Analysis

  • max time kernel
    148s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-09-2024 08:12

General

  • Target

    d66f7617e71ecb9018ac3b943fec478f558413433d3219031af14dcaa590ea76.exe

  • Size

    12.9MB

  • MD5

    17d263eaaf2f1373b41cb0c3ff9aa26f

  • SHA1

    11711ac0749600ae84192fc38141b205b7388399

  • SHA256

    d66f7617e71ecb9018ac3b943fec478f558413433d3219031af14dcaa590ea76

  • SHA512

    8f0b335a3172dc0e1d9eef54ef3f7c968d8dc9d2fba5d4931e47fd43346ff29a9b457cc40d161e1c5100d691817c0f6e8400a75fdbf62a90c00ebf439f219df3

  • SSDEEP

    49152:8P1IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIf:

Malware Config

Extracted

Family

tofsee

C2

quadoil.ru

lakeflex.ru

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Creates new service(s) 2 TTPs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d66f7617e71ecb9018ac3b943fec478f558413433d3219031af14dcaa590ea76.exe
    "C:\Users\Admin\AppData\Local\Temp\d66f7617e71ecb9018ac3b943fec478f558413433d3219031af14dcaa590ea76.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2648
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\gijkqdcf\
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3164
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\sxhxlq.exe" C:\Windows\SysWOW64\gijkqdcf\
      2⤵
      • System Location Discovery: System Language Discovery
      PID:696
    • C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" create gijkqdcf binPath= "C:\Windows\SysWOW64\gijkqdcf\sxhxlq.exe /d\"C:\Users\Admin\AppData\Local\Temp\d66f7617e71ecb9018ac3b943fec478f558413433d3219031af14dcaa590ea76.exe\"" type= own start= auto DisplayName= "wifi support"
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:2844
    • C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" description gijkqdcf "wifi internet conection"
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:5084
    • C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" start gijkqdcf
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:4168
    • C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:3940
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 1048
      2⤵
      • Program crash
      PID:4640
  • C:\Windows\SysWOW64\gijkqdcf\sxhxlq.exe
    C:\Windows\SysWOW64\gijkqdcf\sxhxlq.exe /d"C:\Users\Admin\AppData\Local\Temp\d66f7617e71ecb9018ac3b943fec478f558413433d3219031af14dcaa590ea76.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4620
    • C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      2⤵
      • Sets service image path in registry
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:3652
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 516
      2⤵
      • Program crash
      PID:4532
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2648 -ip 2648
    1⤵
      PID:2352
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4620 -ip 4620
      1⤵
        PID:4332

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\sxhxlq.exe

        Filesize

        11.9MB

        MD5

        98555446d0d9554351c4feb5a631b37b

        SHA1

        182c4378e3692dd6b6238c0db412551aa40d7f0d

        SHA256

        202da363483233d7dcdff7a7ba12c3268249c003e5e84babd132aeb39be41d82

        SHA512

        f535849c0d1ac6d59737fcf11ac24b36f5bcfc1e8a55994d0b0e07fabd065f00f6bbae9ff4b3757758ef0bc22e27c6ffef060ccef07fa1ebef57d3190b0f8f27

      • memory/2648-1-0x0000000000A00000-0x0000000000B00000-memory.dmp

        Filesize

        1024KB

      • memory/2648-2-0x00000000024B0000-0x00000000024C3000-memory.dmp

        Filesize

        76KB

      • memory/2648-3-0x0000000000400000-0x0000000000415000-memory.dmp

        Filesize

        84KB

      • memory/2648-9-0x00000000024B0000-0x00000000024C3000-memory.dmp

        Filesize

        76KB

      • memory/2648-10-0x0000000000400000-0x0000000000415000-memory.dmp

        Filesize

        84KB

      • memory/2648-8-0x0000000000400000-0x000000000076F000-memory.dmp

        Filesize

        3.4MB

      • memory/3652-12-0x0000000000F50000-0x0000000000F65000-memory.dmp

        Filesize

        84KB

      • memory/3652-14-0x0000000000F50000-0x0000000000F65000-memory.dmp

        Filesize

        84KB

      • memory/3652-15-0x0000000000F50000-0x0000000000F65000-memory.dmp

        Filesize

        84KB

      • memory/4620-11-0x0000000000400000-0x000000000076F000-memory.dmp

        Filesize

        3.4MB

      • memory/4620-16-0x0000000000400000-0x000000000076F000-memory.dmp

        Filesize

        3.4MB