Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/03/2024, 04:40

General

  • Target

    c4ffcd2bd37b1c2d3152f4bbde0a0d6a.exe

  • Size

    11.5MB

  • MD5

    c4ffcd2bd37b1c2d3152f4bbde0a0d6a

  • SHA1

    0139695f29932d6a4ca7f04c6cb9a42dbfeeca70

  • SHA256

    0ed2549b5144673e94c79df078daa20e3a07b8d90edcd7422bafe216512bedca

  • SHA512

    d6e24017484c9781c31646c41f1b7307b7a8c2755201e894a15d0e620e1384be9e5b0862873f7271f5481fb7b9ad2b37804f07b1133ed512b7a5cc7da81d91c1

  • SSDEEP

    24576:1Uqa71YB5DHlommmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmW:1F15

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Creates new service(s) 1 TTPs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c4ffcd2bd37b1c2d3152f4bbde0a0d6a.exe
    "C:\Users\Admin\AppData\Local\Temp\c4ffcd2bd37b1c2d3152f4bbde0a0d6a.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:5060
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\zhemkkvr\
      2⤵
        PID:312
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\narasfhb.exe" C:\Windows\SysWOW64\zhemkkvr\
        2⤵
          PID:4576
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create zhemkkvr binPath= "C:\Windows\SysWOW64\zhemkkvr\narasfhb.exe /d\"C:\Users\Admin\AppData\Local\Temp\c4ffcd2bd37b1c2d3152f4bbde0a0d6a.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:4500
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description zhemkkvr "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:716
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start zhemkkvr
          2⤵
          • Launches sc.exe
          PID:4352
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:4240
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 1040
          2⤵
          • Program crash
          PID:2916
      • C:\Windows\SysWOW64\zhemkkvr\narasfhb.exe
        C:\Windows\SysWOW64\zhemkkvr\narasfhb.exe /d"C:\Users\Admin\AppData\Local\Temp\c4ffcd2bd37b1c2d3152f4bbde0a0d6a.exe"
        1⤵
        • Sets service image path in registry
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:220
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          2⤵
          • Deletes itself
          PID:3360
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 516
          2⤵
          • Program crash
          PID:1148
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5060 -ip 5060
        1⤵
          PID:2516
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 220 -ip 220
          1⤵
            PID:5008

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\narasfhb.exe

                  Filesize

                  11.5MB

                  MD5

                  f9ba22ca44a319cc7e4434e0ed266d73

                  SHA1

                  b363a6a9d97c0c0b69ec0d0d6e0f6ecaa7a594ae

                  SHA256

                  71ea6712ed6e0b5f117f8435ce4bf489c6af6e651fa47346f2b093183d04e750

                  SHA512

                  42cac07e5415596e647f1942d3d14faa5b788f172a71e1790e82568080b8f0eae4886f44a0f9b37659df6ea67302c4ad16e9f781f50c792c7e71bb7385e7079a

                • memory/220-10-0x0000000000590000-0x0000000000690000-memory.dmp

                  Filesize

                  1024KB

                • memory/220-11-0x0000000000400000-0x0000000000468000-memory.dmp

                  Filesize

                  416KB

                • memory/220-18-0x0000000000400000-0x0000000000468000-memory.dmp

                  Filesize

                  416KB

                • memory/3360-12-0x00000000012F0000-0x0000000001305000-memory.dmp

                  Filesize

                  84KB

                • memory/3360-15-0x00000000012F0000-0x0000000001305000-memory.dmp

                  Filesize

                  84KB

                • memory/3360-16-0x00000000012F0000-0x0000000001305000-memory.dmp

                  Filesize

                  84KB

                • memory/3360-17-0x00000000012F0000-0x0000000001305000-memory.dmp

                  Filesize

                  84KB

                • memory/3360-19-0x00000000012F0000-0x0000000001305000-memory.dmp

                  Filesize

                  84KB

                • memory/5060-3-0x0000000000400000-0x0000000000468000-memory.dmp

                  Filesize

                  416KB

                • memory/5060-2-0x00000000021B0000-0x00000000021C3000-memory.dmp

                  Filesize

                  76KB

                • memory/5060-8-0x0000000000400000-0x0000000000468000-memory.dmp

                  Filesize

                  416KB

                • memory/5060-9-0x00000000021B0000-0x00000000021C3000-memory.dmp

                  Filesize

                  76KB

                • memory/5060-1-0x00000000004B0000-0x00000000005B0000-memory.dmp

                  Filesize

                  1024KB