tofsee | b9088751630d49d7b5dee27ac9a67abc1b292f84c1e9f5423d88595e88514c6b

General

Target
b9088751630d49d7b5dee27ac9a67abc1b292f84c1e9f5423d88595e88514c6b.exe
Size 13.5MB
Sample261029-negrtabt6t
SHA256 b9088751630d49d7b5dee27ac9a67abc1b292f84c1e9f5423d88595e88514c6b
MD5 c208ac6378b9142f7f1d04c23a693abc
SHA1 9c2c8707429fef79761f8032e41ff460ddb76985
SHA512 ae9d3696539b19c40414f04cf64891f7e5b482e451539b244e25f687023d6553e4a2b48bf46d2bbca7c06dd983625615cab6823729b8be52524f4cdd761b2dc7
SSDEEP 49152:LeppA1rvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrT:LKA
TLSH
T104E6436676D86ED9D0CA0FBC09A1C42B5DECF734043A953096D1504F98AE78A973CBB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution tofsee persistence privilege_escalation trojan

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru
refabyd.info

Signatures

Family: Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4568	netsh.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
2844	rpzxxnwm.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2844 set thread context of 4512	2844	rpzxxnwm.exe	101

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5796	sc.exe
3800	sc.exe
4456	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5020	cmd.exe
5136	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpzxxnwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b9088751630d49d7b5dee27ac9a67abc1b292f84c1e9f5423d88595e88514c6b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 5020	4708	b9088751630d49d7b5dee27ac9a67abc1b292f84c1e9f5423d88595e88514c6b.exe	89
PID 4708 wrote to memory of 5136	4708	b9088751630d49d7b5dee27ac9a67abc1b292f84c1e9f5423d88595e88514c6b.exe	91
PID 4708 wrote to memory of 5796	4708	b9088751630d49d7b5dee27ac9a67abc1b292f84c1e9f5423d88595e88514c6b.exe	93
PID 4708 wrote to memory of 3800	4708	b9088751630d49d7b5dee27ac9a67abc1b292f84c1e9f5423d88595e88514c6b.exe	95
PID 4708 wrote to memory of 4456	4708	b9088751630d49d7b5dee27ac9a67abc1b292f84c1e9f5423d88595e88514c6b.exe	98
PID 2844 wrote to memory of 4512	2844	rpzxxnwm.exe	101
PID 2844 wrote to memory of 4512	2844	rpzxxnwm.exe	101
PID 4708 wrote to memory of 4568	4708	b9088751630d49d7b5dee27ac9a67abc1b292f84c1e9f5423d88595e88514c6b.exe	102

C:\Users\Admin\AppData\Local\Temp\b9088751630d49d7b5dee27ac9a67abc1b292f84c1e9f5423d88595e88514c6b.exe
"C:\Users\Admin\AppData\Local\Temp\b9088751630d49d7b5dee27ac9a67abc1b292f84c1e9f5423d88595e88514c6b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\bpyjwwnx\
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5020
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\rpzxxnwm.exe" C:\Windows\SysWOW64\bpyjwwnx\
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5136
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create bpyjwwnx binPath= "C:\Windows\SysWOW64\bpyjwwnx\rpzxxnwm.exe /d\"C:\Users\Admin\AppData\Local\Temp\b9088751630d49d7b5dee27ac9a67abc1b292f84c1e9f5423d88595e88514c6b.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5796
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description bpyjwwnx "wifi internet conection"
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3800
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start bpyjwwnx
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4456
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4568

C:\Windows\SysWOW64\bpyjwwnx\rpzxxnwm.exe
C:\Windows\SysWOW64\bpyjwwnx\rpzxxnwm.exe /d"C:\Users\Admin\AppData\Local\Temp\b9088751630d49d7b5dee27ac9a67abc1b292f84c1e9f5423d88595e88514c6b.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:4512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rpzxxnwm.exe

Path C:\Users\Admin\AppData\Local\Temp\rpzxxnwm.exe
Size 14.8MB
SHA256 f71ef0e512c5c4fa8b5d0377d3ecf101e07f25e2af28ebf7fe059a2b9f8c0839
MD5 014bd574752cc62013a9799ad103292e
SHA1 07b07724156923145d1c0b7f327e3c7a5982d0c3
SHA512 effed870b8f4932668d639f5e7231e9b5d07dbb50844ec6ae28317caa2b1092bec9bfd5d9da6ec2f639c3dc24fcc75f31046525bac9571816831f436b324ca19
SSDEEP 49152:VeppA1rvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrf:VKA
TLSH
T123F6436676D86ED9D0CA0FBC09A1C42B5DECF734043A953096D1504F98AE78A973CBB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2844-5-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/2844-9-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/4512-6-0x0000000000930000-0x0000000000979000-memory.dmp

Download

memory/4708-0-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/4708-10-0x0000000000400000-0x0000000000449000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads