tofsee | 23922e5ee3a9ff743df4b5f29cb099c6e7ab41d64ffb4123b8a8fde439f5b012

General

Target

23922e5ee3a9ff743df4b5f29cb099c6e7ab41d64ffb4123b8a8fde439f5b012.exe
Size

12.1MB
MD5

db1af63eff5afab4bede9ffd3886b91a
SHA1

5030c06972023757b7d001fa12b02aadc07c3054
SHA256

23922e5ee3a9ff743df4b5f29cb099c6e7ab41d64ffb4123b8a8fde439f5b012
SHA512

97632ddd6e8efa10bfc648500fe39ac4f9650fc512a763b86a454a03c8512450dfef0156b925ee30ea30e5b617ac13810e3d8c90f4accfc9ccf9b9a99d88a62c
SSDEEP

196608:WT66666666666666666666666666666666666666666666666666666666666662:W

Score

10^/10

tofsee evasion execution persistence trojan

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\thgbwlim = "0"	svchost.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

2656 netsh.exe

pid	process
2656	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\thgbwlim\ImagePath = "C:\\Windows\\SysWOW64\\thgbwlim\\orksqsak.exe"	svchost.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

2552 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

orksqsak.exe

pid process

2528 orksqsak.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

orksqsak.exe

description pid process target process

PID 2528 set thread context of 2552 2528 orksqsak.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

2640 sc.exe
2608 sc.exe
2672 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2552	svchost.exe

pid	process
2528	orksqsak.exe

description	pid	process	target process
PID 2528 set thread context of 2552	2528	orksqsak.exe	svchost.exe

pid	process
2640	sc.exe
2608	sc.exe
2672	sc.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

23922e5ee3a9ff743df4b5f29cb099c6e7ab41d64ffb4123b8a8fde439f5b012.exeorksqsak.exe

description	pid	process	target process
PID 1988 wrote to memory of 2328	1988	23922e5ee3a9ff743df4b5f29cb099c6e7ab41d64ffb4123b8a8fde439f5b012.exe	cmd.exe
PID 1988 wrote to memory of 2328	1988	23922e5ee3a9ff743df4b5f29cb099c6e7ab41d64ffb4123b8a8fde439f5b012.exe	cmd.exe
PID 1988 wrote to memory of 2328	1988	23922e5ee3a9ff743df4b5f29cb099c6e7ab41d64ffb4123b8a8fde439f5b012.exe	cmd.exe
PID 1988 wrote to memory of 2328	1988	23922e5ee3a9ff743df4b5f29cb099c6e7ab41d64ffb4123b8a8fde439f5b012.exe	cmd.exe
PID 1988 wrote to memory of 2620	1988	23922e5ee3a9ff743df4b5f29cb099c6e7ab41d64ffb4123b8a8fde439f5b012.exe	cmd.exe
PID 1988 wrote to memory of 2620	1988	23922e5ee3a9ff743df4b5f29cb099c6e7ab41d64ffb4123b8a8fde439f5b012.exe	cmd.exe
PID 1988 wrote to memory of 2620	1988	23922e5ee3a9ff743df4b5f29cb099c6e7ab41d64ffb4123b8a8fde439f5b012.exe	cmd.exe
PID 1988 wrote to memory of 2620	1988	23922e5ee3a9ff743df4b5f29cb099c6e7ab41d64ffb4123b8a8fde439f5b012.exe	cmd.exe
PID 1988 wrote to memory of 2640	1988	23922e5ee3a9ff743df4b5f29cb099c6e7ab41d64ffb4123b8a8fde439f5b012.exe	sc.exe
PID 1988 wrote to memory of 2640	1988	23922e5ee3a9ff743df4b5f29cb099c6e7ab41d64ffb4123b8a8fde439f5b012.exe	sc.exe
PID 1988 wrote to memory of 2640	1988	23922e5ee3a9ff743df4b5f29cb099c6e7ab41d64ffb4123b8a8fde439f5b012.exe	sc.exe
PID 1988 wrote to memory of 2640	1988	23922e5ee3a9ff743df4b5f29cb099c6e7ab41d64ffb4123b8a8fde439f5b012.exe	sc.exe
PID 1988 wrote to memory of 2608	1988	23922e5ee3a9ff743df4b5f29cb099c6e7ab41d64ffb4123b8a8fde439f5b012.exe	sc.exe
PID 1988 wrote to memory of 2608	1988	23922e5ee3a9ff743df4b5f29cb099c6e7ab41d64ffb4123b8a8fde439f5b012.exe	sc.exe
PID 1988 wrote to memory of 2608	1988	23922e5ee3a9ff743df4b5f29cb099c6e7ab41d64ffb4123b8a8fde439f5b012.exe	sc.exe
PID 1988 wrote to memory of 2608	1988	23922e5ee3a9ff743df4b5f29cb099c6e7ab41d64ffb4123b8a8fde439f5b012.exe	sc.exe
PID 1988 wrote to memory of 2672	1988	23922e5ee3a9ff743df4b5f29cb099c6e7ab41d64ffb4123b8a8fde439f5b012.exe	sc.exe
PID 1988 wrote to memory of 2672	1988	23922e5ee3a9ff743df4b5f29cb099c6e7ab41d64ffb4123b8a8fde439f5b012.exe	sc.exe
PID 1988 wrote to memory of 2672	1988	23922e5ee3a9ff743df4b5f29cb099c6e7ab41d64ffb4123b8a8fde439f5b012.exe	sc.exe
PID 1988 wrote to memory of 2672	1988	23922e5ee3a9ff743df4b5f29cb099c6e7ab41d64ffb4123b8a8fde439f5b012.exe	sc.exe
PID 1988 wrote to memory of 2656	1988	23922e5ee3a9ff743df4b5f29cb099c6e7ab41d64ffb4123b8a8fde439f5b012.exe	netsh.exe
PID 1988 wrote to memory of 2656	1988	23922e5ee3a9ff743df4b5f29cb099c6e7ab41d64ffb4123b8a8fde439f5b012.exe	netsh.exe
PID 1988 wrote to memory of 2656	1988	23922e5ee3a9ff743df4b5f29cb099c6e7ab41d64ffb4123b8a8fde439f5b012.exe	netsh.exe
PID 1988 wrote to memory of 2656	1988	23922e5ee3a9ff743df4b5f29cb099c6e7ab41d64ffb4123b8a8fde439f5b012.exe	netsh.exe
PID 2528 wrote to memory of 2552	2528	orksqsak.exe	svchost.exe
PID 2528 wrote to memory of 2552	2528	orksqsak.exe	svchost.exe
PID 2528 wrote to memory of 2552	2528	orksqsak.exe	svchost.exe
PID 2528 wrote to memory of 2552	2528	orksqsak.exe	svchost.exe
PID 2528 wrote to memory of 2552	2528	orksqsak.exe	svchost.exe
PID 2528 wrote to memory of 2552	2528	orksqsak.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\23922e5ee3a9ff743df4b5f29cb099c6e7ab41d64ffb4123b8a8fde439f5b012.exe
"C:\Users\Admin\AppData\Local\Temp\23922e5ee3a9ff743df4b5f29cb099c6e7ab41d64ffb4123b8a8fde439f5b012.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1988

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\thgbwlim\
2⤵
PID:2328

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\orksqsak.exe" C:\Windows\SysWOW64\thgbwlim\
2⤵
PID:2620

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create thgbwlim binPath= "C:\Windows\SysWOW64\thgbwlim\orksqsak.exe /d\"C:\Users\Admin\AppData\Local\Temp\23922e5ee3a9ff743df4b5f29cb099c6e7ab41d64ffb4123b8a8fde439f5b012.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:2640

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description thgbwlim "wifi internet conection"
2⤵
- Launches sc.exe
PID:2608

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start thgbwlim
2⤵
- Launches sc.exe
PID:2672

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:2656

C:\Windows\SysWOW64\thgbwlim\orksqsak.exe
C:\Windows\SysWOW64\thgbwlim\orksqsak.exe /d"C:\Users\Admin\AppData\Local\Temp\23922e5ee3a9ff743df4b5f29cb099c6e7ab41d64ffb4123b8a8fde439f5b012.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2528

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
PID:2552

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

1

T1562.001

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\orksqsak.exe
Filesize
11.2MB

MD5
8242e556652b8e227b2259a3474757fc

SHA1
f63b8d2e3932b4013e15139d01eaa3e013f81b05

SHA256
5bb5ecaaad2a7c956fccfba0f39171f9498c929b805c44e21dcea701cd9f9046

SHA512
106e274f08f9d702dc54df27ea5893114f518ff2360da2da236c76157c7d28b650000fb8bba9e3d8571d546abfc36793f3ef932c7437a475a7fb0a71d5cb5938

Download Submit
memory/1988-9-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download
memory/1988-1-0x00000000009C0000-0x0000000000AC0000-memory.dmp

Filesize
1024KB

Download
memory/1988-3-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1988-8-0x0000000000400000-0x000000000086F000-memory.dmp

Filesize
4.4MB

Download
memory/1988-10-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1988-2-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download
memory/2528-15-0x0000000000400000-0x000000000086F000-memory.dmp

Filesize
4.4MB

Download
memory/2552-11-0x00000000000A0000-0x00000000000B5000-memory.dmp

Filesize
84KB

Download
memory/2552-14-0x00000000000A0000-0x00000000000B5000-memory.dmp

Filesize
84KB

Download
memory/2552-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2552-17-0x00000000000A0000-0x00000000000B5000-memory.dmp

Filesize
84KB

Download
memory/2552-18-0x00000000000A0000-0x00000000000B5000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads