toxiceye | ad28955c354a29a193dfe7dc9588f53c5c80ba6d9b305a1b61b8730be0695358

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20-12-2023 15:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d8a3fbd0660dff1dd3d85cd3ec62fe99.exe
Size

150KB
MD5

d8a3fbd0660dff1dd3d85cd3ec62fe99
SHA1

640febb6d6f64c3c3a9a6de193c168c30ab8dfb4
SHA256

ad28955c354a29a193dfe7dc9588f53c5c80ba6d9b305a1b61b8730be0695358
SHA512

8b0ef5a86bc866bec69adbd2dd04d98342f5fe7c5b275034742484ec446bb5fd44f969300e383ba5690963ab35619663fab28074a3b57b0a76dcea9ac8f9becb
SSDEEP

3072:MbiZnYUuQaS+T8sERvc7LLqmeUPL2QAgbupHhQW0zCrAZu6h3xzsNInS5g1h:1BYUuQaS+T8sERvc7KULbEchYiS5

Score

10^/10

toxiceye rat trojan

Malware Config

Extracted

Family

toxiceye

https://api.telegram.org/bot1929200100:AAFApHmZ6GD9WbEolE1gi0bnOTW4ipj-SSA/sendMessage?chat_id=1917426247

Signatures

ToxicEye
ToxicEye is a trojan written in C#.
rat trojan toxiceye

Deletes itself 1 IoCs

pid	Process
2816	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2860	Alien.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2828	schtasks.exe
1532	schtasks.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
2636	timeout.exe
2372	timeout.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
2624	tasklist.exe
2684	tasklist.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2860	Alien.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2860	Alien.exe
2860	Alien.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3020	d8a3fbd0660dff1dd3d85cd3ec62fe99.exe
Token: SeDebugPrivilege	2624	tasklist.exe
Token: SeDebugPrivilege	2684	tasklist.exe
Token: SeDebugPrivilege	2860	Alien.exe
Token: SeDebugPrivilege	2860	Alien.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2860	Alien.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2828	3020	d8a3fbd0660dff1dd3d85cd3ec62fe99.exe	29
PID 3020 wrote to memory of 2828	3020	d8a3fbd0660dff1dd3d85cd3ec62fe99.exe	29
PID 3020 wrote to memory of 2828	3020	d8a3fbd0660dff1dd3d85cd3ec62fe99.exe	29
PID 3020 wrote to memory of 2816	3020	d8a3fbd0660dff1dd3d85cd3ec62fe99.exe	31
PID 3020 wrote to memory of 2816	3020	d8a3fbd0660dff1dd3d85cd3ec62fe99.exe	31
PID 3020 wrote to memory of 2816	3020	d8a3fbd0660dff1dd3d85cd3ec62fe99.exe	31
PID 2816 wrote to memory of 2624	2816	cmd.exe	33
PID 2816 wrote to memory of 2624	2816	cmd.exe	33
PID 2816 wrote to memory of 2624	2816	cmd.exe	33
PID 2816 wrote to memory of 2784	2816	cmd.exe	34
PID 2816 wrote to memory of 2784	2816	cmd.exe	34
PID 2816 wrote to memory of 2784	2816	cmd.exe	34
PID 2816 wrote to memory of 2636	2816	cmd.exe	35
PID 2816 wrote to memory of 2636	2816	cmd.exe	35
PID 2816 wrote to memory of 2636	2816	cmd.exe	35
PID 2816 wrote to memory of 2684	2816	cmd.exe	37
PID 2816 wrote to memory of 2684	2816	cmd.exe	37
PID 2816 wrote to memory of 2684	2816	cmd.exe	37
PID 2816 wrote to memory of 2620	2816	cmd.exe	36
PID 2816 wrote to memory of 2620	2816	cmd.exe	36
PID 2816 wrote to memory of 2620	2816	cmd.exe	36
PID 2816 wrote to memory of 2372	2816	cmd.exe	38
PID 2816 wrote to memory of 2372	2816	cmd.exe	38
PID 2816 wrote to memory of 2372	2816	cmd.exe	38
PID 2816 wrote to memory of 2860	2816	cmd.exe	39
PID 2816 wrote to memory of 2860	2816	cmd.exe	39
PID 2816 wrote to memory of 2860	2816	cmd.exe	39
PID 2860 wrote to memory of 1532	2860	Alien.exe	41
PID 2860 wrote to memory of 1532	2860	Alien.exe	41
PID 2860 wrote to memory of 1532	2860	Alien.exe	41
PID 2860 wrote to memory of 1636	2860	Alien.exe	43
PID 2860 wrote to memory of 1636	2860	Alien.exe	43
PID 2860 wrote to memory of 1636	2860	Alien.exe	43

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\d8a3fbd0660dff1dd3d85cd3ec62fe99.exe
"C:\Users\Admin\AppData\Local\Temp\d8a3fbd0660dff1dd3d85cd3ec62fe99.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\Alien\Alien.exe"
  2⤵
  - Creates scheduled task(s)
  PID:2828
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp890D.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp890D.tmp.bat
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 3020"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2624
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2784
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2636
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2620
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 3020"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2684
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2372
- - C:\Users\Alien\Alien.exe
    "Alien.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2860
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\Alien\Alien.exe"
      4⤵
      Creates scheduled task(s)
      PID:1532
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2860 -s 1636
      4⤵
      PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp890D.tmp.bat

Filesize
208B

MD5
b3e897e20c7843f97ebc7625ecd4eb51

SHA1
1e8349eb38219a271d623c7f50b0a904dbcb41b0

SHA256
79bb7cc4a9f78334b92a9584ff10d2f608f91488d6a952f95c4987766fde26bb

SHA512
cf1b099a1ac5e0fa106cd195b960ff67cd257e9d8e7b34cac06c85de776ef33ad57d7b2ec8b5b5aabe8c89773ba0341b0eca73c2dbe5c1ce823b26cf3954e881

Download Submit
C:\Users\Alien\Alien.exe

Filesize
150KB

MD5
d8a3fbd0660dff1dd3d85cd3ec62fe99

SHA1
640febb6d6f64c3c3a9a6de193c168c30ab8dfb4

SHA256
ad28955c354a29a193dfe7dc9588f53c5c80ba6d9b305a1b61b8730be0695358

SHA512
8b0ef5a86bc866bec69adbd2dd04d98342f5fe7c5b275034742484ec446bb5fd44f969300e383ba5690963ab35619663fab28074a3b57b0a76dcea9ac8f9becb

Download Submit
memory/2860-10-0x0000000000820000-0x000000000084C000-memory.dmp

Filesize
176KB

Download
memory/2860-11-0x000007FEF4F00000-0x000007FEF58EC000-memory.dmp

Filesize
9.9MB

Download
memory/2860-12-0x000000001B130000-0x000000001B1B0000-memory.dmp

Filesize
512KB

Download
memory/2860-13-0x000007FEF4F00000-0x000007FEF58EC000-memory.dmp

Filesize
9.9MB

Download
memory/2860-14-0x000000001B130000-0x000000001B1B0000-memory.dmp

Filesize
512KB

Download
memory/3020-0-0x00000000000E0000-0x000000000010C000-memory.dmp

Filesize
176KB

Download
memory/3020-1-0x000007FEF58F0000-0x000007FEF62DC000-memory.dmp

Filesize
9.9MB

Download
memory/3020-2-0x000000001AFD0000-0x000000001B050000-memory.dmp

Filesize
512KB

Download
memory/3020-6-0x000007FEF58F0000-0x000007FEF62DC000-memory.dmp

Filesize
9.9MB

Download