Analysis

  • max time kernel
    154s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    13/03/2024, 06:27

General

  • Target

    c532dd750e39a5b79ecccdeb26e153f5.exe

  • Size

    14.3MB

  • MD5

    c532dd750e39a5b79ecccdeb26e153f5

  • SHA1

    2c4d78ab07cf322e488da622f08255b8c04f623c

  • SHA256

    3da981808b1a529f3e59f6c56e42809d38c4cfdd93d6c0efc5e1a80cac3d5d16

  • SHA512

    979acb280679023cc6f181e2aef3925da23b165cfbf408760fa428e819306e0b3f9d04751053ac11bfb7e1be4571994c5262f414cd418e5ec98766b0502da4cf

  • SSDEEP

    24576:cgdy5yNM4444444444444444444444444444444444444444444444444444444s:

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs 1 IoCs
  • Creates new service(s) 1 TTPs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c532dd750e39a5b79ecccdeb26e153f5.exe
    "C:\Users\Admin\AppData\Local\Temp\c532dd750e39a5b79ecccdeb26e153f5.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2832
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\rzjyfmmh\
      2⤵
        PID:3032
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\rvcgilbn.exe" C:\Windows\SysWOW64\rzjyfmmh\
        2⤵
          PID:2620
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create rzjyfmmh binPath= "C:\Windows\SysWOW64\rzjyfmmh\rvcgilbn.exe /d\"C:\Users\Admin\AppData\Local\Temp\c532dd750e39a5b79ecccdeb26e153f5.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:2564
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description rzjyfmmh "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:2736
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start rzjyfmmh
          2⤵
          • Launches sc.exe
          PID:3036
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:2804
      • C:\Windows\SysWOW64\rzjyfmmh\rvcgilbn.exe
        C:\Windows\SysWOW64\rzjyfmmh\rvcgilbn.exe /d"C:\Users\Admin\AppData\Local\Temp\c532dd750e39a5b79ecccdeb26e153f5.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2524
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          2⤵
          • Windows security bypass
          • Sets service image path in registry
          • Deletes itself
          PID:2956

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\rvcgilbn.exe

              Filesize

              14.1MB

              MD5

              10562975ef046801809279f1a1782f81

              SHA1

              5f2fe24fe5404f905efc761b05c376365214a839

              SHA256

              84917ab750de078b23fe8bd326e932d570501e9aa93575a084e2490286d5f441

              SHA512

              8524ef9cbc4f8e616177cd41fb1ca756fa95091c257b145dc197e9d0d4de505d2d1496b022b4653e70c29f54c027b5512e0026e850caf84b5068243b450960e5

            • C:\Windows\SysWOW64\rzjyfmmh\rvcgilbn.exe

              Filesize

              6.6MB

              MD5

              03a3e68696833b1bb1ae31b68527d6c6

              SHA1

              80852941489fe4d208f952a1075327a0d782ca15

              SHA256

              49106d9937c702db5b1893abc505dc3abf0f259b6a00e3916075ac2d6278b6fc

              SHA512

              249ac0c1d6177c060c06fe9f70dbc35bdaf7b7a49c08ae2411a569b8551e3634b55a62bf65d03c2cfbcd68639b2dcfcd5f91999fc048cfd9d0419d09e7887bd7

            • memory/2524-18-0x0000000000400000-0x0000000000456000-memory.dmp

              Filesize

              344KB

            • memory/2524-11-0x0000000000400000-0x0000000000456000-memory.dmp

              Filesize

              344KB

            • memory/2524-10-0x00000000004F0000-0x00000000005F0000-memory.dmp

              Filesize

              1024KB

            • memory/2832-6-0x0000000000400000-0x0000000000456000-memory.dmp

              Filesize

              344KB

            • memory/2832-7-0x0000000000220000-0x0000000000233000-memory.dmp

              Filesize

              76KB

            • memory/2832-1-0x00000000005E0000-0x00000000006E0000-memory.dmp

              Filesize

              1024KB

            • memory/2832-3-0x0000000000400000-0x0000000000456000-memory.dmp

              Filesize

              344KB

            • memory/2832-2-0x0000000000220000-0x0000000000233000-memory.dmp

              Filesize

              76KB

            • memory/2956-12-0x0000000000080000-0x0000000000095000-memory.dmp

              Filesize

              84KB

            • memory/2956-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

              Filesize

              4KB

            • memory/2956-15-0x0000000000080000-0x0000000000095000-memory.dmp

              Filesize

              84KB

            • memory/2956-20-0x0000000000080000-0x0000000000095000-memory.dmp

              Filesize

              84KB

            • memory/2956-21-0x0000000000080000-0x0000000000095000-memory.dmp

              Filesize

              84KB

            • memory/2956-22-0x0000000000080000-0x0000000000095000-memory.dmp

              Filesize

              84KB