tofsee | 5072aed2aa1d122cb0f2bd9b6c125cef7af9fae193ac2c3ae4596662b8a72533

General

Target
d9bdebd7d855fa4cbdd284a006008485.exe
Size 14.8MB
Sample240320-y5966aba91
SHA256 5072aed2aa1d122cb0f2bd9b6c125cef7af9fae193ac2c3ae4596662b8a72533
MD5 d9bdebd7d855fa4cbdd284a006008485
SHA1 2bf3307df57cf98045db0491253470d8052d307e
SHA512 185c969e0ff9fb9ce73fc6e240ef73dc6ef812def435d06b03fe116fe1624e13d812a4de69a66957a7cd63c4a3ce2c0fb7282e3ad0eabefa6804344993e0c051
SSDEEP 6144:r5VCb4QuzF+pIozzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz7:d8NKF+p
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7
lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1800	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\uuqdkujo\ImagePath = "C:\\Windows\\SysWOW64\\uuqdkujo\\yavmdxex.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	d9bdebd7d855fa4cbdd284a006008485.exe

Deletes itself 1 IoCs

pid	Process
1824	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
4424	yavmdxex.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4424 set thread context of 1824	4424	yavmdxex.exe	104

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1760	sc.exe
4376	sc.exe
224	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 1088	1660	d9bdebd7d855fa4cbdd284a006008485.exe	90
PID 1660 wrote to memory of 1088	1660	d9bdebd7d855fa4cbdd284a006008485.exe	90
PID 1660 wrote to memory of 1088	1660	d9bdebd7d855fa4cbdd284a006008485.exe	90
PID 1660 wrote to memory of 3528	1660	d9bdebd7d855fa4cbdd284a006008485.exe	94
PID 1660 wrote to memory of 3528	1660	d9bdebd7d855fa4cbdd284a006008485.exe	94
PID 1660 wrote to memory of 3528	1660	d9bdebd7d855fa4cbdd284a006008485.exe	94
PID 1660 wrote to memory of 1760	1660	d9bdebd7d855fa4cbdd284a006008485.exe	96
PID 1660 wrote to memory of 1760	1660	d9bdebd7d855fa4cbdd284a006008485.exe	96
PID 1660 wrote to memory of 1760	1660	d9bdebd7d855fa4cbdd284a006008485.exe	96
PID 1660 wrote to memory of 4376	1660	d9bdebd7d855fa4cbdd284a006008485.exe	99
PID 1660 wrote to memory of 4376	1660	d9bdebd7d855fa4cbdd284a006008485.exe	99
PID 1660 wrote to memory of 4376	1660	d9bdebd7d855fa4cbdd284a006008485.exe	99
PID 1660 wrote to memory of 224	1660	d9bdebd7d855fa4cbdd284a006008485.exe	101
PID 1660 wrote to memory of 224	1660	d9bdebd7d855fa4cbdd284a006008485.exe	101
PID 1660 wrote to memory of 224	1660	d9bdebd7d855fa4cbdd284a006008485.exe	101
PID 4424 wrote to memory of 1824	4424	yavmdxex.exe	104
PID 4424 wrote to memory of 1824	4424	yavmdxex.exe	104
PID 4424 wrote to memory of 1824	4424	yavmdxex.exe	104
PID 4424 wrote to memory of 1824	4424	yavmdxex.exe	104
PID 4424 wrote to memory of 1824	4424	yavmdxex.exe	104
PID 1660 wrote to memory of 1800	1660	d9bdebd7d855fa4cbdd284a006008485.exe	105
PID 1660 wrote to memory of 1800	1660	d9bdebd7d855fa4cbdd284a006008485.exe	105
PID 1660 wrote to memory of 1800	1660	d9bdebd7d855fa4cbdd284a006008485.exe	105

C:\Users\Admin\AppData\Local\Temp\d9bdebd7d855fa4cbdd284a006008485.exe
"C:\Users\Admin\AppData\Local\Temp\d9bdebd7d855fa4cbdd284a006008485.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\uuqdkujo\
  2⤵
  PID:1088
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\yavmdxex.exe" C:\Windows\SysWOW64\uuqdkujo\
  2⤵
  PID:3528
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create uuqdkujo binPath= "C:\Windows\SysWOW64\uuqdkujo\yavmdxex.exe /d\"C:\Users\Admin\AppData\Local\Temp\d9bdebd7d855fa4cbdd284a006008485.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:1760
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description uuqdkujo "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:4376
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start uuqdkujo
  2⤵
  - Launches sc.exe
  PID:224
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:1800

C:\Windows\SysWOW64\uuqdkujo\yavmdxex.exe
C:\Windows\SysWOW64\uuqdkujo\yavmdxex.exe /d"C:\Users\Admin\AppData\Local\Temp\d9bdebd7d855fa4cbdd284a006008485.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  PID:1824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

yavmdxex.exe

Path C:\Users\Admin\AppData\Local\Temp\yavmdxex.exe
Size 4.5MB
SHA256 e9b4bc2770973812df99b9a1402fe014cc5f273056c01ff5a6f07d75acee818b
MD5 fbb9d6d8a7ce17f582fd11719a23bf4b
SHA1 34c9a7f0c6bae5e37d01c89488a38010baaf6ae4
SHA512 799e995b00271f559bd846240fecf221ac4cf9ab44c49fea77ad64565e2e7718dc746e85f43a26f4c684f5d1383dfba87166bede3bd22ce57e9e585b31cc0093
SSDEEP 6144:W5VCb4QuzF+pIozzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzq:A8NKF+pG
MD5 SHA1 SHA512 SSDEEP

Submit Download

yavmdxex.exe

Path C:\Windows\SysWOW64\uuqdkujo\yavmdxex.exe
Size 8.3MB
SHA256 83c13ce4e7ee70a8fee905a49fd3a85380a888956fc2f40d01a7084cccbdfaee
MD5 c9a4e362e5a5f3bed0ea97a7ca2acd58
SHA1 e7540340effc0d64eb4c4d84bc041adcc4521b50
SHA512 49b87ce57286c9441e47bfa64fb9f1d817acaccc5d924ad01b28ffc0646cdd46ea13c164581335d7f7fbd822804f98f7f1b9edae2d313bb4ae98b97f692c9aee
SSDEEP 6144:W5VCb4QuzF+pIozzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzP:A8NKF+pz
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1824-3-0x0000000000980000-0x0000000000995000-memory.dmp

Download

memory/1824-6-0x0000000000980000-0x0000000000995000-memory.dmp

Download

memory/1824-7-0x0000000000980000-0x0000000000995000-memory.dmp

Download

memory/1824-8-0x0000000000980000-0x0000000000995000-memory.dmp

Download

memory/1824-9-0x0000000000980000-0x0000000000995000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads