toxiceye | 872d241e41e2b657746d8d66b3bce7377790d9793d987929482f088f960c8591

General

Target

TelegramRAT.exe
Size

141KB
MD5

2e421076fded17a6c3643d2d65b6d344
SHA1

8c2d9e0e6b16ab6ddeaacf661f5bf7b472911dd5
SHA256

872d241e41e2b657746d8d66b3bce7377790d9793d987929482f088f960c8591
SHA512

1f275c68f898d96cb34ac2027016ee78b0ac2211dc5003ba94c07ea93a66eecd1935c3a14b6b16826447d3beb93f1162499d3fe69fdc49b06c8fd1647812601d
SSDEEP

3072:lkSfx+nPu2KiQQ7+ofe7Uoxo1bKm1/QW4aCrAZrxIhsz:Sax+nmSn7B1bZ32

Score

10^/10

toxiceye rat trojan

Malware Config

Extracted

Family

toxiceye

C2

https://api.telegram.org/bot7040511851:AAEjBKSxADGWlNtLxaKpotGtf53NUQ1UgAo/sendMessage?chat_id=6226815698

Signatures

ToxicEye
ToxicEye is a trojan written in C#.
rat trojan toxiceye
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2456 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

rat.exe

pid process

1212 rat.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1484 schtasks.exe
948 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2504 timeout.exe
Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

2836 tasklist.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rat.exe

pid process

1212 rat.exe
1212 rat.exe

pid	process
2456	cmd.exe

pid	process
1212	rat.exe

pid	process
1484	schtasks.exe
948	schtasks.exe

pid	process
2504	timeout.exe

pid	process
2836	tasklist.exe

pid	process
1212	rat.exe
1212	rat.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

TelegramRAT.exetasklist.exerat.exe

description	pid	process
Token: SeDebugPrivilege	2368	TelegramRAT.exe
Token: SeDebugPrivilege	2836	tasklist.exe
Token: SeDebugPrivilege	1212	rat.exe
Token: SeDebugPrivilege	1212	rat.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rat.exe

pid process

1212 rat.exe

pid	process
1212	rat.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

TelegramRAT.execmd.exerat.exe

description	pid	process	target process
PID 2368 wrote to memory of 1484	2368	TelegramRAT.exe	schtasks.exe
PID 2368 wrote to memory of 1484	2368	TelegramRAT.exe	schtasks.exe
PID 2368 wrote to memory of 1484	2368	TelegramRAT.exe	schtasks.exe
PID 2368 wrote to memory of 2456	2368	TelegramRAT.exe	cmd.exe
PID 2368 wrote to memory of 2456	2368	TelegramRAT.exe	cmd.exe
PID 2368 wrote to memory of 2456	2368	TelegramRAT.exe	cmd.exe
PID 2456 wrote to memory of 2836	2456	cmd.exe	tasklist.exe
PID 2456 wrote to memory of 2836	2456	cmd.exe	tasklist.exe
PID 2456 wrote to memory of 2836	2456	cmd.exe	tasklist.exe
PID 2456 wrote to memory of 2476	2456	cmd.exe	find.exe
PID 2456 wrote to memory of 2476	2456	cmd.exe	find.exe
PID 2456 wrote to memory of 2476	2456	cmd.exe	find.exe
PID 2456 wrote to memory of 2504	2456	cmd.exe	timeout.exe
PID 2456 wrote to memory of 2504	2456	cmd.exe	timeout.exe
PID 2456 wrote to memory of 2504	2456	cmd.exe	timeout.exe
PID 2456 wrote to memory of 1212	2456	cmd.exe	rat.exe
PID 2456 wrote to memory of 1212	2456	cmd.exe	rat.exe
PID 2456 wrote to memory of 1212	2456	cmd.exe	rat.exe
PID 1212 wrote to memory of 948	1212	rat.exe	schtasks.exe
PID 1212 wrote to memory of 948	1212	rat.exe	schtasks.exe
PID 1212 wrote to memory of 948	1212	rat.exe	schtasks.exe
PID 1212 wrote to memory of 528	1212	rat.exe	WerFault.exe
PID 1212 wrote to memory of 528	1212	rat.exe	WerFault.exe
PID 1212 wrote to memory of 528	1212	rat.exe	WerFault.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe
"C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\a\rat.exe"
  2⤵
  - Creates scheduled task(s)
  PID:1484
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp4EFA.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp4EFA.tmp.bat
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2368"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2836
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2476
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2504
- - C:\a\rat.exe
    "rat.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1212
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\a\rat.exe"
      4⤵
      Creates scheduled task(s)
      PID:948
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1212 -s 1568
      4⤵
      PID:528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Process Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp4EFA.tmp.bat

Filesize
175B

MD5
d5b9d918d4eea15d4269d712755493a9

SHA1
df3a28bf5c0533161e944ac8ee6665101960bb5c

SHA256
6ae3e6cc9b3bccdef1fe47e3829d2ee0aee4daf82aa69335ef61572bc9d0b6fa

SHA512
031be5c54d39c37569da2ddc63e7615c6bb8f651efa5c71e8c548f59bd53dae6e0db2545748abf665d384bb4aee36be8a9cd19e47189e41cf983bce10d699bc7

Download Submit
C:\a\rat.exe

Filesize
141KB

MD5
2e421076fded17a6c3643d2d65b6d344

SHA1
8c2d9e0e6b16ab6ddeaacf661f5bf7b472911dd5

SHA256
872d241e41e2b657746d8d66b3bce7377790d9793d987929482f088f960c8591

SHA512
1f275c68f898d96cb34ac2027016ee78b0ac2211dc5003ba94c07ea93a66eecd1935c3a14b6b16826447d3beb93f1162499d3fe69fdc49b06c8fd1647812601d

Download Submit
memory/1212-10-0x0000000001010000-0x000000000103A000-memory.dmp

Filesize
168KB

Download
memory/1212-11-0x000007FEF5820000-0x000007FEF620C000-memory.dmp

Filesize
9.9MB

Download
memory/1212-12-0x000007FEF5820000-0x000007FEF620C000-memory.dmp

Filesize
9.9MB

Download
memory/2368-0-0x0000000001390000-0x00000000013BA000-memory.dmp

Filesize
168KB

Download
memory/2368-1-0x000007FEF6210000-0x000007FEF6BFC000-memory.dmp

Filesize
9.9MB

Download
memory/2368-2-0x000000001AFE0000-0x000000001B060000-memory.dmp

Filesize
512KB

Download
memory/2368-6-0x000007FEF6210000-0x000007FEF6BFC000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads