Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/03/2024, 08:50

General

  • Target

    dec340af99d11d4bda18bafe03b2172f.exe

  • Size

    14.9MB

  • MD5

    dec340af99d11d4bda18bafe03b2172f

  • SHA1

    08712f078b5470ee9a7398c8662af4269b749da3

  • SHA256

    7d34075aebc551801edcf950ad816a5f277522f2d6b53679e7bd2921d89e0c4f

  • SHA512

    4125d79a9a9f1288e8fdaf5477c47f0c6ef8c522ae639842b334847a7ed1668126ee0ff8eae59dac20808e6b64959027bb6bb811d10f2cfb43c551374bf07a1d

  • SSDEEP

    49152:2yqI2kmso555555555555555555555555555555555555555555555555555555t:2yqI2

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Creates new service(s) 1 TTPs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dec340af99d11d4bda18bafe03b2172f.exe
    "C:\Users\Admin\AppData\Local\Temp\dec340af99d11d4bda18bafe03b2172f.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3424
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\sliiqbqf\
      2⤵
        PID:1260
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\gidjcpz.exe" C:\Windows\SysWOW64\sliiqbqf\
        2⤵
          PID:2212
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create sliiqbqf binPath= "C:\Windows\SysWOW64\sliiqbqf\gidjcpz.exe /d\"C:\Users\Admin\AppData\Local\Temp\dec340af99d11d4bda18bafe03b2172f.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:4460
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description sliiqbqf "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:1040
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start sliiqbqf
          2⤵
          • Launches sc.exe
          PID:2808
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:3184
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 1028
          2⤵
          • Program crash
          PID:1772
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3424 -ip 3424
        1⤵
          PID:1132
        • C:\Windows\SysWOW64\sliiqbqf\gidjcpz.exe
          C:\Windows\SysWOW64\sliiqbqf\gidjcpz.exe /d"C:\Users\Admin\AppData\Local\Temp\dec340af99d11d4bda18bafe03b2172f.exe"
          1⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:404
          • C:\Windows\SysWOW64\svchost.exe
            svchost.exe
            2⤵
            • Sets service image path in registry
            • Deletes itself
            PID:3004
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 404 -s 548
            2⤵
            • Program crash
            PID:2112
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 404 -ip 404
          1⤵
            PID:3440

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\gidjcpz.exe

            Filesize

            12.8MB

            MD5

            22f23142479b4e750945ff4abd484247

            SHA1

            9c68c0d91479c78fb64b76d00f78bea9e7781d24

            SHA256

            69b75925d4341bdae1482039d30c43a1be1631c207d000e19930b45f4dc83ba7

            SHA512

            05603cc0cd211c96e2773b93d6a381c33f19eb7ac3adb6b12111a930312875b111f7b5458fcdf64767d3c937f70b376144e3cb1acafbb33e24bf482a8f76d438

          • C:\Windows\SysWOW64\sliiqbqf\gidjcpz.exe

            Filesize

            6.3MB

            MD5

            7fa11de4bcbc3ed6c566df1725ffa250

            SHA1

            7714a1781036d7a0d110d81116282b57d2e937cc

            SHA256

            bcca1faee7403e0934bdb8dde9465755f1324d11fc03316da0a8198ff9174685

            SHA512

            16052bd3fe3dd83a055d594e2ea6ec6aff059b6197c336a2b6cd8bb0ba2fdcb7aa5d736bcba0c3d5472f1f1d5cc741ba22cdc55c84e70f98cea48b5145861dfa

          • memory/404-10-0x0000000000570000-0x0000000000670000-memory.dmp

            Filesize

            1024KB

          • memory/404-17-0x0000000000400000-0x000000000046E000-memory.dmp

            Filesize

            440KB

          • memory/404-11-0x0000000000400000-0x000000000046E000-memory.dmp

            Filesize

            440KB

          • memory/3004-12-0x00000000010C0000-0x00000000010D5000-memory.dmp

            Filesize

            84KB

          • memory/3004-16-0x00000000010C0000-0x00000000010D5000-memory.dmp

            Filesize

            84KB

          • memory/3004-18-0x00000000010C0000-0x00000000010D5000-memory.dmp

            Filesize

            84KB

          • memory/3004-19-0x00000000010C0000-0x00000000010D5000-memory.dmp

            Filesize

            84KB

          • memory/3424-8-0x00000000021B0000-0x00000000021C3000-memory.dmp

            Filesize

            76KB

          • memory/3424-7-0x0000000000400000-0x000000000046E000-memory.dmp

            Filesize

            440KB

          • memory/3424-3-0x0000000000400000-0x000000000046E000-memory.dmp

            Filesize

            440KB

          • memory/3424-1-0x00000000006B0000-0x00000000007B0000-memory.dmp

            Filesize

            1024KB

          • memory/3424-2-0x00000000021B0000-0x00000000021C3000-memory.dmp

            Filesize

            76KB