tofsee | 832d0960aaccf6c9fa55d5a763efed949534cfd5cbc13f6d93dd783fe92c7ba7

General

Target
832d0960aaccf6c9fa55d5a763efed949534cfd5cbc13f6d93dd783fe92c7ba7.exe
Size 10.7MB
Sample261029-neebpayyhv
SHA256 832d0960aaccf6c9fa55d5a763efed949534cfd5cbc13f6d93dd783fe92c7ba7
MD5 3ab5f56b1068db7ddd48e633f28f9078
SHA1 1595cb3a172d0ba9f28e15a657b4add3d66e6f9c
SHA512 b837d17928661112bef9ac7d7d3adcb3a0723e3998bfaae61f10cd43ad208929998d2cc8ab3a00d5be5c2d143c7aa80b9e210311a7227f3f30579def7cd2f7fd
SSDEEP 49152:Pzp2frvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvn:Pk
TLSH
T15CB6436676D86ED9D0CA0FBC09A1C42B5DECFB34043A553096D1504F98AE78A973CBB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution tofsee persistence privilege_escalation trojan

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru
refabyd.info

Signatures

Family: Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
988	netsh.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
1744	twpxvxfp.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1744 set thread context of 2604	1744	twpxvxfp.exe	102

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3256	sc.exe
2676	sc.exe
1892	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3780	cmd.exe
1300	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	832d0960aaccf6c9fa55d5a763efed949534cfd5cbc13f6d93dd783fe92c7ba7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	twpxvxfp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 3780	4160	832d0960aaccf6c9fa55d5a763efed949534cfd5cbc13f6d93dd783fe92c7ba7.exe	90
PID 4160 wrote to memory of 1300	4160	832d0960aaccf6c9fa55d5a763efed949534cfd5cbc13f6d93dd783fe92c7ba7.exe	92
PID 4160 wrote to memory of 3256	4160	832d0960aaccf6c9fa55d5a763efed949534cfd5cbc13f6d93dd783fe92c7ba7.exe	94
PID 4160 wrote to memory of 2676	4160	832d0960aaccf6c9fa55d5a763efed949534cfd5cbc13f6d93dd783fe92c7ba7.exe	96
PID 4160 wrote to memory of 1892	4160	832d0960aaccf6c9fa55d5a763efed949534cfd5cbc13f6d93dd783fe92c7ba7.exe	98
PID 1744 wrote to memory of 2604	1744	twpxvxfp.exe	102
PID 1744 wrote to memory of 2604	1744	twpxvxfp.exe	102
PID 4160 wrote to memory of 988	4160	832d0960aaccf6c9fa55d5a763efed949534cfd5cbc13f6d93dd783fe92c7ba7.exe	103

C:\Users\Admin\AppData\Local\Temp\832d0960aaccf6c9fa55d5a763efed949534cfd5cbc13f6d93dd783fe92c7ba7.exe
"C:\Users\Admin\AppData\Local\Temp\832d0960aaccf6c9fa55d5a763efed949534cfd5cbc13f6d93dd783fe92c7ba7.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ksiaiawb\
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3780
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\twpxvxfp.exe" C:\Windows\SysWOW64\ksiaiawb\
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1300
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create ksiaiawb binPath= "C:\Windows\SysWOW64\ksiaiawb\twpxvxfp.exe /d\"C:\Users\Admin\AppData\Local\Temp\832d0960aaccf6c9fa55d5a763efed949534cfd5cbc13f6d93dd783fe92c7ba7.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3256
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description ksiaiawb "wifi internet conection"
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2676
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start ksiaiawb
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1892
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:988

C:\Windows\SysWOW64\ksiaiawb\twpxvxfp.exe
C:\Windows\SysWOW64\ksiaiawb\twpxvxfp.exe /d"C:\Users\Admin\AppData\Local\Temp\832d0960aaccf6c9fa55d5a763efed949534cfd5cbc13f6d93dd783fe92c7ba7.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:2604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

twpxvxfp.exe

Path C:\Users\Admin\AppData\Local\Temp\twpxvxfp.exe
Size 14.4MB
SHA256 0fd6ddbe09ec33bc947667048a89bb43854702470586d5e4c194c6d8ddc9916c
MD5 d423483b4b9b131fd6c08a8b38bd9c64
SHA1 ff7e266762c077512ac0c8e9fba24f1e39102c15
SHA512 05b2d7a304437dd45bbcb9078a663c169b4ab013ed25d983efa3a6abf431e41525962fdc5e26da67ca93631a03463f6a3e95983f2927fa07078308d46899a719
SSDEEP 49152:Szp2frvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvH:Sk
TLSH
T172E6436676D86ED9D0CA0FBC09A1C42B5DECFB34043A553096D1504F98AE78A973CBB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1744-5-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/1744-8-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/2604-6-0x0000000000C50000-0x0000000000C99000-memory.dmp

Download

memory/4160-0-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/4160-10-0x0000000000400000-0x0000000000449000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads