Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 14:15
Static task
static1
Behavioral task
behavioral1
Sample
c205b7fe1ffd71e1a00dbd175dde5352aa7e7e7c81754994c5ad0923e629d591.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
c205b7fe1ffd71e1a00dbd175dde5352aa7e7e7c81754994c5ad0923e629d591.exe
Resource
win10v2004-20241007-en
General
-
Target
c205b7fe1ffd71e1a00dbd175dde5352aa7e7e7c81754994c5ad0923e629d591.exe
-
Size
10.5MB
-
MD5
f437958a717001f8bb29ca023faf9bb7
-
SHA1
6771eacfab06f9290ca7276974e206316739e8bb
-
SHA256
c205b7fe1ffd71e1a00dbd175dde5352aa7e7e7c81754994c5ad0923e629d591
-
SHA512
37b3ea8fe4ac0288611010d69da0556c105eb3a886c512d4047f70f335dee9ce4cf76d5eda46d627a0d2965a187aa6ce0f434c279d8c64db25b8b4dcc059c6ff
-
SSDEEP
12288:jnWdwQB3a1ZAXYlVR7jbMviJvK3SRL/R/R/R/R/R/R/R/R/R/R/R/R/R/R/R/R/D:jnWdFB3a1ZLlsviJv9
Malware Config
Extracted
tofsee
quadoil.ru
lakeflex.ru
Signatures
-
Tofsee family
-
Creates new service(s) 2 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2580 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\njjlupue\ImagePath = "C:\\Windows\\SysWOW64\\njjlupue\\odijdloh.exe" svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation c205b7fe1ffd71e1a00dbd175dde5352aa7e7e7c81754994c5ad0923e629d591.exe -
Deletes itself 1 IoCs
pid Process 512 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 2252 odijdloh.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2252 set thread context of 512 2252 odijdloh.exe 102 -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3056 sc.exe 4692 sc.exe 3932 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 4800 2104 WerFault.exe 81 4464 2252 WerFault.exe 94 -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c205b7fe1ffd71e1a00dbd175dde5352aa7e7e7c81754994c5ad0923e629d591.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language odijdloh.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 2104 wrote to memory of 1420 2104 c205b7fe1ffd71e1a00dbd175dde5352aa7e7e7c81754994c5ad0923e629d591.exe 82 PID 2104 wrote to memory of 1420 2104 c205b7fe1ffd71e1a00dbd175dde5352aa7e7e7c81754994c5ad0923e629d591.exe 82 PID 2104 wrote to memory of 1420 2104 c205b7fe1ffd71e1a00dbd175dde5352aa7e7e7c81754994c5ad0923e629d591.exe 82 PID 2104 wrote to memory of 1676 2104 c205b7fe1ffd71e1a00dbd175dde5352aa7e7e7c81754994c5ad0923e629d591.exe 84 PID 2104 wrote to memory of 1676 2104 c205b7fe1ffd71e1a00dbd175dde5352aa7e7e7c81754994c5ad0923e629d591.exe 84 PID 2104 wrote to memory of 1676 2104 c205b7fe1ffd71e1a00dbd175dde5352aa7e7e7c81754994c5ad0923e629d591.exe 84 PID 2104 wrote to memory of 3056 2104 c205b7fe1ffd71e1a00dbd175dde5352aa7e7e7c81754994c5ad0923e629d591.exe 86 PID 2104 wrote to memory of 3056 2104 c205b7fe1ffd71e1a00dbd175dde5352aa7e7e7c81754994c5ad0923e629d591.exe 86 PID 2104 wrote to memory of 3056 2104 c205b7fe1ffd71e1a00dbd175dde5352aa7e7e7c81754994c5ad0923e629d591.exe 86 PID 2104 wrote to memory of 4692 2104 c205b7fe1ffd71e1a00dbd175dde5352aa7e7e7c81754994c5ad0923e629d591.exe 88 PID 2104 wrote to memory of 4692 2104 c205b7fe1ffd71e1a00dbd175dde5352aa7e7e7c81754994c5ad0923e629d591.exe 88 PID 2104 wrote to memory of 4692 2104 c205b7fe1ffd71e1a00dbd175dde5352aa7e7e7c81754994c5ad0923e629d591.exe 88 PID 2104 wrote to memory of 3932 2104 c205b7fe1ffd71e1a00dbd175dde5352aa7e7e7c81754994c5ad0923e629d591.exe 92 PID 2104 wrote to memory of 3932 2104 c205b7fe1ffd71e1a00dbd175dde5352aa7e7e7c81754994c5ad0923e629d591.exe 92 PID 2104 wrote to memory of 3932 2104 c205b7fe1ffd71e1a00dbd175dde5352aa7e7e7c81754994c5ad0923e629d591.exe 92 PID 2104 wrote to memory of 2580 2104 c205b7fe1ffd71e1a00dbd175dde5352aa7e7e7c81754994c5ad0923e629d591.exe 95 PID 2104 wrote to memory of 2580 2104 c205b7fe1ffd71e1a00dbd175dde5352aa7e7e7c81754994c5ad0923e629d591.exe 95 PID 2104 wrote to memory of 2580 2104 c205b7fe1ffd71e1a00dbd175dde5352aa7e7e7c81754994c5ad0923e629d591.exe 95 PID 2252 wrote to memory of 512 2252 odijdloh.exe 102 PID 2252 wrote to memory of 512 2252 odijdloh.exe 102 PID 2252 wrote to memory of 512 2252 odijdloh.exe 102 PID 2252 wrote to memory of 512 2252 odijdloh.exe 102 PID 2252 wrote to memory of 512 2252 odijdloh.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\c205b7fe1ffd71e1a00dbd175dde5352aa7e7e7c81754994c5ad0923e629d591.exe"C:\Users\Admin\AppData\Local\Temp\c205b7fe1ffd71e1a00dbd175dde5352aa7e7e7c81754994c5ad0923e629d591.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\njjlupue\2⤵
- System Location Discovery: System Language Discovery
PID:1420
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\odijdloh.exe" C:\Windows\SysWOW64\njjlupue\2⤵
- System Location Discovery: System Language Discovery
PID:1676
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create njjlupue binPath= "C:\Windows\SysWOW64\njjlupue\odijdloh.exe /d\"C:\Users\Admin\AppData\Local\Temp\c205b7fe1ffd71e1a00dbd175dde5352aa7e7e7c81754994c5ad0923e629d591.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3056
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description njjlupue "wifi internet conection"2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4692
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start njjlupue2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3932
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2580
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 12442⤵
- Program crash
PID:4800
-
-
C:\Windows\SysWOW64\njjlupue\odijdloh.exeC:\Windows\SysWOW64\njjlupue\odijdloh.exe /d"C:\Users\Admin\AppData\Local\Temp\c205b7fe1ffd71e1a00dbd175dde5352aa7e7e7c81754994c5ad0923e629d591.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
- Deletes itself
- System Location Discovery: System Language Discovery
PID:512
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 5282⤵
- Program crash
PID:4464
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2104 -ip 21041⤵PID:2356
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2252 -ip 22521⤵PID:1688
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12.7MB
MD5b8d7bdc50e623deba0ce15574d9e9a36
SHA1a7e10cfb7ef5e4bb9c8607cea54001cc99d777cd
SHA25620a107019f5640a15fe19f06f327fa74fb72bb9c1fc6bb98383afd30cb542d95
SHA51279fd58659184c4d862486ead9462af1d175a9e2e67d8bffef196e8e4531f1b8b5332116d80e864af6e93fd740c12a23c9ebddd6a8485453f084a775278ba20f4