tofsee | 4cdabd75e610ba709a80cdf6ae7e4b7e170e0522e1c8b32066ac8e917697c128

Analysis

max time kernel
146s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 03:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e0a9ef38f65d7d2f909db84733c0e66c.exe
Size 13.8MB
Sample240327-d43qgaeg21
SHA256 4cdabd75e610ba709a80cdf6ae7e4b7e170e0522e1c8b32066ac8e917697c128
MD5 e0a9ef38f65d7d2f909db84733c0e66c
SHA1 66bbd23caa023a99c3c0b44dd1af1d03a919ca54
SHA512 2be8f23e7a6f9dbd176174a56111b46113d29ae4ed9f8c746440f468644b9d45718ed0263f2b16896a8a7b458daf1ec0323f63100f4d4c05c3c8b7a9adb5a90d
SSDEEP 49152:q66666666666666666666666666666666666666666666666666666666666666j:
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

43.231.4.6
lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2652	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\uqeigqts\ImagePath = "C:\\Windows\\SysWOW64\\uqeigqts\\nkctpgca.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	e0a9ef38f65d7d2f909db84733c0e66c.exe

Deletes itself 1 IoCs

pid	Process
2672	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
3504	nkctpgca.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3504 set thread context of 2672	3504	nkctpgca.exe	121

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
344	sc.exe
4484	sc.exe
4552	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2380	4976	WerFault.exe	95
2504	3504	WerFault.exe	114

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 3880	4976	e0a9ef38f65d7d2f909db84733c0e66c.exe	103
PID 4976 wrote to memory of 3880	4976	e0a9ef38f65d7d2f909db84733c0e66c.exe	103
PID 4976 wrote to memory of 3880	4976	e0a9ef38f65d7d2f909db84733c0e66c.exe	103
PID 4976 wrote to memory of 3828	4976	e0a9ef38f65d7d2f909db84733c0e66c.exe	105
PID 4976 wrote to memory of 3828	4976	e0a9ef38f65d7d2f909db84733c0e66c.exe	105
PID 4976 wrote to memory of 3828	4976	e0a9ef38f65d7d2f909db84733c0e66c.exe	105
PID 4976 wrote to memory of 344	4976	e0a9ef38f65d7d2f909db84733c0e66c.exe	107
PID 4976 wrote to memory of 344	4976	e0a9ef38f65d7d2f909db84733c0e66c.exe	107
PID 4976 wrote to memory of 344	4976	e0a9ef38f65d7d2f909db84733c0e66c.exe	107
PID 4976 wrote to memory of 4484	4976	e0a9ef38f65d7d2f909db84733c0e66c.exe	109
PID 4976 wrote to memory of 4484	4976	e0a9ef38f65d7d2f909db84733c0e66c.exe	109
PID 4976 wrote to memory of 4484	4976	e0a9ef38f65d7d2f909db84733c0e66c.exe	109
PID 4976 wrote to memory of 4552	4976	e0a9ef38f65d7d2f909db84733c0e66c.exe	111
PID 4976 wrote to memory of 4552	4976	e0a9ef38f65d7d2f909db84733c0e66c.exe	111
PID 4976 wrote to memory of 4552	4976	e0a9ef38f65d7d2f909db84733c0e66c.exe	111
PID 4976 wrote to memory of 2652	4976	e0a9ef38f65d7d2f909db84733c0e66c.exe	115
PID 4976 wrote to memory of 2652	4976	e0a9ef38f65d7d2f909db84733c0e66c.exe	115
PID 4976 wrote to memory of 2652	4976	e0a9ef38f65d7d2f909db84733c0e66c.exe	115
PID 3504 wrote to memory of 2672	3504	nkctpgca.exe	121
PID 3504 wrote to memory of 2672	3504	nkctpgca.exe	121
PID 3504 wrote to memory of 2672	3504	nkctpgca.exe	121
PID 3504 wrote to memory of 2672	3504	nkctpgca.exe	121
PID 3504 wrote to memory of 2672	3504	nkctpgca.exe	121

C:\Users\Admin\AppData\Local\Temp\e0a9ef38f65d7d2f909db84733c0e66c.exe
"C:\Users\Admin\AppData\Local\Temp\e0a9ef38f65d7d2f909db84733c0e66c.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\uqeigqts\
  2⤵
  PID:3880
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\nkctpgca.exe" C:\Windows\SysWOW64\uqeigqts\
  2⤵
  PID:3828
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create uqeigqts binPath= "C:\Windows\SysWOW64\uqeigqts\nkctpgca.exe /d\"C:\Users\Admin\AppData\Local\Temp\e0a9ef38f65d7d2f909db84733c0e66c.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:344
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description uqeigqts "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:4484
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start uqeigqts
  2⤵
  - Launches sc.exe
  PID:4552
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:2652
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4976 -s 892
  2⤵
  - Program crash
  PID:2380

C:\Windows\SysWOW64\uqeigqts\nkctpgca.exe
C:\Windows\SysWOW64\uqeigqts\nkctpgca.exe /d"C:\Users\Admin\AppData\Local\Temp\e0a9ef38f65d7d2f909db84733c0e66c.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  PID:2672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 516
  2⤵
  - Program crash
  PID:2504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4976 -ip 4976
1⤵
PID:3516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3504 -ip 3504
1⤵
PID:4436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1332 --field-trial-handle=2268,i,8796662530135712346,11409037572378858775,262144 --variations-seed-version /prefetch:8
1⤵
PID:5076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nkctpgca.exe

Path C:\Users\Admin\AppData\Local\Temp\nkctpgca.exe
Size 12.6MB
SHA256 dc338829c3e36d4d8f52cea9d48bd3f7263d4ce6214db18f333faaad89bbffa0
MD5 e5d3dd04b5ae8e7d1b3b95f814fffb77
SHA1 10a6ff63dc29d55b0185fdd42365fca025d9f037
SHA512 8dd22c061c354ec44ff633798433b5b45926d6d7ef14ed68ef6c174692f3377bf7d9c599cebab277ccf27e003bae0ddbd9a25a9c87b6f97a6362ec59dac6b95d
SSDEEP 49152:I66666666666666666666666666666666666666666666666666666666666666y:
MD5 SHA1 SHA512 SSDEEP

Submit Download

nkctpgca.exe

Path C:\Windows\SysWOW64\uqeigqts\nkctpgca.exe
Size 12.0MB
SHA256 173b4f4eff4800ead3df294b93be5140bd15c838c61104f481d96e94b149e868
MD5 1beab6da05d7d81c068fbdcd65b473c9
SHA1 b0d31c30ebd024b897b1a20f5a114386a067d456
SHA512 610e62cab11f4391284d933bcd7651a7fbbdca6b21b82dcdb7ef701441c8e67726529a71e0d22c35af3baf4d4d54b702660c67bcb142ba30b302dd9c143943b8
SSDEEP 49152:I66666666666666666666666666666666666666666666666666666666666666K:
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2672-11-0x0000000000FE0000-0x0000000000FF5000-memory.dmp

Download

memory/2672-16-0x0000000000FE0000-0x0000000000FF5000-memory.dmp

Download

memory/2672-17-0x0000000000FE0000-0x0000000000FF5000-memory.dmp

Download

memory/2672-19-0x0000000000FE0000-0x0000000000FF5000-memory.dmp

Download

memory/3504-10-0x0000000000E50000-0x0000000000F50000-memory.dmp

Download

memory/3504-12-0x0000000000400000-0x0000000000C0A000-memory.dmp

Download

memory/3504-18-0x0000000000400000-0x0000000000C0A000-memory.dmp

Download

memory/4976-4-0x0000000000400000-0x0000000000C0A000-memory.dmp

Download

memory/4976-2-0x0000000000D60000-0x0000000000D73000-memory.dmp

Download

memory/4976-7-0x0000000000400000-0x0000000000C0A000-memory.dmp

Download

memory/4976-8-0x0000000000D60000-0x0000000000D73000-memory.dmp

Download

memory/4976-1-0x0000000000F80000-0x0000000001080000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads