Analysis

  • max time kernel
    146s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-09-2024 23:05

General

  • Target

    78ffb37d0d83a6cab5ffda39feca2226b7313e14cf2591742a713cbbf4346ef5.exe

  • Size

    11.3MB

  • MD5

    e465df146e4a00ed2e4a0d941003a13c

  • SHA1

    451f1f0877d638646261a730de87929f01debf68

  • SHA256

    78ffb37d0d83a6cab5ffda39feca2226b7313e14cf2591742a713cbbf4346ef5

  • SHA512

    39151020dc52e537ae0333a2a317f70406f9da72fb9013fd49358cb71a39fabc5c267e0fb19d2e28dc2fa221b218857b9dc03320f64b03e99fb31a615cc06983

  • SSDEEP

    3072:NoiqjV0QCeV75zMwb2EfDXTBrt0c5f+Z7ApWt+0krytpObPUfAGM4H1M4CjiJNx4:NoiqjWHeV9zthDjBrmA+VkDbSAgQiTx

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Creates new service(s) 2 TTPs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Program crash 6 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\78ffb37d0d83a6cab5ffda39feca2226b7313e14cf2591742a713cbbf4346ef5.exe
    "C:\Users\Admin\AppData\Local\Temp\78ffb37d0d83a6cab5ffda39feca2226b7313e14cf2591742a713cbbf4346ef5.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1988
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\uddntykp\
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2792
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\tamzivwq.exe" C:\Windows\SysWOW64\uddntykp\
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2636
    • C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" create uddntykp binPath= "C:\Windows\SysWOW64\uddntykp\tamzivwq.exe /d\"C:\Users\Admin\AppData\Local\Temp\78ffb37d0d83a6cab5ffda39feca2226b7313e14cf2591742a713cbbf4346ef5.exe\"" type= own start= auto DisplayName= "wifi support"
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:764
    • C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" description uddntykp "wifi internet conection"
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:2888
    • C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" start uddntykp
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:692
    • C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:1688
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 1256
      2⤵
      • Program crash
      PID:3444
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 604
      2⤵
      • Program crash
      PID:1748
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 1044
      2⤵
      • Program crash
      PID:4492
  • C:\Windows\SysWOW64\uddntykp\tamzivwq.exe
    C:\Windows\SysWOW64\uddntykp\tamzivwq.exe /d"C:\Users\Admin\AppData\Local\Temp\78ffb37d0d83a6cab5ffda39feca2226b7313e14cf2591742a713cbbf4346ef5.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5004
    • C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      2⤵
      • Sets service image path in registry
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:3536
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 516
      2⤵
      • Program crash
      PID:4564
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 556
      2⤵
      • Program crash
      PID:4552
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 532
      2⤵
      • Program crash
      PID:1552
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1988 -ip 1988
    1⤵
      PID:2352
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1988 -ip 1988
      1⤵
        PID:1624
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5004 -ip 5004
        1⤵
          PID:3936
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1988 -ip 1988
          1⤵
            PID:1404
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5004 -ip 5004
            1⤵
              PID:2288
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5004 -ip 5004
              1⤵
                PID:1160
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4292,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:8
                1⤵
                  PID:4352

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\tamzivwq.exe

                  Filesize

                  13.1MB

                  MD5

                  2fd8f5d2784ce90d44783033c1246bff

                  SHA1

                  825c405105b9859b715bc42a363d3e12223a0d76

                  SHA256

                  3554728ab2fbf803e919811576ee80f1ef477f01f98e382bbb311c56c403e416

                  SHA512

                  05b43c935557f6ae6c3b4810608e6fc08def46c51412db366c06ccbe51e255eae4d7f4e33048e31c4ec0054d383f89f7ae733fae23c8b985376ad71790ddca7d

                • memory/1988-12-0x0000000000400000-0x000000000086B000-memory.dmp

                  Filesize

                  4.4MB

                • memory/1988-3-0x0000000000400000-0x0000000000415000-memory.dmp

                  Filesize

                  84KB

                • memory/1988-2-0x00000000008F0000-0x0000000000903000-memory.dmp

                  Filesize

                  76KB

                • memory/1988-14-0x0000000000400000-0x0000000000415000-memory.dmp

                  Filesize

                  84KB

                • memory/1988-13-0x00000000008F0000-0x0000000000903000-memory.dmp

                  Filesize

                  76KB

                • memory/1988-1-0x0000000000AD0000-0x0000000000BD0000-memory.dmp

                  Filesize

                  1024KB

                • memory/3536-10-0x0000000001050000-0x0000000001065000-memory.dmp

                  Filesize

                  84KB

                • memory/3536-17-0x0000000001050000-0x0000000001065000-memory.dmp

                  Filesize

                  84KB

                • memory/3536-18-0x0000000001050000-0x0000000001065000-memory.dmp

                  Filesize

                  84KB

                • memory/5004-8-0x0000000000400000-0x000000000086B000-memory.dmp

                  Filesize

                  4.4MB

                • memory/5004-9-0x0000000000400000-0x000000000086B000-memory.dmp

                  Filesize

                  4.4MB

                • memory/5004-16-0x0000000000400000-0x000000000086B000-memory.dmp

                  Filesize

                  4.4MB