f42d0e2c1568ab7d7ff6add4693f22eb888133cd6bfbdfd45b8863355fdecb6d

  • SHA512

    7f9c24a21bd59529e34f07a8f3d57a593974b9a5605b3f90758bfef36788931aa78d7253bbe43e0cfc8596f83cfa436da38a3130362f3888dbdaaf98fbe21aa4

  • SSDEEP

    24576:ElxdvCcpOKCtBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBr:ElzOR

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs 1 IoCs
  • Creates new service(s) 1 TTPs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c4a9c28cd43849f4627561bca275779e.exe
    "C:\Users\Admin\AppData\Local\Temp\c4a9c28cd43849f4627561bca275779e.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2912
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\dujmyxav\
      2⤵
        PID:2852
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\cpgphuwq.exe" C:\Windows\SysWOW64\dujmyxav\
        2⤵
          PID:2468
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create dujmyxav binPath= "C:\Windows\SysWOW64\dujmyxav\cpgphuwq.exe /d\"C:\Users\Admin\AppData\Local\Temp\c4a9c28cd43849f4627561bca275779e.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:2620
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description dujmyxav "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:2484
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start dujmyxav
          2⤵
          • Launches sc.exe
          PID:2472
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:2664
      • C:\Windows\SysWOW64\dujmyxav\cpgphuwq.exe
        C:\Windows\SysWOW64\dujmyxav\cpgphuwq.exe /d"C:\Users\Admin\AppData\Local\Temp\c4a9c28cd43849f4627561bca275779e.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2456
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          2⤵
          • Windows security bypass
          • Sets service image path in registry
          • Deletes itself
          PID:2336

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\cpgphuwq.exe

              Filesize

              2.2MB

              MD5

              07f7b8054a15596471807c7830991a4f

              SHA1

              711aa0643bf39af809e01e2fddf9862b002b7a37

              SHA256

              8592d91185244a5173494d301c3b9dde3b959703827183d4d90034e6d2a05bf5

              SHA512

              92060c96391c99c8fb2f0c8391c896342f5edaa41c21505242d0b7e89b9b2f88e9496ec598e3bc62353f02f9e2f8bdfea887d4b24315f6c63745ae8ec910e70f

            • C:\Windows\SysWOW64\dujmyxav\cpgphuwq.exe

              Filesize

              4.4MB

              MD5

              b4ea8d12200344126056f292a7974ac2

              SHA1

              74471f400beabc67e5e6400b044c61604a3b98b0

              SHA256

              8ee434d29ffe59b8e959202e7b41110ba977d2ca5181d8ed8e4143278615ca51

              SHA512

              e7e03949bfbb0e854b3c033d07e0958749c53fe603c012237bfe14b1c46aa144a9573bc491820c13234c83cdc7b80ccaeffe4981c4d29e4715c7880c5881c66d

            • memory/2336-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

              Filesize

              4KB

            • memory/2336-15-0x0000000000090000-0x00000000000A5000-memory.dmp

              Filesize

              84KB

            • memory/2336-22-0x0000000000090000-0x00000000000A5000-memory.dmp

              Filesize

              84KB

            • memory/2336-20-0x0000000000090000-0x00000000000A5000-memory.dmp

              Filesize

              84KB

            • memory/2336-21-0x0000000000090000-0x00000000000A5000-memory.dmp

              Filesize

              84KB

            • memory/2336-19-0x0000000000090000-0x00000000000A5000-memory.dmp

              Filesize

              84KB

            • memory/2336-11-0x0000000000090000-0x00000000000A5000-memory.dmp

              Filesize

              84KB

            • memory/2456-17-0x0000000000400000-0x0000000000468000-memory.dmp

              Filesize

              416KB

            • memory/2456-12-0x0000000000400000-0x0000000000468000-memory.dmp

              Filesize

              416KB

            • memory/2456-10-0x00000000005A0000-0x00000000006A0000-memory.dmp

              Filesize

              1024KB

            • memory/2912-1-0x0000000000520000-0x0000000000620000-memory.dmp

              Filesize

              1024KB

            • memory/2912-3-0x0000000000220000-0x0000000000233000-memory.dmp

              Filesize

              76KB

            • memory/2912-9-0x0000000000520000-0x0000000000620000-memory.dmp

              Filesize

              1024KB

            • memory/2912-8-0x0000000000400000-0x0000000000468000-memory.dmp

              Filesize

              416KB

            • memory/2912-4-0x0000000000400000-0x0000000000468000-memory.dmp

              Filesize

              416KB