tofsee | 00b23692bd6690523e4b220291aa8cba00621233aa6b7173f39340140b5c56ba

Analysis

max time kernel
147s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-11-2024 20:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-23_fa7712b50791b07d5dbbe48526c34ac1_karagany_mafia.exe
Size

12.8MB
MD5

fa7712b50791b07d5dbbe48526c34ac1
SHA1

f457a42707e66c05d103b91695d31ff85114caa4
SHA256

00b23692bd6690523e4b220291aa8cba00621233aa6b7173f39340140b5c56ba
SHA512

21b7de6d6c6b39e8f9daed599e1a7c974e194717a0f82e40c16aea153c06f72597b8f2e6c3917e913da3a6ca8b0139ed7d4ef9d915e1c8e1e9e41ffda29c9560
SSDEEP

6144:JXxZs2EcxJ8GD96ySzTVaFRFX53ncNnUUMMMMMMMMb5:JXzuKJ8GD96ySzTcANnQMMMMMMMb

Score

10^/10

tofsee discovery evasion execution persistence privilege_escalation trojan

Malware Config

Extracted

Family

tofsee

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Tofsee family
tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\ozbicgwk = "0"	svchost.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

netsh.exe

pid	Process
3020	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ozbicgwk\ImagePath = "C:\\Windows\\SysWOW64\\ozbicgwk\\jobbedty.exe"	svchost.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid	Process
2528	svchost.exe

Executes dropped EXE 1 IoCs

Processes:

jobbedty.exe

pid	Process
2888	jobbedty.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

jobbedty.exe

description	pid	Process	procid_target
PID 2888 set thread context of 2528	2888	jobbedty.exe	44

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid	Process
2244	sc.exe
2112	sc.exe
2740	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

jobbedty.exesc.exenetsh.exesvchost.exe2024-11-23_fa7712b50791b07d5dbbe48526c34ac1_karagany_mafia.execmd.execmd.exesc.exesc.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jobbedty.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-23_fa7712b50791b07d5dbbe48526c34ac1_karagany_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

