Malware Analysis Report

2024-08-06 11:59

Sample ID 231112-tgadeahc98
Target lib.banan
SHA256 58e05a5c06fdf6566e9b58805b90a33568a2a1e67fd973c9a95b4b8d3be1d375
Tags
toxiceye rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

58e05a5c06fdf6566e9b58805b90a33568a2a1e67fd973c9a95b4b8d3be1d375

Threat Level: Known bad

The file lib.banan was found to be: Known bad.

Malicious Activity Summary

toxiceye rat trojan

ToxicEye

Deletes itself

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Suspicious use of NtSetInformationThreadHideFromDebugger

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Enumerates processes with tasklist

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Delays execution with timeout.exe

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Scheduled Task/Job
T1053
Persistence
TA0003
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Process Discovery
T1057
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2023-11-12 16:01

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-11-12 16:01

Reported

2023-11-12 16:04

Platform

win7-20231023-en

Max time kernel

132s

Max time network

137s

Command Line

"C:\Users\Admin\AppData\Local\Temp\lib.exe"

Signatures

ToxicEye

rat trojan toxiceye

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\ToxicEye\rat.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\lib.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\lib.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Users\ToxicEye\rat.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\lib.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3028 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\lib.exe C:\Windows\SysWOW64\schtasks.exe
PID 3028 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\lib.exe C:\Windows\SysWOW64\schtasks.exe
PID 3028 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\lib.exe C:\Windows\SysWOW64\schtasks.exe
PID 3028 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\lib.exe C:\Windows\SysWOW64\schtasks.exe
PID 3028 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\lib.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\lib.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\lib.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\lib.exe C:\Windows\SysWOW64\cmd.exe
PID 2508 wrote to memory of 1700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2508 wrote to memory of 1700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2508 wrote to memory of 1700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2508 wrote to memory of 1700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2508 wrote to memory of 2520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2508 wrote to memory of 2520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2508 wrote to memory of 2520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2508 wrote to memory of 2520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2508 wrote to memory of 2492 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2508 wrote to memory of 2492 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2508 wrote to memory of 2492 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2508 wrote to memory of 2492 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2508 wrote to memory of 2272 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\ToxicEye\rat.exe
PID 2508 wrote to memory of 2272 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\ToxicEye\rat.exe
PID 2508 wrote to memory of 2272 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\ToxicEye\rat.exe
PID 2508 wrote to memory of 2272 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\ToxicEye\rat.exe
PID 2272 wrote to memory of 2660 N/A C:\Users\ToxicEye\rat.exe C:\Windows\SysWOW64\schtasks.exe
PID 2272 wrote to memory of 2660 N/A C:\Users\ToxicEye\rat.exe C:\Windows\SysWOW64\schtasks.exe
PID 2272 wrote to memory of 2660 N/A C:\Users\ToxicEye\rat.exe C:\Windows\SysWOW64\schtasks.exe
PID 2272 wrote to memory of 2660 N/A C:\Users\ToxicEye\rat.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\lib.exe

"C:\Users\Admin\AppData\Local\Temp\lib.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpACF2.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpACF2.tmp.bat

C:\Windows\SysWOW64\find.exe

find ":"

C:\Windows\SysWOW64\tasklist.exe

Tasklist /fi "PID eq 3028"

C:\Windows\SysWOW64\timeout.exe

Timeout /T 1 /Nobreak

C:\Users\ToxicEye\rat.exe

"rat.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 google.com udp

Files

memory/3028-0-0x0000000001210000-0x00000000015B4000-memory.dmp

memory/3028-2-0x0000000074CF0000-0x00000000753DE000-memory.dmp

memory/3028-1-0x0000000001210000-0x00000000015B4000-memory.dmp

memory/3028-3-0x0000000005C10000-0x0000000005C50000-memory.dmp

memory/3028-6-0x0000000001210000-0x00000000015B4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpACF2.tmp.bat

