toxiceye | 872d241e41e2b657746d8d66b3bce7377790d9793d987929482f088f960c8591

General

Target

TelegramRAT.exe
Size

141KB
MD5

2e421076fded17a6c3643d2d65b6d344
SHA1

8c2d9e0e6b16ab6ddeaacf661f5bf7b472911dd5
SHA256

872d241e41e2b657746d8d66b3bce7377790d9793d987929482f088f960c8591
SHA512

1f275c68f898d96cb34ac2027016ee78b0ac2211dc5003ba94c07ea93a66eecd1935c3a14b6b16826447d3beb93f1162499d3fe69fdc49b06c8fd1647812601d
SSDEEP

3072:lkSfx+nPu2KiQQ7+ofe7Uoxo1bKm1/QW4aCrAZrxIhsz:Sax+nmSn7B1bZ32

Score

10^/10

toxiceye rat trojan

Malware Config

Extracted

Family

toxiceye

C2

https://api.telegram.org/bot7040511851:AAEjBKSxADGWlNtLxaKpotGtf53NUQ1UgAo/sendMessage?chat_id=6226815698

Signatures

ToxicEye
ToxicEye is a trojan written in C#.
rat trojan toxiceye

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

TelegramRAT.exerat.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	TelegramRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	rat.exe

Executes dropped EXE 1 IoCs

Processes:

rat.exe

pid process

3568 rat.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service
T1102

Processes:

flow ioc

34 raw.githubusercontent.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2424 schtasks.exe
1796 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

4220 timeout.exe
Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

3688 tasklist.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

rat.exe

pid process

3568 rat.exe
3568 rat.exe
3568 rat.exe
3568 rat.exe
3568 rat.exe

pid	process
3568	rat.exe

flow	ioc
34	raw.githubusercontent.com

pid	process
2424	schtasks.exe
1796	schtasks.exe

pid	process
4220	timeout.exe

pid	process
3688	tasklist.exe

pid	process
3568	rat.exe
3568	rat.exe
3568	rat.exe
3568	rat.exe
3568	rat.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

TelegramRAT.exetasklist.exerat.exe

description	pid	process
Token: SeDebugPrivilege	4032	TelegramRAT.exe
Token: SeDebugPrivilege	3688	tasklist.exe
Token: SeDebugPrivilege	3568	rat.exe
Token: SeDebugPrivilege	3568	rat.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rat.exe

pid process

3568 rat.exe

pid	process
3568	rat.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

TelegramRAT.execmd.exerat.exe

description	pid	process	target process
PID 4032 wrote to memory of 2424	4032	TelegramRAT.exe	schtasks.exe
PID 4032 wrote to memory of 2424	4032	TelegramRAT.exe	schtasks.exe
PID 4032 wrote to memory of 3400	4032	TelegramRAT.exe	cmd.exe
PID 4032 wrote to memory of 3400	4032	TelegramRAT.exe	cmd.exe
PID 3400 wrote to memory of 3688	3400	cmd.exe	tasklist.exe
PID 3400 wrote to memory of 3688	3400	cmd.exe	tasklist.exe
PID 3400 wrote to memory of 3176	3400	cmd.exe	find.exe
PID 3400 wrote to memory of 3176	3400	cmd.exe	find.exe
PID 3400 wrote to memory of 4220	3400	cmd.exe	timeout.exe
PID 3400 wrote to memory of 4220	3400	cmd.exe	timeout.exe
PID 3400 wrote to memory of 3568	3400	cmd.exe	rat.exe
PID 3400 wrote to memory of 3568	3400	cmd.exe	rat.exe
PID 3568 wrote to memory of 1796	3568	rat.exe	schtasks.exe
PID 3568 wrote to memory of 1796	3568	rat.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe
"C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\a\rat.exe"
  2⤵
  - Creates scheduled task(s)
  PID:2424
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpE81E.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpE81E.tmp.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3400
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 4032"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3688
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:3176
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4220
- - C:\a\rat.exe
    "rat.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3568
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\a\rat.exe"
      4⤵
      Creates scheduled task(s)
      PID:1796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3844 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
1⤵
PID:568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Process Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpE81E.tmp.bat

Filesize
175B

MD5
5fa6ce82c7f52aa7fbbc320e1d17b196

SHA1
a9329971cac9e20ff49c8479296b13885f20bf1f

SHA256
04ae9b0d1974e8bc61488df89c92bc731bcfa47e4cc6e7ec64cf22c0d78c0455

SHA512
837ffd4badc02d532a9adeecbd81bed517f7d2fc4026df5d23a0d104326377ff3e9c6a88781eadf7abd9bde7c3716996f03a4bab4b779a38446be1ac0b307085

Download Submit
C:\a\rat.exe

Filesize
141KB

MD5
2e421076fded17a6c3643d2d65b6d344

SHA1
8c2d9e0e6b16ab6ddeaacf661f5bf7b472911dd5

SHA256
872d241e41e2b657746d8d66b3bce7377790d9793d987929482f088f960c8591

SHA512
1f275c68f898d96cb34ac2027016ee78b0ac2211dc5003ba94c07ea93a66eecd1935c3a14b6b16826447d3beb93f1162499d3fe69fdc49b06c8fd1647812601d

Download Submit
memory/3568-11-0x00007FFEAB9D0000-0x00007FFEAC491000-memory.dmp

Filesize
10.8MB

Download
memory/3568-12-0x0000025A43EF0000-0x0000025A43F00000-memory.dmp

Filesize
64KB

Download
memory/3568-14-0x0000025A5EE90000-0x0000025A5EE9A000-memory.dmp

Filesize
40KB

Download
memory/3568-16-0x0000025A5F1C0000-0x0000025A5F1D2000-memory.dmp

Filesize
72KB

Download
memory/3568-17-0x00007FFEAB9D0000-0x00007FFEAC491000-memory.dmp

Filesize
10.8MB

Download
memory/4032-0-0x000002618B1D0000-0x000002618B1FA000-memory.dmp

Filesize
168KB

Download
memory/4032-1-0x00007FFEABB00000-0x00007FFEAC5C1000-memory.dmp

Filesize
10.8MB

Download
memory/4032-2-0x00000261A5610000-0x00000261A5620000-memory.dmp

Filesize
64KB

Download
memory/4032-6-0x00007FFEABB00000-0x00007FFEAC5C1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads