Analysis

  • max time kernel
    151s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/03/2024, 10:51

General

  • Target

    c5b025bdaf3514eec1039bdfd3136719.exe

  • Size

    12.3MB

  • MD5

    c5b025bdaf3514eec1039bdfd3136719

  • SHA1

    fde907f50ba9d3688ac89bbfbdb439882da654cf

  • SHA256

    6eb81b659b7fdf4fd090a09e86d122dbcda216e56c5cb73677b4c01f81d7a1ea

  • SHA512

    c3d6a2dc0be83a5d0b1546ce2a34d7f409190d924b5e282e9543ae4213bf95d22ff12f72a834aee8f24955d12aca29fda3d9e16a5aff777498d81e920bb87607

  • SSDEEP

    49152:YRBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBf:

Malware Config

Extracted

Family

tofsee

C2

43.231.4.6

lazystax.ru

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Creates new service(s) 1 TTPs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c5b025bdaf3514eec1039bdfd3136719.exe
    "C:\Users\Admin\AppData\Local\Temp\c5b025bdaf3514eec1039bdfd3136719.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4968
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\dnexasot\
      2⤵
        PID:3044
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\abhqbxlt.exe" C:\Windows\SysWOW64\dnexasot\
        2⤵
          PID:3952
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create dnexasot binPath= "C:\Windows\SysWOW64\dnexasot\abhqbxlt.exe /d\"C:\Users\Admin\AppData\Local\Temp\c5b025bdaf3514eec1039bdfd3136719.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:3328
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description dnexasot "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:1928
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start dnexasot
          2⤵
          • Launches sc.exe
          PID:4580
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:4416
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 1212
          2⤵
          • Program crash
          PID:4632
      • C:\Windows\SysWOW64\dnexasot\abhqbxlt.exe
        C:\Windows\SysWOW64\dnexasot\abhqbxlt.exe /d"C:\Users\Admin\AppData\Local\Temp\c5b025bdaf3514eec1039bdfd3136719.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4924
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          2⤵
          • Sets service image path in registry
          • Deletes itself
          PID:2832
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 512
          2⤵
          • Program crash
          PID:916
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4968 -ip 4968
        1⤵
          PID:4376
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4924 -ip 4924
          1⤵
            PID:1980
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3808 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
            1⤵
              PID:1824

            Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\abhqbxlt.exe

                    Filesize

                    13.7MB

                    MD5

                    1eba9ddac3237d946ffa5626f6873f4a

                    SHA1

                    8e02b7360c0070b005cb030c4e0aa9695da985d4

                    SHA256

                    269f1db7876f48c8fd88d97c5a77a01c47fd37d5806fbad1c03ed7774ca466e3

                    SHA512

                    962f78b12e4e905fcd182c27a1c84eff5e7b849e5241fccb7d0fd33eae3805929b2775c74b7502df66bba82f5a95aa99314c5574397fa36248fec9df58dfc3cd

                  • memory/2832-20-0x0000000001090000-0x00000000010A5000-memory.dmp

                    Filesize

                    84KB

                  • memory/2832-19-0x0000000001090000-0x00000000010A5000-memory.dmp

                    Filesize

                    84KB

                  • memory/2832-17-0x0000000001090000-0x00000000010A5000-memory.dmp

                    Filesize

                    84KB

                  • memory/2832-13-0x0000000001090000-0x00000000010A5000-memory.dmp

                    Filesize

                    84KB

                  • memory/4924-12-0x0000000000400000-0x0000000000C0A000-memory.dmp

                    Filesize

                    8.0MB

                  • memory/4924-18-0x0000000000400000-0x0000000000C0A000-memory.dmp

                    Filesize

                    8.0MB

                  • memory/4924-11-0x0000000000D50000-0x0000000000E50000-memory.dmp

                    Filesize

                    1024KB

                  • memory/4968-5-0x0000000000400000-0x0000000000C0A000-memory.dmp

                    Filesize

                    8.0MB

                  • memory/4968-9-0x0000000000FB0000-0x0000000000FC3000-memory.dmp

                    Filesize

                    76KB

                  • memory/4968-8-0x0000000000400000-0x0000000000C0A000-memory.dmp

                    Filesize

                    8.0MB

                  • memory/4968-1-0x0000000000FD0000-0x00000000010D0000-memory.dmp

                    Filesize

                    1024KB

                  • memory/4968-3-0x0000000000400000-0x0000000000C0A000-memory.dmp

                    Filesize

                    8.0MB

                  • memory/4968-2-0x0000000000FB0000-0x0000000000FC3000-memory.dmp

                    Filesize

                    76KB