tofsee | 916ed7d444a4233ca18d621514bc9a419608860fa3d13d1aef060d9e034bceb1

Analysis

max time kernel
148s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/03/2024, 15:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d3d0c67da718de678206c8e774c6d30c.exe
Size

14.6MB
MD5

d3d0c67da718de678206c8e774c6d30c
SHA1

b2b4039df080b6ad64d6a886ac4b29c76fcd1a37
SHA256

916ed7d444a4233ca18d621514bc9a419608860fa3d13d1aef060d9e034bceb1
SHA512

2647deb5b80f83d8d8f6a7f47e393fea4e57299703ba7458aba84317a5694eb5e70ea038342bdd60de5370b6fabb8685582c3e2115ca5fb1c4867af2b97b3974
SSDEEP

49152:r66666666666666666666666666666666666666666666666666666666666666/:

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

43.231.4.6

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\narfwhma = "0"	svchost.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2496	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\narfwhma\ImagePath = "C:\\Windows\\SysWOW64\\narfwhma\\laeiylcc.exe"	svchost.exe

Deletes itself 1 IoCs

pid	Process
2532	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2584	laeiylcc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2584 set thread context of 2532	2584	laeiylcc.exe	41

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2572	sc.exe
2560	sc.exe
2952	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 1784	1932	d3d0c67da718de678206c8e774c6d30c.exe	28
PID 1932 wrote to memory of 1784	1932	d3d0c67da718de678206c8e774c6d30c.exe	28
PID 1932 wrote to memory of 1784	1932	d3d0c67da718de678206c8e774c6d30c.exe	28
PID 1932 wrote to memory of 1784	1932	d3d0c67da718de678206c8e774c6d30c.exe	28
PID 1932 wrote to memory of 1608	1932	d3d0c67da718de678206c8e774c6d30c.exe	30
PID 1932 wrote to memory of 1608	1932	d3d0c67da718de678206c8e774c6d30c.exe	30
PID 1932 wrote to memory of 1608	1932	d3d0c67da718de678206c8e774c6d30c.exe	30
PID 1932 wrote to memory of 1608	1932	d3d0c67da718de678206c8e774c6d30c.exe	30
PID 1932 wrote to memory of 2952	1932	d3d0c67da718de678206c8e774c6d30c.exe	32
PID 1932 wrote to memory of 2952	1932	d3d0c67da718de678206c8e774c6d30c.exe	32
PID 1932 wrote to memory of 2952	1932	d3d0c67da718de678206c8e774c6d30c.exe	32
PID 1932 wrote to memory of 2952	1932	d3d0c67da718de678206c8e774c6d30c.exe	32
PID 1932 wrote to memory of 2572	1932	d3d0c67da718de678206c8e774c6d30c.exe	34
PID 1932 wrote to memory of 2572	1932	d3d0c67da718de678206c8e774c6d30c.exe	34
PID 1932 wrote to memory of 2572	1932	d3d0c67da718de678206c8e774c6d30c.exe	34
PID 1932 wrote to memory of 2572	1932	d3d0c67da718de678206c8e774c6d30c.exe	34
PID 1932 wrote to memory of 2560	1932	d3d0c67da718de678206c8e774c6d30c.exe	36
PID 1932 wrote to memory of 2560	1932	d3d0c67da718de678206c8e774c6d30c.exe	36
PID 1932 wrote to memory of 2560	1932	d3d0c67da718de678206c8e774c6d30c.exe	36
PID 1932 wrote to memory of 2560	1932	d3d0c67da718de678206c8e774c6d30c.exe	36
PID 1932 wrote to memory of 2496	1932	d3d0c67da718de678206c8e774c6d30c.exe	39
PID 1932 wrote to memory of 2496	1932	d3d0c67da718de678206c8e774c6d30c.exe	39
PID 1932 wrote to memory of 2496	1932	d3d0c67da718de678206c8e774c6d30c.exe	39
PID 1932 wrote to memory of 2496	1932	d3d0c67da718de678206c8e774c6d30c.exe	39
PID 2584 wrote to memory of 2532	2584	laeiylcc.exe	41
PID 2584 wrote to memory of 2532	2584	laeiylcc.exe	41
PID 2584 wrote to memory of 2532	2584	laeiylcc.exe	41
PID 2584 wrote to memory of 2532	2584	laeiylcc.exe	41
PID 2584 wrote to memory of 2532	2584	laeiylcc.exe	41
PID 2584 wrote to memory of 2532	2584	laeiylcc.exe	41

C:\Users\Admin\AppData\Local\Temp\d3d0c67da718de678206c8e774c6d30c.exe
"C:\Users\Admin\AppData\Local\Temp\d3d0c67da718de678206c8e774c6d30c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\narfwhma\
  2⤵
  PID:1784
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\laeiylcc.exe" C:\Windows\SysWOW64\narfwhma\
  2⤵
  PID:1608
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create narfwhma binPath= "C:\Windows\SysWOW64\narfwhma\laeiylcc.exe /d\"C:\Users\Admin\AppData\Local\Temp\d3d0c67da718de678206c8e774c6d30c.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:2952
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description narfwhma "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2572
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start narfwhma
  2⤵
  - Launches sc.exe
  PID:2560
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:2496

C:\Windows\SysWOW64\narfwhma\laeiylcc.exe
C:\Windows\SysWOW64\narfwhma\laeiylcc.exe /d"C:\Users\Admin\AppData\Local\Temp\d3d0c67da718de678206c8e774c6d30c.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Windows security bypass
  - Sets service image path in registry
  - Deletes itself
  PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\laeiylcc.exe

Filesize
9.1MB

MD5
a19f5bf65fb69a51e5ab803764866bed

SHA1
3570d9b051a324c7c2c347bb31eec0e361c1aa53

SHA256
47a91b904e8bcc11b923a0dc6f929ee7f0485999edd2b96987f2fafd2c3e5f97

SHA512
ca77d0d2df1556914913db4804c66373495f52da61e5e051c4a0f8fbb6c1713fc210c20552dcbce4c1870d94cee9290087e92bdae1875cbbc02162f4052d93c4

Download Submit
C:\Windows\SysWOW64\narfwhma\laeiylcc.exe

Filesize
2.5MB

MD5
f665bfc55d516f4fedb437a9442d59d7

SHA1
49ef0118c2d7c40abd10b0268c9a52b658a6e34f

SHA256
670eeddfe3f17a268072a769f21119f992b377624f446382f88b1ef0fef279d3

SHA512
3de8720e279e981d4789e5d8696465b7542b6b6e4beed9a6d47ba2d82bdac2b4721ede0aa9fe47a8648dc04dd9047a9434ead987eb559f4bbf952fec94373e2f

Download Submit
memory/1932-1-0x0000000000D50000-0x0000000000E50000-memory.dmp

Filesize
1024KB

Download
memory/1932-3-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download
memory/1932-4-0x0000000000400000-0x0000000000C0A000-memory.dmp

Filesize
8.0MB

Download
memory/1932-7-0x0000000000400000-0x0000000000C0A000-memory.dmp

Filesize
8.0MB

Download
memory/2532-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2532-10-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2532-13-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2532-19-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2532-20-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2532-21-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2584-9-0x0000000000D20000-0x0000000000E20000-memory.dmp

Filesize
1024KB

Download
memory/2584-15-0x0000000000400000-0x0000000000C0A000-memory.dmp

Filesize
8.0MB

Download
memory/2584-17-0x0000000000400000-0x0000000000C0A000-memory.dmp

Filesize
8.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads