toxiceye | d33e97596d19884faf2d19e3c33799bff12a790062e98522ff30db4236ff170b

General

Target

TelegramRAT.exe
Size

141KB
MD5

ed2c7bc269dac9dd4478f1dc773de9f6
SHA1

a2bf4318a949329308799ccfc3d2379acf304d77
SHA256

d33e97596d19884faf2d19e3c33799bff12a790062e98522ff30db4236ff170b
SHA512

afeda67797e52f3fe873f8da0454028bcb3eed09b39596c69333cf09b79c91161add4f7b6992078a114abb2190e4e4f0fa98da83748fcf20cd07ce27bbc73b46
SSDEEP

3072:BnFBrznkLAWjtnXGXM9bA9D5QW4aCrAZr1m/Nf:lDznkcKWc9bA38

Score

10^/10

toxiceye rat trojan

Malware Config

Extracted

Family

toxiceye

C2

https://api.telegram.org/bot7040511851:AAEjBKSxADGWlNtLxaKpotGtf53NUQ1UgAo/sendMessage?chat_id=6226815698

Signatures

ToxicEye
ToxicEye is a trojan written in C#.
rat trojan toxiceye
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2836 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

rat.exe

pid process

2604 rat.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2568 schtasks.exe
476 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2508 timeout.exe
Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

2480 tasklist.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rat.exe

pid process

2604 rat.exe
2604 rat.exe

pid	process
2836	cmd.exe

pid	process
2604	rat.exe

pid	process
2568	schtasks.exe
476	schtasks.exe

pid	process
2508	timeout.exe

pid	process
2480	tasklist.exe

pid	process
2604	rat.exe
2604	rat.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

TelegramRAT.exetasklist.exerat.exe

description	pid	process
Token: SeDebugPrivilege	2320	TelegramRAT.exe
Token: SeDebugPrivilege	2480	tasklist.exe
Token: SeDebugPrivilege	2604	rat.exe
Token: SeDebugPrivilege	2604	rat.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rat.exe

pid process

2604 rat.exe

pid	process
2604	rat.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

TelegramRAT.execmd.exerat.exe

description	pid	process	target process
PID 2320 wrote to memory of 2568	2320	TelegramRAT.exe	schtasks.exe
PID 2320 wrote to memory of 2568	2320	TelegramRAT.exe	schtasks.exe
PID 2320 wrote to memory of 2568	2320	TelegramRAT.exe	schtasks.exe
PID 2320 wrote to memory of 2836	2320	TelegramRAT.exe	cmd.exe
PID 2320 wrote to memory of 2836	2320	TelegramRAT.exe	cmd.exe
PID 2320 wrote to memory of 2836	2320	TelegramRAT.exe	cmd.exe
PID 2836 wrote to memory of 2480	2836	cmd.exe	tasklist.exe
PID 2836 wrote to memory of 2480	2836	cmd.exe	tasklist.exe
PID 2836 wrote to memory of 2480	2836	cmd.exe	tasklist.exe
PID 2836 wrote to memory of 2488	2836	cmd.exe	find.exe
PID 2836 wrote to memory of 2488	2836	cmd.exe	find.exe
PID 2836 wrote to memory of 2488	2836	cmd.exe	find.exe
PID 2836 wrote to memory of 2508	2836	cmd.exe	timeout.exe
PID 2836 wrote to memory of 2508	2836	cmd.exe	timeout.exe
PID 2836 wrote to memory of 2508	2836	cmd.exe	timeout.exe
PID 2836 wrote to memory of 2604	2836	cmd.exe	rat.exe
PID 2836 wrote to memory of 2604	2836	cmd.exe	rat.exe
PID 2836 wrote to memory of 2604	2836	cmd.exe	rat.exe
PID 2604 wrote to memory of 476	2604	rat.exe	schtasks.exe
PID 2604 wrote to memory of 476	2604	rat.exe	schtasks.exe
PID 2604 wrote to memory of 476	2604	rat.exe	schtasks.exe
PID 2604 wrote to memory of 2864	2604	rat.exe	WerFault.exe
PID 2604 wrote to memory of 2864	2604	rat.exe	WerFault.exe
PID 2604 wrote to memory of 2864	2604	rat.exe	WerFault.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe
"C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\CyberEye\rat.exe"
  2⤵
  - Creates scheduled task(s)
  PID:2568
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp78D8.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp78D8.tmp.bat
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2320"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2480
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2488
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2508
- - C:\Users\CyberEye\rat.exe
    "rat.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\CyberEye\rat.exe"
      4⤵
      Creates scheduled task(s)
      PID:476
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2604 -s 1584
      4⤵
      PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Process Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp78D8.tmp.bat

Filesize
188B

MD5
d83308c0c1dfe50749a90a4dafc23cd8

SHA1
c7d6884b7041692ab6394d92963ac9bd67b5691b

SHA256
2f282e046a4d348b89c3ab94d959c3d7cf0eb3ad0f2b367d003fdba60c141044

SHA512
8e35d85d45927549c18bf5e5c20fca40ad10c194abefd1839544f5284989c04cd46f9abcbcf430f2d1b9d95f0fbe89baabaa4ce84c69f2e551a63886121775c5

Download Submit
C:\Users\CyberEye\rat.exe

Filesize
141KB

MD5
ed2c7bc269dac9dd4478f1dc773de9f6

SHA1
a2bf4318a949329308799ccfc3d2379acf304d77

SHA256
d33e97596d19884faf2d19e3c33799bff12a790062e98522ff30db4236ff170b

SHA512
afeda67797e52f3fe873f8da0454028bcb3eed09b39596c69333cf09b79c91161add4f7b6992078a114abb2190e4e4f0fa98da83748fcf20cd07ce27bbc73b46

Download Submit
memory/2320-0-0x0000000001090000-0x00000000010BA000-memory.dmp

Filesize
168KB

Download
memory/2320-1-0x000007FEF55D0000-0x000007FEF5FBC000-memory.dmp

Filesize
9.9MB

Download
memory/2320-2-0x000000001B010000-0x000000001B090000-memory.dmp

Filesize
512KB

Download
memory/2320-6-0x000007FEF55D0000-0x000007FEF5FBC000-memory.dmp

Filesize
9.9MB

Download
memory/2604-10-0x0000000000E40000-0x0000000000E6A000-memory.dmp

Filesize
168KB

Download
memory/2604-11-0x000007FEF4BE0000-0x000007FEF55CC000-memory.dmp

Filesize
9.9MB

Download
memory/2604-12-0x000000001B140000-0x000000001B1C0000-memory.dmp

Filesize
512KB

Download
memory/2604-13-0x000007FEF4BE0000-0x000007FEF55CC000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads