tofsee | a7009b6d109dfa0a473288b9e463064b04f86d9ea5726e1613cf089f5d89c786

General

Target

2024-06-24_eef64444ae02ed37da2826093fc05d4a_mafia.exe
Size

11.8MB
MD5

eef64444ae02ed37da2826093fc05d4a
SHA1

854da2256f622edbf673ca91cb3014d3d69763b1
SHA256

a7009b6d109dfa0a473288b9e463064b04f86d9ea5726e1613cf089f5d89c786
SHA512

1ebfff5d3fec92c940bb300cf18b951043463a08267d2087a83dc31f370c788e5a775ac31dc3c8c82e19aae9450ec9db22911dcf07e4329f78155dea6bfdb6aa
SSDEEP

6144:h+rWO2zeSPDjMXMH7Ll4aFpWVqIwUAP97GEwHrG2+e1x2:h+r1IeSXMXc7LlxWV4Ug97GZ+ej

Score

10^/10

tofsee evasion execution persistence privilege_escalation trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\hjcmxzxy = "0"	svchost.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

2220 netsh.exe

pid	process
2220	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\hjcmxzxy\ImagePath = "C:\\Windows\\SysWOW64\\hjcmxzxy\\divvyxns.exe"	svchost.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

1140 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

divvyxns.exe

pid process

2628 divvyxns.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

divvyxns.exe

description pid process target process

PID 2628 set thread context of 1140 2628 divvyxns.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

2600 sc.exe
2700 sc.exe
2944 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1140	svchost.exe

pid	process
2628	divvyxns.exe

description	pid	process	target process
PID 2628 set thread context of 1140	2628	divvyxns.exe	svchost.exe

pid	process
2600	sc.exe
2700	sc.exe
2944	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

2024-06-24_eef64444ae02ed37da2826093fc05d4a_mafia.exedivvyxns.exe

description	pid	process	target process
PID 1700 wrote to memory of 2428	1700	2024-06-24_eef64444ae02ed37da2826093fc05d4a_mafia.exe	cmd.exe
PID 1700 wrote to memory of 2428	1700	2024-06-24_eef64444ae02ed37da2826093fc05d4a_mafia.exe	cmd.exe
PID 1700 wrote to memory of 2428	1700	2024-06-24_eef64444ae02ed37da2826093fc05d4a_mafia.exe	cmd.exe
PID 1700 wrote to memory of 2428	1700	2024-06-24_eef64444ae02ed37da2826093fc05d4a_mafia.exe	cmd.exe
PID 1700 wrote to memory of 1932	1700	2024-06-24_eef64444ae02ed37da2826093fc05d4a_mafia.exe	cmd.exe
PID 1700 wrote to memory of 1932	1700	2024-06-24_eef64444ae02ed37da2826093fc05d4a_mafia.exe	cmd.exe
PID 1700 wrote to memory of 1932	1700	2024-06-24_eef64444ae02ed37da2826093fc05d4a_mafia.exe	cmd.exe
PID 1700 wrote to memory of 1932	1700	2024-06-24_eef64444ae02ed37da2826093fc05d4a_mafia.exe	cmd.exe
PID 1700 wrote to memory of 2600	1700	2024-06-24_eef64444ae02ed37da2826093fc05d4a_mafia.exe	sc.exe
PID 1700 wrote to memory of 2600	1700	2024-06-24_eef64444ae02ed37da2826093fc05d4a_mafia.exe	sc.exe
PID 1700 wrote to memory of 2600	1700	2024-06-24_eef64444ae02ed37da2826093fc05d4a_mafia.exe	sc.exe
PID 1700 wrote to memory of 2600	1700	2024-06-24_eef64444ae02ed37da2826093fc05d4a_mafia.exe	sc.exe
PID 1700 wrote to memory of 2700	1700	2024-06-24_eef64444ae02ed37da2826093fc05d4a_mafia.exe	sc.exe
PID 1700 wrote to memory of 2700	1700	2024-06-24_eef64444ae02ed37da2826093fc05d4a_mafia.exe	sc.exe
PID 1700 wrote to memory of 2700	1700	2024-06-24_eef64444ae02ed37da2826093fc05d4a_mafia.exe	sc.exe
PID 1700 wrote to memory of 2700	1700	2024-06-24_eef64444ae02ed37da2826093fc05d4a_mafia.exe	sc.exe
PID 1700 wrote to memory of 2944	1700	2024-06-24_eef64444ae02ed37da2826093fc05d4a_mafia.exe	sc.exe
PID 1700 wrote to memory of 2944	1700	2024-06-24_eef64444ae02ed37da2826093fc05d4a_mafia.exe	sc.exe
PID 1700 wrote to memory of 2944	1700	2024-06-24_eef64444ae02ed37da2826093fc05d4a_mafia.exe	sc.exe
PID 1700 wrote to memory of 2944	1700	2024-06-24_eef64444ae02ed37da2826093fc05d4a_mafia.exe	sc.exe
PID 2628 wrote to memory of 1140	2628	divvyxns.exe	svchost.exe
PID 2628 wrote to memory of 1140	2628	divvyxns.exe	svchost.exe
PID 2628 wrote to memory of 1140	2628	divvyxns.exe	svchost.exe
PID 2628 wrote to memory of 1140	2628	divvyxns.exe	svchost.exe
PID 2628 wrote to memory of 1140	2628	divvyxns.exe	svchost.exe
PID 2628 wrote to memory of 1140	2628	divvyxns.exe	svchost.exe
PID 1700 wrote to memory of 2220	1700	2024-06-24_eef64444ae02ed37da2826093fc05d4a_mafia.exe	netsh.exe
PID 1700 wrote to memory of 2220	1700	2024-06-24_eef64444ae02ed37da2826093fc05d4a_mafia.exe	netsh.exe
PID 1700 wrote to memory of 2220	1700	2024-06-24_eef64444ae02ed37da2826093fc05d4a_mafia.exe	netsh.exe
PID 1700 wrote to memory of 2220	1700	2024-06-24_eef64444ae02ed37da2826093fc05d4a_mafia.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\2024-06-24_eef64444ae02ed37da2826093fc05d4a_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-24_eef64444ae02ed37da2826093fc05d4a_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1700

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\hjcmxzxy\
2⤵
PID:2428

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\divvyxns.exe" C:\Windows\SysWOW64\hjcmxzxy\
2⤵
PID:1932

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create hjcmxzxy binPath= "C:\Windows\SysWOW64\hjcmxzxy\divvyxns.exe /d\"C:\Users\Admin\AppData\Local\Temp\2024-06-24_eef64444ae02ed37da2826093fc05d4a_mafia.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:2600

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description hjcmxzxy "wifi internet conection"
2⤵
- Launches sc.exe
PID:2700

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start hjcmxzxy
2⤵
- Launches sc.exe
PID:2944

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2220

C:\Windows\SysWOW64\hjcmxzxy\divvyxns.exe
C:\Windows\SysWOW64\hjcmxzxy\divvyxns.exe /d"C:\Users\Admin\AppData\Local\Temp\2024-06-24_eef64444ae02ed37da2826093fc05d4a_mafia.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2628

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
PID:1140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify System Firewall

1

T1562.004

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\divvyxns.exe
Filesize
11.8MB

MD5
60e4e3c438da9a700e5ae1d465191557

SHA1
28665866206611ff5ea38199c795ca1141ecdc45

SHA256
8b24ed3df6baac64dd6efe64450b576b408b89ffcf62b5bfd98564feb91544c1

SHA512
987aa44492c2ba99ffce3463db866af8fde0e5a7e96c6d19bd43c7d9846ad50d7899aa832eeab7ccb55fcdcf92e51a2a498f4c06ff82be71359ec7143f991037

Download Submit
memory/1140-10-0x0000000000100000-0x0000000000115000-memory.dmp

Filesize
84KB

Download
memory/1140-7-0x0000000000100000-0x0000000000115000-memory.dmp

Filesize
84KB

Download
memory/1140-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1140-15-0x0000000000100000-0x0000000000115000-memory.dmp

Filesize
84KB

Download
memory/1140-16-0x0000000000100000-0x0000000000115000-memory.dmp

Filesize
84KB

Download
memory/1700-1-0x00000000002B0000-0x00000000003B0000-memory.dmp

Filesize
1024KB

Download
memory/1700-3-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1700-13-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download
memory/1700-14-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2628-12-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads