Analysis
-
max time kernel
144s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 14:50
Static task
static1
Behavioral task
behavioral1
Sample
588e82d016cf820981a0ff1bc1063ebdacc6918051d5855756d4f141ebc9f48c.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
588e82d016cf820981a0ff1bc1063ebdacc6918051d5855756d4f141ebc9f48c.exe
Resource
win10v2004-20241007-en
General
-
Target
588e82d016cf820981a0ff1bc1063ebdacc6918051d5855756d4f141ebc9f48c.exe
-
Size
12.6MB
-
MD5
0c4b956df94e7fa77967043428ee105d
-
SHA1
7ec22983461cd45e2fba80b561b9006fd5e012be
-
SHA256
588e82d016cf820981a0ff1bc1063ebdacc6918051d5855756d4f141ebc9f48c
-
SHA512
1d0b850ec7273459e454b24ca3ead47d36a270762cc7a348f15df73b63d31390f795e9283e84b401148515ad2404e53993221fee92cf4ca0cd851638e054b18e
-
SSDEEP
393216:fH2222222222222222222222222222222222222222222222222222222222222h:v222222222222222222222222222222G
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Tofsee family
-
Creates new service(s) 2 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 3832 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\fzxvjgya\ImagePath = "C:\\Windows\\SysWOW64\\fzxvjgya\\ikdovdrh.exe" svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 588e82d016cf820981a0ff1bc1063ebdacc6918051d5855756d4f141ebc9f48c.exe -
Deletes itself 1 IoCs
pid Process 4784 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 3152 ikdovdrh.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3152 set thread context of 4784 3152 ikdovdrh.exe 94 -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1616 sc.exe 1504 sc.exe 796 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 1804 2548 WerFault.exe 82 5112 3152 WerFault.exe 93 -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ikdovdrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 588e82d016cf820981a0ff1bc1063ebdacc6918051d5855756d4f141ebc9f48c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 2548 wrote to memory of 4692 2548 588e82d016cf820981a0ff1bc1063ebdacc6918051d5855756d4f141ebc9f48c.exe 83 PID 2548 wrote to memory of 4692 2548 588e82d016cf820981a0ff1bc1063ebdacc6918051d5855756d4f141ebc9f48c.exe 83 PID 2548 wrote to memory of 4692 2548 588e82d016cf820981a0ff1bc1063ebdacc6918051d5855756d4f141ebc9f48c.exe 83 PID 2548 wrote to memory of 1420 2548 588e82d016cf820981a0ff1bc1063ebdacc6918051d5855756d4f141ebc9f48c.exe 85 PID 2548 wrote to memory of 1420 2548 588e82d016cf820981a0ff1bc1063ebdacc6918051d5855756d4f141ebc9f48c.exe 85 PID 2548 wrote to memory of 1420 2548 588e82d016cf820981a0ff1bc1063ebdacc6918051d5855756d4f141ebc9f48c.exe 85 PID 2548 wrote to memory of 1616 2548 588e82d016cf820981a0ff1bc1063ebdacc6918051d5855756d4f141ebc9f48c.exe 87 PID 2548 wrote to memory of 1616 2548 588e82d016cf820981a0ff1bc1063ebdacc6918051d5855756d4f141ebc9f48c.exe 87 PID 2548 wrote to memory of 1616 2548 588e82d016cf820981a0ff1bc1063ebdacc6918051d5855756d4f141ebc9f48c.exe 87 PID 2548 wrote to memory of 1504 2548 588e82d016cf820981a0ff1bc1063ebdacc6918051d5855756d4f141ebc9f48c.exe 89 PID 2548 wrote to memory of 1504 2548 588e82d016cf820981a0ff1bc1063ebdacc6918051d5855756d4f141ebc9f48c.exe 89 PID 2548 wrote to memory of 1504 2548 588e82d016cf820981a0ff1bc1063ebdacc6918051d5855756d4f141ebc9f48c.exe 89 PID 2548 wrote to memory of 796 2548 588e82d016cf820981a0ff1bc1063ebdacc6918051d5855756d4f141ebc9f48c.exe 91 PID 2548 wrote to memory of 796 2548 588e82d016cf820981a0ff1bc1063ebdacc6918051d5855756d4f141ebc9f48c.exe 91 PID 2548 wrote to memory of 796 2548 588e82d016cf820981a0ff1bc1063ebdacc6918051d5855756d4f141ebc9f48c.exe 91 PID 3152 wrote to memory of 4784 3152 ikdovdrh.exe 94 PID 3152 wrote to memory of 4784 3152 ikdovdrh.exe 94 PID 3152 wrote to memory of 4784 3152 ikdovdrh.exe 94 PID 3152 wrote to memory of 4784 3152 ikdovdrh.exe 94 PID 3152 wrote to memory of 4784 3152 ikdovdrh.exe 94 PID 2548 wrote to memory of 3832 2548 588e82d016cf820981a0ff1bc1063ebdacc6918051d5855756d4f141ebc9f48c.exe 100 PID 2548 wrote to memory of 3832 2548 588e82d016cf820981a0ff1bc1063ebdacc6918051d5855756d4f141ebc9f48c.exe 100 PID 2548 wrote to memory of 3832 2548 588e82d016cf820981a0ff1bc1063ebdacc6918051d5855756d4f141ebc9f48c.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\588e82d016cf820981a0ff1bc1063ebdacc6918051d5855756d4f141ebc9f48c.exe"C:\Users\Admin\AppData\Local\Temp\588e82d016cf820981a0ff1bc1063ebdacc6918051d5855756d4f141ebc9f48c.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\fzxvjgya\2⤵
- System Location Discovery: System Language Discovery
PID:4692
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ikdovdrh.exe" C:\Windows\SysWOW64\fzxvjgya\2⤵
- System Location Discovery: System Language Discovery
PID:1420
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create fzxvjgya binPath= "C:\Windows\SysWOW64\fzxvjgya\ikdovdrh.exe /d\"C:\Users\Admin\AppData\Local\Temp\588e82d016cf820981a0ff1bc1063ebdacc6918051d5855756d4f141ebc9f48c.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1616
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description fzxvjgya "wifi internet conection"2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1504
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start fzxvjgya2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:796
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3832
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 6002⤵
- Program crash
PID:1804
-
-
C:\Windows\SysWOW64\fzxvjgya\ikdovdrh.exeC:\Windows\SysWOW64\fzxvjgya\ikdovdrh.exe /d"C:\Users\Admin\AppData\Local\Temp\588e82d016cf820981a0ff1bc1063ebdacc6918051d5855756d4f141ebc9f48c.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
- Deletes itself
- System Location Discovery: System Language Discovery
PID:4784
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 5202⤵
- Program crash
PID:5112
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3152 -ip 31521⤵PID:1952
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2548 -ip 25481⤵PID:3928
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11.9MB
MD588bc08a83542d0ce880626a1131b8d51
SHA18f9a832566a28a46918b26adda212a07ca2ec5ca
SHA256847e55086018375d4c52c863ea1340199aab8a6f49f0a057a24ec96c55d39f4b
SHA512e784249809b352ae4bd7c69de172cc76b7cb30e48deba50599dbb228a0f22f458ae6d1ff523a57af1f8978d566df5c50c50b111b4f64d3ab1cc78ffdb1ae651b