Analysis

  • max time kernel
    145s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/01/2025, 15:45

General

  • Target

    2025-01-28_dcaece4ebdb520ecb6aa2823c0c73699_mafia.exe

  • Size

    10.3MB

  • MD5

    dcaece4ebdb520ecb6aa2823c0c73699

  • SHA1

    eb6cbbf5ce20c6c2ebb9c09579050892272120e1

  • SHA256

    ce095a4e30dda5460968c93f15abe9d6cdce4af2201395dd4b3a60c6105a7c24

  • SHA512

    c1da465a240ca5ecc8db9ee7951f25527962185f991134c8e474b6857a026db5fd3d10cdf6c0fa7d89dd09c148992273f64a28f71b2fcbab708bc55c95299c9f

  • SSDEEP

    49152:RqE0YKr3fYPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPe:RqtYc3r

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Tofsee family
  • Creates new service(s) 2 TTPs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-01-28_dcaece4ebdb520ecb6aa2823c0c73699_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-01-28_dcaece4ebdb520ecb6aa2823c0c73699_mafia.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2872
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\owneuvim\
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4968
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\tnnepypr.exe" C:\Windows\SysWOW64\owneuvim\
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1612
    • C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" create owneuvim binPath= "C:\Windows\SysWOW64\owneuvim\tnnepypr.exe /d\"C:\Users\Admin\AppData\Local\Temp\2025-01-28_dcaece4ebdb520ecb6aa2823c0c73699_mafia.exe\"" type= own start= auto DisplayName= "wifi support"
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:4580
    • C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" description owneuvim "wifi internet conection"
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:3056
    • C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" start owneuvim
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:4444
    • C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:2136
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 644
      2⤵
      • Program crash
      PID:2576
  • C:\Windows\SysWOW64\owneuvim\tnnepypr.exe
    C:\Windows\SysWOW64\owneuvim\tnnepypr.exe /d"C:\Users\Admin\AppData\Local\Temp\2025-01-28_dcaece4ebdb520ecb6aa2823c0c73699_mafia.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3516
    • C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      2⤵
      • Sets service image path in registry
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:3628
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 528
      2⤵
      • Program crash
      PID:2548
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3516 -ip 3516
    1⤵
      PID:1644
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2872 -ip 2872
      1⤵
        PID:452

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\tnnepypr.exe

        Filesize

        14.1MB

        MD5

        af9bc789e2264ef558ab7ae6f67eb571

        SHA1

        93eb9b0485ca532af623101470f3fe9e9e5851f1

        SHA256

        71ce67d1c51cef93b5055fcd754998dcb5fe4a2196f8b45ba075768492fb525c

        SHA512

        3d3a33ac75286fc265d7215b94bcb5568c3fc24aeef47b543df1506c671b86180f823148672117cb5e7aac4727b9376fa3710d1cf0f01a7c1022d379e1236f15

      • memory/2872-2-0x0000000002E10000-0x0000000002E23000-memory.dmp

        Filesize

        76KB

      • memory/2872-1-0x0000000002EE0000-0x0000000002FE0000-memory.dmp

        Filesize

        1024KB

      • memory/2872-3-0x0000000000400000-0x0000000000415000-memory.dmp

        Filesize

        84KB

      • memory/2872-13-0x0000000000400000-0x0000000000415000-memory.dmp

        Filesize

        84KB

      • memory/2872-12-0x0000000002E10000-0x0000000002E23000-memory.dmp

        Filesize

        76KB

      • memory/2872-11-0x0000000000400000-0x0000000002DC3000-memory.dmp

        Filesize

        41.8MB

      • memory/3516-10-0x0000000000400000-0x0000000002DC3000-memory.dmp

        Filesize

        41.8MB

      • memory/3628-8-0x0000000000720000-0x0000000000735000-memory.dmp

        Filesize

        84KB

      • memory/3628-15-0x0000000000720000-0x0000000000735000-memory.dmp

        Filesize

        84KB

      • memory/3628-14-0x0000000000720000-0x0000000000735000-memory.dmp

        Filesize

        84KB