tofsee | 4043c471bb101ba5705f35adce9a06603af390b5596fe3a338d5a36e7bd845b8

Analysis

max time kernel
139s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 02:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c4c585bbf04113bba793972a6825bcf7.exe
Size

12.8MB
MD5

c4c585bbf04113bba793972a6825bcf7
SHA1

a6c2b02e2949b25a84f96136794299ca4bfd9f4e
SHA256

4043c471bb101ba5705f35adce9a06603af390b5596fe3a338d5a36e7bd845b8
SHA512

9c537400b2981d5c591aa462cde7b289c278fcb884c0a0e55dd89d8ac2d7b1408596e9c3085166bd5fd74e8fac9522bf327d877164f6d41588bf4d0fe835e93d
SSDEEP

12288:3udiizJsed1efCc6hAKOFCaUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUY:3udiiNRc6E

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

defeatwax.ru

refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4396	netsh.exe
1664	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	c4c585bbf04113bba793972a6825bcf7.exe

Executes dropped EXE 1 IoCs

pid	Process
3208	ttmzlihj.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4768	sc.exe
3328	sc.exe
1936	sc.exe
100	sc.exe
2444	sc.exe
3228	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ttmzlihj.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ttmzlihj.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ttmzlihj.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ttmzlihj.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ttmzlihj.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 3508	3680	c4c585bbf04113bba793972a6825bcf7.exe	91
PID 3680 wrote to memory of 3508	3680	c4c585bbf04113bba793972a6825bcf7.exe	91
PID 3680 wrote to memory of 3508	3680	c4c585bbf04113bba793972a6825bcf7.exe	91
PID 3680 wrote to memory of 5060	3680	c4c585bbf04113bba793972a6825bcf7.exe	93
PID 3680 wrote to memory of 5060	3680	c4c585bbf04113bba793972a6825bcf7.exe	93
PID 3680 wrote to memory of 5060	3680	c4c585bbf04113bba793972a6825bcf7.exe	93
PID 3680 wrote to memory of 2444	3680	c4c585bbf04113bba793972a6825bcf7.exe	95
PID 3680 wrote to memory of 2444	3680	c4c585bbf04113bba793972a6825bcf7.exe	95
PID 3680 wrote to memory of 2444	3680	c4c585bbf04113bba793972a6825bcf7.exe	95
PID 3680 wrote to memory of 3228	3680	c4c585bbf04113bba793972a6825bcf7.exe	97
PID 3680 wrote to memory of 3228	3680	c4c585bbf04113bba793972a6825bcf7.exe	97
PID 3680 wrote to memory of 3228	3680	c4c585bbf04113bba793972a6825bcf7.exe	97
PID 3680 wrote to memory of 4768	3680	c4c585bbf04113bba793972a6825bcf7.exe	99
PID 3680 wrote to memory of 4768	3680	c4c585bbf04113bba793972a6825bcf7.exe	99
PID 3680 wrote to memory of 4768	3680	c4c585bbf04113bba793972a6825bcf7.exe	99
PID 3680 wrote to memory of 4396	3680	c4c585bbf04113bba793972a6825bcf7.exe	102
PID 3680 wrote to memory of 4396	3680	c4c585bbf04113bba793972a6825bcf7.exe	102
PID 3680 wrote to memory of 4396	3680	c4c585bbf04113bba793972a6825bcf7.exe	102
PID 3208 wrote to memory of 3764	3208	ttmzlihj.exe	105
PID 3208 wrote to memory of 3764	3208	ttmzlihj.exe	105
PID 3208 wrote to memory of 3764	3208	ttmzlihj.exe	105
PID 3208 wrote to memory of 2208	3208	ttmzlihj.exe	109
PID 3208 wrote to memory of 2208	3208	ttmzlihj.exe	109
PID 3208 wrote to memory of 2208	3208	ttmzlihj.exe	109
PID 3208 wrote to memory of 3328	3208	ttmzlihj.exe	111
PID 3208 wrote to memory of 3328	3208	ttmzlihj.exe	111
PID 3208 wrote to memory of 3328	3208	ttmzlihj.exe	111
PID 3208 wrote to memory of 1936	3208	ttmzlihj.exe	114
PID 3208 wrote to memory of 1936	3208	ttmzlihj.exe	114
PID 3208 wrote to memory of 1936	3208	ttmzlihj.exe	114
PID 3208 wrote to memory of 100	3208	ttmzlihj.exe	118
PID 3208 wrote to memory of 100	3208	ttmzlihj.exe	118
PID 3208 wrote to memory of 100	3208	ttmzlihj.exe	118
PID 3208 wrote to memory of 1664	3208	ttmzlihj.exe	120
PID 3208 wrote to memory of 1664	3208	ttmzlihj.exe	120
PID 3208 wrote to memory of 1664	3208	ttmzlihj.exe	120

C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe
"C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\qoikmqkg\
  2⤵
  PID:3508
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ttmzlihj.exe" C:\Windows\SysWOW64\qoikmqkg\
  2⤵
  PID:5060
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create qoikmqkg binPath= "C:\Windows\SysWOW64\qoikmqkg\ttmzlihj.exe /d\"C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:2444
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description qoikmqkg "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:3228
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start qoikmqkg
  2⤵
  - Launches sc.exe
  PID:4768
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:4396

C:\Windows\SysWOW64\qoikmqkg\ttmzlihj.exe
C:\Windows\SysWOW64\qoikmqkg\ttmzlihj.exe /d"C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\zxrtvztp\
  2⤵
  PID:3764
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Windows\TEMP\ezjmallt.exe" C:\Windows\SysWOW64\zxrtvztp\
  2⤵
  PID:2208
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create zxrtvztp binPath= "C:\Windows\SysWOW64\zxrtvztp\ezjmallt.exe /d\"C:\Windows\SysWOW64\qoikmqkg\ttmzlihj.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:3328
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description zxrtvztp "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:1936
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start zxrtvztp
  2⤵
  - Launches sc.exe
  PID:100
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:1664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ttmzlihj.exe

Filesize
185KB

MD5
e6ba87931a8b48ea21c9de63148e0c34

SHA1
7b3c2924c7a6844236588e04bb3c356a86a37090

SHA256
b5e9cbbcb64c8265daaae5847370bf8cdf52b79f0bba79e67381c665b7bb34e2

SHA512
4375eab81c6c8263730dca1419943a93acaca1b66c5b47269fe6da2d0f43306727952b2a29ca4b7e3bd08f60d5b31541f59e0acba7d4a520f4507ee847ab4ba2

Download Submit
C:\Windows\SysWOW64\qoikmqkg\ttmzlihj.exe

Filesize
283KB

MD5
e9f3e1078d58eaaa10d36e6af2374da2

SHA1
87ac6bce1608738eb787bf24bfbfd8054eb19244

SHA256
80062b97df8b2438334fe2e6a3eed0ca89c5b349675b920aaaca1712b1499a5e

SHA512
d7ef67cedb11a2af4061ee41c8dd43a1b287f30812b234c0e3ba27d2d9850127a0e1dc45e97dab1a334cbe4686d26d5d3b47fa6b7e1c45c1e1e82cce3326db4d

Download Submit
C:\Windows\TEMP\ezjmallt.exe

Filesize
3.4MB

MD5
5ded3ce880f7f2b00f08abee23316eff

SHA1
8db925f036c0181754111cb9d51f512c0fc9b2dc

SHA256
ec400c6f4afe3ce0cd22ac7b165ef59fdfa947a63025b4a7e8bc2fd87d96a6ab

SHA512
704b8e22c5a61c63e09d84f3d7877e9d2e8d84a9947e11ad9cfd3e0e739c479c1cba48b9faaccca2ff517fe701ddb494d1d6eaf5204621e1db125733893d4c8b

Download Submit
memory/3208-10-0x0000000003410000-0x0000000003510000-memory.dmp

Filesize
1024KB

Download
memory/3208-12-0x0000000000400000-0x000000000324C000-memory.dmp

Filesize
46.3MB

Download
memory/3208-14-0x0000000000400000-0x000000000324C000-memory.dmp

Filesize
46.3MB

Download
memory/3680-1-0x0000000003270000-0x0000000003370000-memory.dmp

Filesize
1024KB

Download
memory/3680-2-0x0000000004E60000-0x0000000004E73000-memory.dmp

Filesize
76KB

Download
memory/3680-4-0x0000000000400000-0x000000000324C000-memory.dmp

Filesize
46.3MB

Download
memory/3680-7-0x0000000000400000-0x000000000324C000-memory.dmp

Filesize
46.3MB

Download
memory/3680-9-0x0000000004E60000-0x0000000004E73000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads