Analysis

  • max time kernel
    57s
  • max time network
    59s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-09-2024 19:45

General

  • Target

    7d33c7099e8696a3c06361ee3d4da8c45461cd3fdb6fe354d81be76fe5d8625d.exe

  • Size

    11.2MB

  • MD5

    dc95cb1290fa14086d6e54605ef163e4

  • SHA1

    e38ae542e1c56fc2db4e3976c86af29faf48293a

  • SHA256

    7d33c7099e8696a3c06361ee3d4da8c45461cd3fdb6fe354d81be76fe5d8625d

  • SHA512

    7009d924341b95beb3fb709b6895a44364fa6f9f1f2ce019ce972cdad24870e09abc6e08064e5478a10b21253bf7126b15bab8be3eee0ef37c7ad29ccc64955a

  • SSDEEP

    1536:CpUJsMq8nDNrnUtDDqJ55fNBVcmiCxmeZUUfOxxjDRvgdi0/zvjHNq8wR4vyKT:O6nln1X17rpLfOz3t8Fbti4v

Malware Config

Extracted

Family

tofsee

C2

103.248.137.133

59.188.74.26

115.230.124.76

111.121.193.242

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Creates new service(s) 2 TTPs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7d33c7099e8696a3c06361ee3d4da8c45461cd3fdb6fe354d81be76fe5d8625d.exe
    "C:\Users\Admin\AppData\Local\Temp\7d33c7099e8696a3c06361ee3d4da8c45461cd3fdb6fe354d81be76fe5d8625d.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2924
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\dwndznva\
      2⤵
      • System Location Discovery: System Language Discovery
      PID:636
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\scpmzjmk.exe" C:\Windows\SysWOW64\dwndznva\
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5084
    • C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" create dwndznva binPath= "C:\Windows\SysWOW64\dwndznva\scpmzjmk.exe /d\"C:\Users\Admin\AppData\Local\Temp\7d33c7099e8696a3c06361ee3d4da8c45461cd3fdb6fe354d81be76fe5d8625d.exe\"" type= own start= auto DisplayName= "P2P Support"
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:3028
    • C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" description dwndznva "Internet Mobile Support"
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:1336
    • C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" start dwndznva
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:8
    • C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:3016
  • C:\Windows\SysWOW64\dwndznva\scpmzjmk.exe
    C:\Windows\SysWOW64\dwndznva\scpmzjmk.exe /d"C:\Users\Admin\AppData\Local\Temp\7d33c7099e8696a3c06361ee3d4da8c45461cd3fdb6fe354d81be76fe5d8625d.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1868
    • C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      2⤵
      • Sets service image path in registry
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:3100

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\scpmzjmk.exe

    Filesize

    13.7MB

    MD5

    e6052b33579df229ce23187c45f31986

    SHA1

    db1763520889c78688e683eb597771d956347363

    SHA256

    5e22698b57131656ca66ff3ae07d263fe654838593a48d15fd714432a331bb98

    SHA512

    a0e90e3fa5b735b46c6733d0786f8a0b92e6fe09d5e48f8585f0c7481edc1641032233f08344655c43893b0ab0a4680485376085b01d5250f2ceeafddd2954e4

  • memory/1868-7-0x0000000000400000-0x0000000000427000-memory.dmp

    Filesize

    156KB

  • memory/1868-13-0x0000000000400000-0x0000000000427000-memory.dmp

    Filesize

    156KB

  • memory/2924-0-0x0000000000400000-0x0000000000427000-memory.dmp

    Filesize

    156KB

  • memory/2924-1-0x00000000009D0000-0x00000000009D1000-memory.dmp

    Filesize

    4KB

  • memory/2924-3-0x00000000024D0000-0x00000000024D1000-memory.dmp

    Filesize

    4KB

  • memory/2924-2-0x0000000000400000-0x0000000000427000-memory.dmp

    Filesize

    156KB

  • memory/2924-9-0x0000000000400000-0x0000000000427000-memory.dmp

    Filesize

    156KB

  • memory/3100-11-0x00000000003B0000-0x00000000003C6000-memory.dmp

    Filesize

    88KB

  • memory/3100-15-0x00000000003B0000-0x00000000003C6000-memory.dmp

    Filesize

    88KB

  • memory/3100-16-0x00000000003B0000-0x00000000003C6000-memory.dmp

    Filesize

    88KB