2024-11-23_fa7712b50791b07d5dbbe48526c34ac1_karagany_mafia.exejobbedty.exe

description	pid	Process	procid_target
PID 2524 wrote to memory of 2004	2524	2024-11-23_fa7712b50791b07d5dbbe48526c34ac1_karagany_mafia.exe	30
PID 2524 wrote to memory of 2004	2524	2024-11-23_fa7712b50791b07d5dbbe48526c34ac1_karagany_mafia.exe	30
PID 2524 wrote to memory of 2004	2524	2024-11-23_fa7712b50791b07d5dbbe48526c34ac1_karagany_mafia.exe	30
PID 2524 wrote to memory of 2004	2524	2024-11-23_fa7712b50791b07d5dbbe48526c34ac1_karagany_mafia.exe	30
PID 2524 wrote to memory of 1632	2524	2024-11-23_fa7712b50791b07d5dbbe48526c34ac1_karagany_mafia.exe	32
PID 2524 wrote to memory of 1632	2524	2024-11-23_fa7712b50791b07d5dbbe48526c34ac1_karagany_mafia.exe	32
PID 2524 wrote to memory of 1632	2524	2024-11-23_fa7712b50791b07d5dbbe48526c34ac1_karagany_mafia.exe	32
PID 2524 wrote to memory of 1632	2524	2024-11-23_fa7712b50791b07d5dbbe48526c34ac1_karagany_mafia.exe	32
PID 2524 wrote to memory of 2244	2524	2024-11-23_fa7712b50791b07d5dbbe48526c34ac1_karagany_mafia.exe	34
PID 2524 wrote to memory of 2244	2524	2024-11-23_fa7712b50791b07d5dbbe48526c34ac1_karagany_mafia.exe	34
PID 2524 wrote to memory of 2244	2524	2024-11-23_fa7712b50791b07d5dbbe48526c34ac1_karagany_mafia.exe	34
PID 2524 wrote to memory of 2244	2524	2024-11-23_fa7712b50791b07d5dbbe48526c34ac1_karagany_mafia.exe	34
PID 2524 wrote to memory of 2112	2524	2024-11-23_fa7712b50791b07d5dbbe48526c34ac1_karagany_mafia.exe	36
PID 2524 wrote to memory of 2112	2524	2024-11-23_fa7712b50791b07d5dbbe48526c34ac1_karagany_mafia.exe	36
PID 2524 wrote to memory of 2112	2524	2024-11-23_fa7712b50791b07d5dbbe48526c34ac1_karagany_mafia.exe	36
PID 2524 wrote to memory of 2112	2524	2024-11-23_fa7712b50791b07d5dbbe48526c34ac1_karagany_mafia.exe	36
PID 2524 wrote to memory of 2740	2524	2024-11-23_fa7712b50791b07d5dbbe48526c34ac1_karagany_mafia.exe	38
PID 2524 wrote to memory of 2740	2524	2024-11-23_fa7712b50791b07d5dbbe48526c34ac1_karagany_mafia.exe	38
PID 2524 wrote to memory of 2740	2524	2024-11-23_fa7712b50791b07d5dbbe48526c34ac1_karagany_mafia.exe	38
PID 2524 wrote to memory of 2740	2524	2024-11-23_fa7712b50791b07d5dbbe48526c34ac1_karagany_mafia.exe	38
PID 2524 wrote to memory of 3020	2524	2024-11-23_fa7712b50791b07d5dbbe48526c34ac1_karagany_mafia.exe	41
PID 2524 wrote to memory of 3020	2524	2024-11-23_fa7712b50791b07d5dbbe48526c34ac1_karagany_mafia.exe	41
PID 2524 wrote to memory of 3020	2524	2024-11-23_fa7712b50791b07d5dbbe48526c34ac1_karagany_mafia.exe	41
PID 2524 wrote to memory of 3020	2524	2024-11-23_fa7712b50791b07d5dbbe48526c34ac1_karagany_mafia.exe	41
PID 2888 wrote to memory of 2528	2888	jobbedty.exe	44
PID 2888 wrote to memory of 2528	2888	jobbedty.exe	44
PID 2888 wrote to memory of 2528	2888	jobbedty.exe	44
PID 2888 wrote to memory of 2528	2888	jobbedty.exe	44
PID 2888 wrote to memory of 2528	2888	jobbedty.exe	44
PID 2888 wrote to memory of 2528	2888	jobbedty.exe	44

C:\Users\Admin\AppData\Local\Temp\2024-11-23_fa7712b50791b07d5dbbe48526c34ac1_karagany_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-23_fa7712b50791b07d5dbbe48526c34ac1_karagany_mafia.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ozbicgwk\
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2004
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\jobbedty.exe" C:\Windows\SysWOW64\ozbicgwk\
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1632
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create ozbicgwk binPath= "C:\Windows\SysWOW64\ozbicgwk\jobbedty.exe /d\"C:\Users\Admin\AppData\Local\Temp\2024-11-23_fa7712b50791b07d5dbbe48526c34ac1_karagany_mafia.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2244
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description ozbicgwk "wifi internet conection"
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2112
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start ozbicgwk
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2740
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3020

C:\Windows\SysWOW64\ozbicgwk\jobbedty.exe
C:\Windows\SysWOW64\ozbicgwk\jobbedty.exe /d"C:\Users\Admin\AppData\Local\Temp\2024-11-23_fa7712b50791b07d5dbbe48526c34ac1_karagany_mafia.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Windows security bypass
  - Sets service image path in registry
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\jobbedty.exe

Filesize
14.3MB

MD5
6a5104c72fad94bb8e23ff237bb89ade

SHA1
04a64d62c438b8bad2dfd6bd4cfd58a9785e4098

SHA256
6a5712ed39958cd91c6fcc4b10efdc587a515f1d4342a03845f357ef5f0a49e9

SHA512
2b6d3acf2f0455faf824d0f4c3194227826c37ea3fe4f6e245fc5f966414bf5e4397bced59fda262bd1738c0eaac43e0a886690ae33527f62c740ba0cd6ef80f

Download Submit
memory/2524-8-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/2524-3-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2524-2-0x0000000000230000-0x0000000000243000-memory.dmp

Filesize
76KB

Download
memory/2524-10-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2524-9-0x0000000000230000-0x0000000000243000-memory.dmp

Filesize
76KB

Download
memory/2524-1-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/2524-7-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2528-15-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2528-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2528-12-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2528-17-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2528-18-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2528-19-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2888-16-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download