tofsee | ca42af334909a2296e1a3ef8707988abba34633858c1b5613b3d6354e66eb0db

Analysis

max time kernel
152s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21/03/2024, 04:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
daad6bbfc12991b5f327755123cb4b48.exe
Size 11.7MB
Sample240321-eyshzsbf85
SHA256 ca42af334909a2296e1a3ef8707988abba34633858c1b5613b3d6354e66eb0db
MD5 daad6bbfc12991b5f327755123cb4b48
SHA1 da32a326b2a616b1ead71b2b804ac5c2af70aa81
SHA512 1a197f619d8fbc8ce21f93400fbed79e9f50d37751e734c7fd1d52d7d1005307b384ff3ff6f92c933953c393adf1a490b5c103fe128c717f0b213efe0b50c5c2
SSDEEP 24576:+gdy5yNM4444444444444444444444444444444444444444444444444444444s:
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

defeatwax.ru
refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4432	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\zxgccpsy\ImagePath = "C:\\Windows\\SysWOW64\\zxgccpsy\\naayxyll.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	daad6bbfc12991b5f327755123cb4b48.exe

Deletes itself 1 IoCs

pid	Process
2308	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
3944	naayxyll.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3944 set thread context of 2308	3944	naayxyll.exe	116

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2128	sc.exe
4112	sc.exe
1008	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3276	5072	WerFault.exe	94
4312	3944	WerFault.exe	113

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 4588	5072	daad6bbfc12991b5f327755123cb4b48.exe	101
PID 5072 wrote to memory of 4588	5072	daad6bbfc12991b5f327755123cb4b48.exe	101
PID 5072 wrote to memory of 4588	5072	daad6bbfc12991b5f327755123cb4b48.exe	101
PID 5072 wrote to memory of 4916	5072	daad6bbfc12991b5f327755123cb4b48.exe	103
PID 5072 wrote to memory of 4916	5072	daad6bbfc12991b5f327755123cb4b48.exe	103
PID 5072 wrote to memory of 4916	5072	daad6bbfc12991b5f327755123cb4b48.exe	103
PID 5072 wrote to memory of 2128	5072	daad6bbfc12991b5f327755123cb4b48.exe	105
PID 5072 wrote to memory of 2128	5072	daad6bbfc12991b5f327755123cb4b48.exe	105
PID 5072 wrote to memory of 2128	5072	daad6bbfc12991b5f327755123cb4b48.exe	105
PID 5072 wrote to memory of 4112	5072	daad6bbfc12991b5f327755123cb4b48.exe	107
PID 5072 wrote to memory of 4112	5072	daad6bbfc12991b5f327755123cb4b48.exe	107
PID 5072 wrote to memory of 4112	5072	daad6bbfc12991b5f327755123cb4b48.exe	107
PID 5072 wrote to memory of 1008	5072	daad6bbfc12991b5f327755123cb4b48.exe	109
PID 5072 wrote to memory of 1008	5072	daad6bbfc12991b5f327755123cb4b48.exe	109
PID 5072 wrote to memory of 1008	5072	daad6bbfc12991b5f327755123cb4b48.exe	109
PID 5072 wrote to memory of 4432	5072	daad6bbfc12991b5f327755123cb4b48.exe	111
PID 5072 wrote to memory of 4432	5072	daad6bbfc12991b5f327755123cb4b48.exe	111
PID 5072 wrote to memory of 4432	5072	daad6bbfc12991b5f327755123cb4b48.exe	111
PID 3944 wrote to memory of 2308	3944	naayxyll.exe	116
PID 3944 wrote to memory of 2308	3944	naayxyll.exe	116
PID 3944 wrote to memory of 2308	3944	naayxyll.exe	116
PID 3944 wrote to memory of 2308	3944	naayxyll.exe	116
PID 3944 wrote to memory of 2308	3944	naayxyll.exe	116

C:\Users\Admin\AppData\Local\Temp\daad6bbfc12991b5f327755123cb4b48.exe
"C:\Users\Admin\AppData\Local\Temp\daad6bbfc12991b5f327755123cb4b48.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\zxgccpsy\
  2⤵
  PID:4588
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\naayxyll.exe" C:\Windows\SysWOW64\zxgccpsy\
  2⤵
  PID:4916
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create zxgccpsy binPath= "C:\Windows\SysWOW64\zxgccpsy\naayxyll.exe /d\"C:\Users\Admin\AppData\Local\Temp\daad6bbfc12991b5f327755123cb4b48.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:2128
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description zxgccpsy "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:4112
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start zxgccpsy
  2⤵
  - Launches sc.exe
  PID:1008
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:4432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 1228
  2⤵
  - Program crash
  PID:3276

C:\Windows\SysWOW64\zxgccpsy\naayxyll.exe
C:\Windows\SysWOW64\zxgccpsy\naayxyll.exe /d"C:\Users\Admin\AppData\Local\Temp\daad6bbfc12991b5f327755123cb4b48.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  PID:2308
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 508
  2⤵
  - Program crash
  PID:4312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5072 -ip 5072
1⤵
PID:1872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3944 -ip 3944
1⤵
PID:1680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4032 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

naayxyll.exe

Path C:\Users\Admin\AppData\Local\Temp\naayxyll.exe
Size 6.4MB
SHA256 295dcb007ee06cabe719ae6b512d934b1b3431d93e678d80762fd8ccf2db7729
MD5 3d4498cc2beb9ac287bb4d18a2b32efa
SHA1 b4ef9ba35a13b2a02f90fc7b6afd35f5d28ea0c7
SHA512 ffc53c3d5b913f9d31487f495ce079414c6c38b48257a21721a0247fec6acb5c20ca6c4d5ce8b893496854d33b4624266ee33c2739601c527d5f10f72c353af7
SSDEEP 24576:Ugdy5yNM4444444444444444444444444444444444444444444444444444444I:
MD5 SHA1 SHA512 SSDEEP

Submit Download

naayxyll.exe

Path C:\Windows\SysWOW64\zxgccpsy\naayxyll.exe
Size 10.3MB
SHA256 a00a93f7a854ce260d91ecc0f583640bbb15cc6950cac1f9895b04d4e89c2107
MD5 cc6220d8ad1eb4db70c6eca03acc16b8
SHA1 4a6d0a5001d565e9792ba60098d9e3d0fa7221a1
SHA512 25114af25545d27cfd5cf770b4f15befd7a06e084027d899eabbaa9ad34cf42425e38676568aaf463c7ee449ba9097142d90ec2ecbfe9ac68109a556846583cd
SSDEEP 24576:Ugdy5yNM44444444444444444444444444444444444444444444444444444443:
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2308-13-0x0000000000550000-0x0000000000565000-memory.dmp

Download

memory/2308-20-0x0000000000550000-0x0000000000565000-memory.dmp

Download

memory/2308-19-0x0000000000550000-0x0000000000565000-memory.dmp

Download

memory/2308-17-0x0000000000550000-0x0000000000565000-memory.dmp

Download

memory/2308-16-0x0000000000550000-0x0000000000565000-memory.dmp

Download

memory/3944-11-0x00000000006A0000-0x00000000007A0000-memory.dmp

Download

memory/3944-12-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/3944-18-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/5072-1-0x0000000000520000-0x0000000000620000-memory.dmp

Download

memory/5072-10-0x00000000021A0000-0x00000000021B3000-memory.dmp

Download

memory/5072-9-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/5072-6-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/5072-3-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/5072-2-0x00000000021A0000-0x00000000021B3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads