Analysis

  • max time kernel
    147s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/03/2024, 11:38

General

  • Target

    ddeb056ae1107f54f787111be1f88041.exe

  • Size

    12.1MB

  • MD5

    ddeb056ae1107f54f787111be1f88041

  • SHA1

    e423feb2f9ab5312ccc4a4ab6cee6997f1c86c03

  • SHA256

    0679a918d7d020d9487e309fbcf8e55c997f405530f92256b6de7d3ae27eb0b7

  • SHA512

    d4ddc7fc8df98e218a483b231bf7a57d58a10718381b6d6c4af9a27bd7967874cc2fcba8ef5a8621efcc72e78bc1ca3a4b496ba0db896c9ecc178ac4a9cd0ed6

  • SSDEEP

    24576:Igdy5yNM4444444444444444444444444444444444444444444444444444444v:

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Creates new service(s) 1 TTPs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe
    "C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2672
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\hzhyimee\
      2⤵
        PID:2556
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\gbqafkca.exe" C:\Windows\SysWOW64\hzhyimee\
        2⤵
          PID:4476
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create hzhyimee binPath= "C:\Windows\SysWOW64\hzhyimee\gbqafkca.exe /d\"C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:3836
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description hzhyimee "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:4228
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start hzhyimee
          2⤵
          • Launches sc.exe
          PID:3520
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:3088
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 1232
          2⤵
          • Program crash
          PID:2060
      • C:\Windows\SysWOW64\hzhyimee\gbqafkca.exe
        C:\Windows\SysWOW64\hzhyimee\gbqafkca.exe /d"C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3280
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          2⤵
          • Sets service image path in registry
          • Deletes itself
          PID:2308
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3280 -s 520
          2⤵
          • Program crash
          PID:3504
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2672 -ip 2672
        1⤵
          PID:4444
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3280 -ip 3280
          1⤵
            PID:3156

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\gbqafkca.exe

            Filesize

            14.7MB

            MD5

            5d1470caf0cf10f682be43586f909f62

            SHA1

            8b8e686d21ff3277ce86d9b5f9475eff108875ff

            SHA256

            39177e8c1255444d714f716028f324d346c3f9ce13e99554ef9a56a9094bdf58

            SHA512

            c265fee6d74bfaaacd05f790e2f6863362be0f112b2d6deb58803502500a536b5b6ef24b90b8d30732acb4f3f635c69d1ea38282d900d7422cf7b6f1c6e4d174

          • memory/2308-15-0x0000000001230000-0x0000000001245000-memory.dmp

            Filesize

            84KB

          • memory/2308-11-0x0000000001230000-0x0000000001245000-memory.dmp

            Filesize

            84KB

          • memory/2308-16-0x0000000001230000-0x0000000001245000-memory.dmp

            Filesize

            84KB

          • memory/2308-17-0x0000000001230000-0x0000000001245000-memory.dmp

            Filesize

            84KB

          • memory/2308-19-0x0000000001230000-0x0000000001245000-memory.dmp

            Filesize

            84KB

          • memory/2672-3-0x0000000000400000-0x0000000000456000-memory.dmp

            Filesize

            344KB

          • memory/2672-2-0x00000000005F0000-0x0000000000603000-memory.dmp

            Filesize

            76KB

          • memory/2672-8-0x0000000000400000-0x0000000000456000-memory.dmp

            Filesize

            344KB

          • memory/2672-9-0x00000000005F0000-0x0000000000603000-memory.dmp

            Filesize

            76KB

          • memory/2672-1-0x0000000000810000-0x0000000000910000-memory.dmp

            Filesize

            1024KB

          • memory/3280-10-0x00000000005D0000-0x00000000006D0000-memory.dmp

            Filesize

            1024KB

          • memory/3280-12-0x0000000000400000-0x0000000000456000-memory.dmp

            Filesize

            344KB

          • memory/3280-18-0x0000000000400000-0x0000000000456000-memory.dmp

            Filesize

            344KB