MD5 18c8923e877f737a46eeefb0351a75f1
SHA1 3fa887fc983df69c6366ea8a6b05fbab35062031
SHA256 9eb44c8ca55952edbdec8b0f54a81a4d75e072acc81be93ba73b02e6b5916c4e
SHA512 c7e6464ab447a71305ab75bf0a1115cec887aa13825112b7e07a5b2423fcb7f4e86991e4fbf1659eb28d7b8e262485ea48dff4d2464bf642b141dd4ff4d91f4b

memory/3028-8-0x0000000074CF0000-0x00000000753DE000-memory.dmp

\Users\ToxicEye\rat.exe

MD5 d39f50f7840e788f9aabb6fc571b954b
SHA1 b3a05caf1aa8b5767a9f84f57fd269ab0a7034f4
SHA256 58e05a5c06fdf6566e9b58805b90a33568a2a1e67fd973c9a95b4b8d3be1d375
SHA512 dd3dbb76b910f2f1e265dc68e7b12aa92e3fafc0839181fdd8ca800cbc39a7d57d57dd1316800358cff5d523643a61d57c4f695e1c598bf2bc21b494a3745fce

memory/2508-11-0x0000000002050000-0x00000000023F4000-memory.dmp

C:\Users\ToxicEye\rat.exe

MD5 d39f50f7840e788f9aabb6fc571b954b
SHA1 b3a05caf1aa8b5767a9f84f57fd269ab0a7034f4
SHA256 58e05a5c06fdf6566e9b58805b90a33568a2a1e67fd973c9a95b4b8d3be1d375
SHA512 dd3dbb76b910f2f1e265dc68e7b12aa92e3fafc0839181fdd8ca800cbc39a7d57d57dd1316800358cff5d523643a61d57c4f695e1c598bf2bc21b494a3745fce

memory/2272-13-0x0000000000840000-0x0000000000BE4000-memory.dmp

C:\Users\ToxicEye\rat.exe

MD5 d39f50f7840e788f9aabb6fc571b954b
SHA1 b3a05caf1aa8b5767a9f84f57fd269ab0a7034f4
SHA256 58e05a5c06fdf6566e9b58805b90a33568a2a1e67fd973c9a95b4b8d3be1d375
SHA512 dd3dbb76b910f2f1e265dc68e7b12aa92e3fafc0839181fdd8ca800cbc39a7d57d57dd1316800358cff5d523643a61d57c4f695e1c598bf2bc21b494a3745fce

memory/2272-14-0x0000000000840000-0x0000000000BE4000-memory.dmp

memory/2272-15-0x0000000074D10000-0x00000000753FE000-memory.dmp

memory/2272-16-0x0000000002560000-0x00000000025A0000-memory.dmp

memory/2272-17-0x0000000000840000-0x0000000000BE4000-memory.dmp

memory/2272-18-0x0000000000840000-0x0000000000BE4000-memory.dmp

memory/2272-19-0x0000000074D10000-0x00000000753FE000-memory.dmp

memory/2272-20-0x0000000002560000-0x00000000025A0000-memory.dmp

memory/2272-21-0x0000000000840000-0x0000000000BE4000-memory.dmp

memory/2272-22-0x0000000000840000-0x0000000000BE4000-memory.dmp

memory/2272-23-0x0000000000840000-0x0000000000BE4000-memory.dmp

memory/2272-24-0x0000000000840000-0x0000000000BE4000-memory.dmp

memory/2272-25-0x0000000000840000-0x0000000000BE4000-memory.dmp

memory/2272-26-0x0000000000840000-0x0000000000BE4000-memory.dmp

memory/2272-27-0x0000000000840000-0x0000000000BE4000-memory.dmp

memory/2272-28-0x0000000000840000-0x0000000000BE4000-memory.dmp

memory/2272-29-0x0000000000840000-0x0000000000BE4000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-11-12 16:01

Reported

2023-11-12 16:03

Platform

win10-20231023-en

Max time kernel

136s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\lib.exe"

Signatures

ToxicEye

rat trojan toxiceye

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\ToxicEye\rat.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\lib.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\lib.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Users\ToxicEye\rat.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\lib.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2456 wrote to memory of 4020 N/A C:\Users\Admin\AppData\Local\Temp\lib.exe C:\Windows\SysWOW64\schtasks.exe
PID 2456 wrote to memory of 4020 N/A C:\Users\Admin\AppData\Local\Temp\lib.exe C:\Windows\SysWOW64\schtasks.exe
PID 2456 wrote to memory of 4020 N/A C:\Users\Admin\AppData\Local\Temp\lib.exe C:\Windows\SysWOW64\schtasks.exe
PID 2456 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\lib.exe C:\Windows\SysWOW64\cmd.exe
PID 2456 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\lib.exe C:\Windows\SysWOW64\cmd.exe
PID 2456 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\lib.exe C:\Windows\SysWOW64\cmd.exe
PID 2316 wrote to memory of 796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2316 wrote to memory of 796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2316 wrote to memory of 796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2316 wrote to memory of 2080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2316 wrote to memory of 2080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2316 wrote to memory of 2080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2316 wrote to memory of 4260 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2316 wrote to memory of 4260 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2316 wrote to memory of 4260 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2316 wrote to memory of 4144 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\ToxicEye\rat.exe
PID 2316 wrote to memory of 4144 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\ToxicEye\rat.exe
PID 2316 wrote to memory of 4144 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\ToxicEye\rat.exe
PID 4144 wrote to memory of 4960 N/A C:\Users\ToxicEye\rat.exe C:\Windows\SysWOW64\schtasks.exe
PID 4144 wrote to memory of 4960 N/A C:\Users\ToxicEye\rat.exe C:\Windows\SysWOW64\schtasks.exe
PID 4144 wrote to memory of 4960 N/A C:\Users\ToxicEye\rat.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\lib.exe

"C:\Users\Admin\AppData\Local\Temp\lib.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpC36F.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpC36F.tmp.bat

C:\Windows\SysWOW64\find.exe

find ":"

C:\Windows\SysWOW64\tasklist.exe

Tasklist /fi "PID eq 2456"

C:\Windows\SysWOW64\timeout.exe

Timeout /T 1 /Nobreak

C:\Users\ToxicEye\rat.exe

"rat.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 13.97.120.100.in-addr.arpa udp
US 8.8.8.8:53 165.231.90.100.in-addr.arpa udp
US 8.8.8.8:53 201.175.97.100.in-addr.arpa udp

Files

memory/2456-0-0x0000000000320000-0x00000000006C4000-memory.dmp

memory/2456-2-0x0000000072FA0000-0x000000007368E000-memory.dmp

memory/2456-1-0x0000000000320000-0x00000000006C4000-memory.dmp

memory/2456-3-0x0000000006A60000-0x0000000006F5E000-memory.dmp

memory/2456-4-0x0000000006390000-0x0000000006422000-memory.dmp

memory/2456-5-0x0000000006550000-0x0000000006560000-memory.dmp

memory/2456-6-0x0000000006430000-0x0000000006496000-memory.dmp

memory/2456-10-0x0000000000320000-0x00000000006C4000-memory.dmp

memory/2456-11-0x0000000072FA0000-0x000000007368E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpC36F.tmp.bat

MD5 1ac3fe7dedfafff46028ab61e7d5c9b5
SHA1 97fdd75caecb296bf172d6301746bcdb66a178f9
SHA256 8e9fda2f0b46fa69d57c32de014b6ec29a46170aba33ce5159420ed4fa3a8b70
SHA512 1a31237081d1defa50ab4f03dc94d8b044119bf264005c958b68f3107a782981ac184e11a4c7f636bc229395df85b47539705b226f2c3ca440e9adf6dd9ddb53

C:\Users\ToxicEye\rat.exe

MD5 d39f50f7840e788f9aabb6fc571b954b
SHA1 b3a05caf1aa8b5767a9f84f57fd269ab0a7034f4
SHA256 58e05a5c06fdf6566e9b58805b90a33568a2a1e67fd973c9a95b4b8d3be1d375
SHA512 dd3dbb76b910f2f1e265dc68e7b12aa92e3fafc0839181fdd8ca800cbc39a7d57d57dd1316800358cff5d523643a61d57c4f695e1c598bf2bc21b494a3745fce

memory/4144-15-0x0000000001270000-0x0000000001614000-memory.dmp

C:\Users\ToxicEye\rat.exe

MD5 d39f50f7840e788f9aabb6fc571b954b
SHA1 b3a05caf1aa8b5767a9f84f57fd269ab0a7034f4
SHA256 58e05a5c06fdf6566e9b58805b90a33568a2a1e67fd973c9a95b4b8d3be1d375
SHA512 dd3dbb76b910f2f1e265dc68e7b12aa92e3fafc0839181fdd8ca800cbc39a7d57d57dd1316800358cff5d523643a61d57c4f695e1c598bf2bc21b494a3745fce

