toxiceye | dada83a7deb7c568532e54bbae01a7da1f5ca57f29918ec821027d3dcf00b49a

Analysis

max time kernel
316s
max time network
322s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 09:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TelegramRAT.exe
Size

111KB
MD5

8834c1eaf28b3b076df2a0aac5d1148e
SHA1

640e70c94c0e01492c4c45cf2b23b65914a94cc5
SHA256

49f704606ec839fa6867a5f5f67090299b69b02dab7d352e161c8a754165de8a
SHA512

59c6d085818d43607ee2aef904899690a116a34f6e50978c35017d1a546964bcdfc435b7fb09bab998d4d0eacc8b614a58a55c029311d7c33473a501f4f3f561
SSDEEP

1536:p+bvqJIP4M91qQIwzUrxxxdKy2nBfUbhDqI6CsQWVzCrAZuDZ6Dd:sbvqJe4MUlxxDrbxqHBQWVzCrAZuDQd

Score

10^/10

toxiceye evasion rat trojan

Malware Config

Extracted

Family

toxiceye

https://api.telegram.org/bot7005624592:AAFT1GroRFjOnavaa8nJipFR-iCuYT3f2xQ/sendMessage?chat_id=6235796510

Signatures

ToxicEye
ToxicEye is a trojan written in C#.
rat trojan toxiceye
Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

TelegramRAT.exerat.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	TelegramRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	rat.exe

Executes dropped EXE 1 IoCs

Processes:

rat.exe

pid process

2676 rat.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exefirefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4160 schtasks.exe
1304 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1588 timeout.exe
Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

832 tasklist.exe

pid	process
4160	schtasks.exe
1304	schtasks.exe

pid	process
1588	timeout.exe

pid	process
832	tasklist.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

Processes:

firefox.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3808065738-1666277613-1125846146-1000\{66F40AB7-66A4-4768-A5AF-D379B3CE408A}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

rat.exe

pid process

2676 rat.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rat.exe

pid	process
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

TelegramRAT.exetasklist.exerat.exe

description	pid	process
Token: SeDebugPrivilege	2916	TelegramRAT.exe
Token: SeDebugPrivilege	832	tasklist.exe
Token: SeDebugPrivilege	2676	rat.exe
Token: SeDebugPrivilege	2676	rat.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

firefox.exehelppane.exe

pid process

4944 firefox.exe
4944 firefox.exe
4944 firefox.exe
4944 firefox.exe
1396 helppane.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

firefox.exe

pid process

4944 firefox.exe
4944 firefox.exe
4944 firefox.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

rat.exefirefox.exehelppane.exe

pid process

2676 rat.exe
4944 firefox.exe
1396 helppane.exe
1396 helppane.exe

pid	process
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
1396	helppane.exe

pid	process
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

TelegramRAT.execmd.exerat.execmd.exefirefox.exefirefox.exe

description	pid	process	target process
PID 2916 wrote to memory of 4160	2916	TelegramRAT.exe	schtasks.exe
PID 2916 wrote to memory of 4160	2916	TelegramRAT.exe	schtasks.exe
PID 2916 wrote to memory of 3700	2916	TelegramRAT.exe	cmd.exe
PID 2916 wrote to memory of 3700	2916	TelegramRAT.exe	cmd.exe
PID 3700 wrote to memory of 832	3700	cmd.exe	tasklist.exe
PID 3700 wrote to memory of 832	3700	cmd.exe	tasklist.exe
PID 3700 wrote to memory of 4984	3700	cmd.exe	find.exe
PID 3700 wrote to memory of 4984	3700	cmd.exe	find.exe
PID 3700 wrote to memory of 1588	3700	cmd.exe	timeout.exe
PID 3700 wrote to memory of 1588	3700	cmd.exe	timeout.exe
PID 3700 wrote to memory of 2676	3700	cmd.exe	rat.exe
PID 3700 wrote to memory of 2676	3700	cmd.exe	rat.exe
PID 2676 wrote to memory of 1304	2676	rat.exe	schtasks.exe
PID 2676 wrote to memory of 1304	2676	rat.exe	schtasks.exe
PID 2676 wrote to memory of 3068	2676	rat.exe	cmd.exe
PID 2676 wrote to memory of 3068	2676	rat.exe	cmd.exe
PID 3068 wrote to memory of 2712	3068	cmd.exe	cmd.exe
PID 3068 wrote to memory of 2712	3068	cmd.exe	cmd.exe
PID 4084 wrote to memory of 4944	4084	firefox.exe	firefox.exe
PID 4084 wrote to memory of 4944	4084	firefox.exe	firefox.exe
PID 4084 wrote to memory of 4944	4084	firefox.exe	firefox.exe
PID 4084 wrote to memory of 4944	4084	firefox.exe	firefox.exe
PID 4084 wrote to memory of 4944	4084	firefox.exe	firefox.exe
PID 4084 wrote to memory of 4944	4084	firefox.exe	firefox.exe
PID 4084 wrote to memory of 4944	4084	firefox.exe	firefox.exe
PID 4084 wrote to memory of 4944	4084	firefox.exe	firefox.exe
PID 4084 wrote to memory of 4944	4084	firefox.exe	firefox.exe
PID 4084 wrote to memory of 4944	4084	firefox.exe	firefox.exe
PID 4084 wrote to memory of 4944	4084	firefox.exe	firefox.exe
PID 4944 wrote to memory of 876	4944	firefox.exe	firefox.exe
PID 4944 wrote to memory of 876	4944	firefox.exe	firefox.exe
PID 4944 wrote to memory of 2920	4944	firefox.exe	firefox.exe
PID 4944 wrote to memory of 2920	4944	firefox.exe	firefox.exe
PID 4944 wrote to memory of 2920	4944	firefox.exe	firefox.exe
PID 4944 wrote to memory of 2920	4944	firefox.exe	firefox.exe
PID 4944 wrote to memory of 2920	4944	firefox.exe	firefox.exe
PID 4944 wrote to memory of 2920	4944	firefox.exe	firefox.exe
PID 4944 wrote to memory of 2920	4944	firefox.exe	firefox.exe
PID 4944 wrote to memory of 2920	4944	firefox.exe	firefox.exe
PID 4944 wrote to memory of 2920	4944	firefox.exe	firefox.exe
PID 4944 wrote to memory of 2920	4944	firefox.exe	firefox.exe
PID 4944 wrote to memory of 2920	4944	firefox.exe	firefox.exe
PID 4944 wrote to memory of 2920	4944	firefox.exe	firefox.exe
PID 4944 wrote to memory of 2920	4944	firefox.exe	firefox.exe
PID 4944 wrote to memory of 2920	4944	firefox.exe	firefox.exe
PID 4944 wrote to memory of 2920	4944	firefox.exe	firefox.exe
PID 4944 wrote to memory of 2920	4944	firefox.exe	firefox.exe
PID 4944 wrote to memory of 2920	4944	firefox.exe	firefox.exe
PID 4944 wrote to memory of 2920	4944	firefox.exe	firefox.exe
PID 4944 wrote to memory of 2920	4944	firefox.exe	firefox.exe
PID 4944 wrote to memory of 2920	4944	firefox.exe	firefox.exe
PID 4944 wrote to memory of 2920	4944	firefox.exe	firefox.exe
PID 4944 wrote to memory of 2920	4944	firefox.exe	firefox.exe
PID 4944 wrote to memory of 2920	4944	firefox.exe	firefox.exe
PID 4944 wrote to memory of 2920	4944	firefox.exe	firefox.exe
PID 4944 wrote to memory of 2920	4944	firefox.exe	firefox.exe
PID 4944 wrote to memory of 2920	4944	firefox.exe	firefox.exe
PID 4944 wrote to memory of 2920	4944	firefox.exe	firefox.exe
PID 4944 wrote to memory of 2920	4944	firefox.exe	firefox.exe
PID 4944 wrote to memory of 2920	4944	firefox.exe	firefox.exe
PID 4944 wrote to memory of 2920	4944	firefox.exe	firefox.exe
PID 4944 wrote to memory of 2920	4944	firefox.exe	firefox.exe
PID 4944 wrote to memory of 2920	4944	firefox.exe	firefox.exe
PID 4944 wrote to memory of 2920	4944	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe
"C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\Admin\rat.exe"
  2⤵
  - Creates scheduled task(s)
  PID:4160
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpF4B0.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpF4B0.tmp.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2916"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:832
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:4984
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1588
- - C:\Users\Admin\rat.exe
    "rat.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2676
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\Admin\rat.exe"
      4⤵
      Creates scheduled task(s)
      PID:1304
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c cmd.exe del C:\
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3068
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe del C:\
        5⤵
        
        PID:2712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3752 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
1⤵
PID:5032

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4944.0.353996538\1766962065" -parentBuildID 20221007134813 -prefsHandle 1856 -prefMapHandle 1848 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2aa6e175-117b-4118-afdf-225acc05df62} 4944 "\\.\pipe\gecko-crash-server-pipe.4944" 1948 186b56f5e58 gpu
    3⤵
    PID:876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4944.1.702753281\2014560205" -parentBuildID 20221007134813 -prefsHandle 2304 -prefMapHandle 2300 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2137593-d277-4914-abeb-41e32b444898} 4944 "\\.\pipe\gecko-crash-server-pipe.4944" 2348 186b5241b58 socket
    3⤵
    - Checks processor information in registry
    PID:2920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4944.2.311370692\1853817133" -childID 1 -isForBrowser -prefsHandle 3036 -prefMapHandle 3180 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1412 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a13ac2f-c02b-49ba-be18-eb20e6dfce7b} 4944 "\\.\pipe\gecko-crash-server-pipe.4944" 3212 186b565ee58 tab
    3⤵
    PID:1452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4944.3.1420253414\870916094" -childID 2 -isForBrowser -prefsHandle 3568 -prefMapHandle 3260 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1412 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6d735e9a-fcbf-4c72-9d15-e76c1b849ed4} 4944 "\\.\pipe\gecko-crash-server-pipe.4944" 3532 186a1a65f58 tab
    3⤵
    PID:3720
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4944.4.420799281\1861264785" -childID 3 -isForBrowser -prefsHandle 4148 -prefMapHandle 4144 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1412 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {69a028ef-4af8-458d-8e35-a0eab39564c6} 4944 "\\.\pipe\gecko-crash-server-pipe.4944" 4160 186a1a62b58 tab
    3⤵
    PID:560

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=528884
  2⤵
  PID:4792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=5060 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:1
1⤵
PID:5052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --mojo-platform-channel-handle=5764 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:1
1⤵
PID:636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5884 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
1⤵
PID:3612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=4832 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:1
1⤵
PID:3004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --mojo-platform-channel-handle=5516 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:1
1⤵
PID:4508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4036 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
1⤵
PID:3100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
- Enumerates system info in registry
- Modifies registry class
PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffa2d402e98,0x7ffa2d402ea4,0x7ffa2d402eb0
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2260 --field-trial-handle=2264,i,182425650604301845,1324665153004943507,262144 --variations-seed-version /prefetch:2
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2296 --field-trial-handle=2264,i,182425650604301845,1324665153004943507,262144 --variations-seed-version /prefetch:3
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2444 --field-trial-handle=2264,i,182425650604301845,1324665153004943507,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4432 --field-trial-handle=2264,i,182425650604301845,1324665153004943507,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4432 --field-trial-handle=2264,i,182425650604301845,1324665153004943507,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:3780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
06b94a71b9b221e8f4762be31a9369af

SHA1
a262d085fd8e7fd7920080faeb808e6024fb6cae

SHA256
dcb897577803854ae0397825217408c6f97313adcd616f535bdfe256566049bd

SHA512
ed41ab561ecfb0b4e2ae5558fe792316dc3f514b1bdf47f7cf976db0f1b3d78909f58b372d3c6719928c5d0dce1de9eaee39bcb62dfc97b885c948faba3db42a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
1c0950fb117974bbe47a9f87654d247e

SHA1
cd03fa51f50ffa83bbd6e6d3d69eab22f2a3a709

SHA256
4f31057a37ae49dcc04714270a90dfd0b7907e528c873a81d4be83c7e2a809dd

SHA512
c8ebe47ea32a25ebc586f849e19652710f38f1cfaeedd1add4560ba459004a667d5b8ba0ff6380d61b333f1ed21f286814b48b36c796c4d3a340e991eb25e733

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\224855db-022e-4b38-9d7d-5930f9fc3be6.tmp

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
63KB

MD5
7b4e4f3b240277b93c98647184af006e

SHA1
37f4fb823e0134dc1ecf45aeeca9746b8fc40969

SHA256
a46528c44d064d367924d91e5532555379ddf0366ed87ecb92d192db6c72ce4b

SHA512
0e8d2aeeaaa89b2c74e7546d89972ce8542084394ef40deac5d3829c4f7e4c33602161b38416955e673b76e3ebb8537c8012a4aa9d4bdce1682fd06b00bc8469

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
698fc846c06a57450c56ed38e36eab83

SHA1
e46697eef0c50da848e9d16bc371a8efb362b549

SHA256
e72ab7d18b6d764ed3f256c7ce6f123361d31fe17d32e8b2273bb4b85fc74338

SHA512
907c7b5e8922d6d1bde3401059a1543701eb214a2e6785e15f3304ab517c47023e1a210b411a3d4bae2c4e29fe64e3bbb51d70bb4f42622c1433c079070518f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpF4B0.tmp.bat

Filesize
185B

MD5
519a3bbb6609a886f9aac7ee1d189406

SHA1
a45b33c2f782a65cef368d3697735e4ba081df7a

SHA256
c417a79c9e70a349d08901e6eb92d65bd5af84e41c91929187cc648b0c6c2c6b

SHA512
4d473cea35e328c9e03a57f90aaf9b3151d030633fccad4c1bd2c06247b5e20b3715d1ce884db089aa557648f669db4f804c704350fd4963b5db1187d415bddf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
4d6711a7b00e79dc754879e337e5fa97

SHA1
40e491ae32123500d638fd5a47e982e45e43bc2b

SHA256
4ba60ad5aa60f87218ab9abc988b7549768e9be1ad4cd3a05a4e463c347789a7

SHA512
ee62e9ef242d0da4cca1b5a571a9856a835ea55827bfe6a65220568da4df8f7ad6472b674cb71d3841cf4243b156903cf67c7bb86947353d779c6c7ef012ddd4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\2fbb3bdd-923b-4e35-bf74-f5102cf97622

Filesize
10KB

MD5
51249de8ed12025ade9424ac93e5e03f

SHA1
1c49bd026176e7fb9a6191d42ec89f2320558b06

SHA256
d3489e65e79c8d4478a50458a4e5a6880ebe247e710d70521f2c0cd2b6c5c309

SHA512
c7a26c713fa782dd07e049b01e932f51806f3e4f225f6293c42d74815918e52f6b6272d19a8ef8b007920cc13cd502f6663badd4dec1d69c73c956d27b45d5ff

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\916e8b19-3f2e-4ad3-ac88-3b2af5f3030e

Filesize
746B

MD5
e846d3b0b6b8fe604cb6ee88180cb268

SHA1
b3a45dee8ecc1c4e5bd74094a39e6640d18a42d0

SHA256
cb42b3e401b660a6fef5d1416ae00d0913e743bada0be0f00c07a879e0805190

SHA512
e4972bdc2e47c6cbb5dd6cb606036755cd03b7ea3d85dc363056dbaf30b8ba5b5098c57e22504597a968d8086b3e416b0077a9c133702c4a12ebda048c6a8a17

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js

Filesize
6KB

MD5
d3e85fe73bd8fcbc0ff3c90d5d4aa500

SHA1
4ea837dacb0c9bd85497af29b64c0e5fa84bf8e0

SHA256
bf8423ec28d26c2d9f901fc3f70d704b088235773768cd88af7d6295b8a6b9ec

SHA512
076187349cf3a691036f2c92411f784f8dfea078681155f2996aa57135fda1169a9a76d9313af1dbebdc6703a9dd4656c78e5ec70e5a584a284d6b423ff6bf80

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore.jsonlz4

Filesize
890B

MD5
e33cf6c1d70519253339ccc0b0c582eb

SHA1
782a2568e0b7c5a5a491cc71883c14c5c1fdd823

SHA256
882961f93b858ae761af2d4858f736ced6403109435834aec48da58fecb2890d

SHA512
817bb2bca03dd485d238161b82aad84b320bdf2de835dd6739d62151c1ffb20a30134a654d00d3846fb3f3fa694a9ba2f5d8eed3652ad80bba7621127f7d5b6f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
03994b88bdc9e598d88f9273dfec8e0e

SHA1
9c4d73dc30e024c6884167494d36edc072a59cc6

SHA256
51f2123c825c0e1071fa87a6d9e6cf057b9829be2092ba1277681ce095dd270e

SHA512
17741d2e38e8a695c7b10ad67bf390d5ce515136ccf2e7445aa705d427c2f05213ce83cfa333651971759e49bebd2d70b3fd3535b17008328f69cf3a04c407a0

Download Submit
C:\Users\Admin\keylogs

Filesize
32B

MD5
c8b4d33414e27ea403998013dfbbaaf8

SHA1
f57040fec53b1334a77b199750ced92de2583291

SHA256
40397d0aca65160de8b4cfbe8aafbdeeb7059ade5cea1d4d0d6c65226a77a16f

SHA512
40e47fb14bf2263c9123d1a81e56022ac8bea78a836fb6d8feb62abfd488b4eef7c427f9c3665454adfc7c6c9c629b0b05c1fce2e56fff546d17df150a6a9290

Download Submit
C:\Users\Admin\keylogs.txt

Filesize
95B

MD5
8905a55e005c1fff118d0e42cc7e0309

SHA1
a4f06cb8f189ff8f3e674f4b4b27a32b054b0d4c

SHA256
dfb02fc882325984852345c577d4b6a296c31e3df297b559d857876ce3958378

SHA512
eab6710bb8036588a4f7165327ffcc7f7b3ac16d34601e7813d1fc3da1bcb1a9d95ae645ffc6bd1a79106cba6be1f3ed47b71b35ffea8728d4d119c3e4b0ff5e

Download Submit
C:\Users\Admin\rat.exe

Filesize
111KB

MD5
8834c1eaf28b3b076df2a0aac5d1148e

SHA1
640e70c94c0e01492c4c45cf2b23b65914a94cc5

SHA256
49f704606ec839fa6867a5f5f67090299b69b02dab7d352e161c8a754165de8a

SHA512
59c6d085818d43607ee2aef904899690a116a34f6e50978c35017d1a546964bcdfc435b7fb09bab998d4d0eacc8b614a58a55c029311d7c33473a501f4f3f561

Download Submit
\??\pipe\crashpad_968_OHTAXKDQDQZEVYLT

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2676-26-0x000001AA4F9D0000-0x000001AA4F9DA000-memory.dmp

Filesize
40KB

Download
memory/2676-12-0x000001AA50390000-0x000001AA50406000-memory.dmp

Filesize
472KB

Download
memory/2676-11-0x000001AA50260000-0x000001AA5030A000-memory.dmp

Filesize
680KB

Download
memory/2916-0-0x000001ADA2520000-0x000001ADA2542000-memory.dmp

Filesize
136KB

Download
memory/2916-6-0x00007FFA36590000-0x00007FFA37051000-memory.dmp

Filesize
10.8MB

Download
memory/2916-2-0x000001ADBCAF0000-0x000001ADBCB00000-memory.dmp

Filesize
64KB

Download
memory/2916-1-0x00007FFA36590000-0x00007FFA37051000-memory.dmp

Filesize
10.8MB

Download