memory/4144-18-0x0000000072FA0000-0x000000007368E000-memory.dmp

memory/4144-17-0x0000000001270000-0x0000000001614000-memory.dmp

memory/4144-19-0x0000000001270000-0x0000000001614000-memory.dmp

memory/4144-20-0x0000000002EB0000-0x0000000002EC0000-memory.dmp

memory/4144-21-0x0000000001270000-0x0000000001614000-memory.dmp

memory/4144-22-0x0000000001270000-0x0000000001614000-memory.dmp

memory/4144-23-0x0000000001270000-0x0000000001614000-memory.dmp

memory/4144-24-0x0000000072FA0000-0x000000007368E000-memory.dmp

memory/4144-25-0x0000000002EB0000-0x0000000002EC0000-memory.dmp

memory/4144-26-0x0000000001270000-0x0000000001614000-memory.dmp

memory/4144-27-0x0000000001270000-0x0000000001614000-memory.dmp

memory/4144-28-0x0000000001270000-0x0000000001614000-memory.dmp

memory/4144-29-0x0000000001270000-0x0000000001614000-memory.dmp

memory/4144-30-0x0000000001270000-0x0000000001614000-memory.dmp

memory/4144-31-0x0000000001270000-0x0000000001614000-memory.dmp

memory/4144-32-0x0000000001270000-0x0000000001614000-memory.dmp

memory/4144-33-0x0000000001270000-0x0000000001614000-memory.dmp

memory/4144-34-0x0000000001270000-0x0000000001614000-memory.dmp

memory/4144-35-0x0000000001270000-0x0000000001614000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2023-11-12 16:01

Reported

2023-11-12 16:03

Platform

win10v2004-20231020-en

Max time kernel

137s

Max time network

135s

Command Line

"C:\Users\Admin\AppData\Local\Temp\lib.exe"

Signatures

ToxicEye

rat trojan toxiceye

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\lib.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation C:\Users\ToxicEye\rat.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\ToxicEye\rat.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\lib.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lib.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\lib.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Users\ToxicEye\rat.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\lib.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3884 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\lib.exe C:\Windows\SysWOW64\schtasks.exe
PID 3884 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\lib.exe C:\Windows\SysWOW64\schtasks.exe
PID 3884 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\lib.exe C:\Windows\SysWOW64\schtasks.exe
PID 3884 wrote to memory of 4688 N/A C:\Users\Admin\AppData\Local\Temp\lib.exe C:\Windows\SysWOW64\cmd.exe
PID 3884 wrote to memory of 4688 N/A C:\Users\Admin\AppData\Local\Temp\lib.exe C:\Windows\SysWOW64\cmd.exe
PID 3884 wrote to memory of 4688 N/A C:\Users\Admin\AppData\Local\Temp\lib.exe C:\Windows\SysWOW64\cmd.exe
PID 4688 wrote to memory of 1284 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 4688 wrote to memory of 1284 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 4688 wrote to memory of 1284 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 4688 wrote to memory of 864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 4688 wrote to memory of 864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 4688 wrote to memory of 864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 4688 wrote to memory of 2216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4688 wrote to memory of 2216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4688 wrote to memory of 2216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4688 wrote to memory of 3264 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\ToxicEye\rat.exe
PID 4688 wrote to memory of 3264 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\ToxicEye\rat.exe
PID 4688 wrote to memory of 3264 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\ToxicEye\rat.exe
PID 3264 wrote to memory of 64 N/A C:\Users\ToxicEye\rat.exe C:\Windows\SysWOW64\schtasks.exe
PID 3264 wrote to memory of 64 N/A C:\Users\ToxicEye\rat.exe C:\Windows\SysWOW64\schtasks.exe
PID 3264 wrote to memory of 64 N/A C:\Users\ToxicEye\rat.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\lib.exe

"C:\Users\Admin\AppData\Local\Temp\lib.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp972F.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp972F.tmp.bat

C:\Windows\SysWOW64\tasklist.exe

Tasklist /fi "PID eq 3884"

C:\Windows\SysWOW64\find.exe

find ":"

C:\Windows\SysWOW64\timeout.exe

Timeout /T 1 /Nobreak

C:\Users\ToxicEye\rat.exe

"rat.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 210.24.91.100.in-addr.arpa udp
US 8.8.8.8:53 53.77.110.100.in-addr.arpa udp
US 8.8.8.8:53 33.18.72.100.in-addr.arpa udp
US 8.8.8.8:53 26.165.74.100.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
N/A 100.98.218.248:443 g.bing.com tcp
N/A 100.98.218.248:443 g.bing.com tcp
N/A 100.98.218.248:443 g.bing.com tcp
US 8.8.8.8:53 29.253.104.100.in-addr.arpa udp
US 8.8.8.8:53 248.218.98.100.in-addr.arpa udp
US 8.8.8.8:53 135.46.126.100.in-addr.arpa udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 238.120.78.100.in-addr.arpa udp
US 8.8.8.8:53 179.138.99.100.in-addr.arpa udp
US 52.111.227.11:443 tcp
US 8.8.8.8:53 151.60.117.100.in-addr.arpa udp

Files

memory/3884-0-0x0000000000A60000-0x0000000000E04000-memory.dmp

memory/3884-1-0x0000000073DC0000-0x0000000074570000-memory.dmp

memory/3884-2-0x0000000000A60000-0x0000000000E04000-memory.dmp

memory/3884-3-0x0000000006DC0000-0x0000000007364000-memory.dmp

memory/3884-4-0x00000000068B0000-0x0000000006942000-memory.dmp

memory/3884-5-0x0000000006800000-0x0000000006810000-memory.dmp

memory/3884-6-0x0000000006950000-0x00000000069B6000-memory.dmp

memory/3884-10-0x0000000000A60000-0x0000000000E04000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp972F.tmp.bat

MD5 fff08585aef977eb6db263413ddebd5f
SHA1 2470efa69aeaca5cc09c9401a0d62d9c2c845bcc
SHA256 e0f4342e464c3cca7a05e45bbc9305151707e8cd7106949d8a6f2d8d546d5163
SHA512 8872a24cb4a58be02a65a74bee503040c36893d46a51987c1cb06d47104eca401fba4033ca4f5ac718334426221f5d1a047fa38d9eda563f099c60db94053436

memory/3884-12-0x0000000073DC0000-0x0000000074570000-memory.dmp

C:\Users\ToxicEye\rat.exe

MD5 d39f50f7840e788f9aabb6fc571b954b
SHA1 b3a05caf1aa8b5767a9f84f57fd269ab0a7034f4
SHA256 58e05a5c06fdf6566e9b58805b90a33568a2a1e67fd973c9a95b4b8d3be1d375
SHA512 dd3dbb76b910f2f1e265dc68e7b12aa92e3fafc0839181fdd8ca800cbc39a7d57d57dd1316800358cff5d523643a61d57c4f695e1c598bf2bc21b494a3745fce

memory/3264-15-0x0000000000040000-0x00000000003E4000-memory.dmp

C:\Users\ToxicEye\rat.exe

MD5 d39f50f7840e788f9aabb6fc571b954b
SHA1 b3a05caf1aa8b5767a9f84f57fd269ab0a7034f4
SHA256 58e05a5c06fdf6566e9b58805b90a33568a2a1e67fd973c9a95b4b8d3be1d375
SHA512 dd3dbb76b910f2f1e265dc68e7b12aa92e3fafc0839181fdd8ca800cbc39a7d57d57dd1316800358cff5d523643a61d57c4f695e1c598bf2bc21b494a3745fce

memory/3264-17-0x0000000073DC0000-0x0000000074570000-memory.dmp

memory/3264-18-0x0000000000040000-0x00000000003E4000-memory.dmp

memory/3264-19-0x0000000000040000-0x00000000003E4000-memory.dmp

memory/3264-20-0x0000000006540000-0x0000000006550000-memory.dmp

memory/3264-21-0x0000000000040000-0x00000000003E4000-memory.dmp

memory/3264-22-0x0000000000040000-0x00000000003E4000-memory.dmp

memory/3264-23-0x0000000000040000-0x00000000003E4000-memory.dmp

memory/3264-24-0x0000000073DC0000-0x0000000074570000-memory.dmp

memory/3264-25-0x0000000006540000-0x0000000006550000-memory.dmp

memory/3264-26-0x0000000000040000-0x00000000003E4000-memory.dmp

memory/3264-27-0x0000000000040000-0x00000000003E4000-memory.dmp

memory/3264-28-0x0000000000040000-0x00000000003E4000-memory.dmp

memory/3264-29-0x0000000000040000-0x00000000003E4000-memory.dmp

memory/3264-30-0x0000000000040000-0x00000000003E4000-memory.dmp

memory/3264-31-0x0000000000040000-0x00000000003E4000-memory.dmp

memory/3264-32-0x0000000000040000-0x00000000003E4000-memory.dmp

memory/3264-33-0x0000000000040000-0x00000000003E4000-memory.dmp

memory/3264-34-0x0000000000040000-0x00000000003E4000-memory.dmp

memory/3264-35-0x0000000000040000-0x00000000003E4000-memory.dmp