Overview

overview

10

Static

static

10

XcHvYYrNa.exe

windows7-x64

10

XcHvYYrNa.exe

windows10-2004-x64

10

Resubmissions

18-05-2024 01:48

240518-b8ehbsee95 10

18-05-2024 01:47

240518-b7snkaee49 10

18-05-2024 01:40

240518-b3mlraec26 10

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-05-2024 01:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    XcHvYYrNa.exe

  • Size

    111KB

  • MD5

    98e558eaea97f0b282b42fa6d49070b6

  • SHA1

    2e48bb1b50177fe17392ac9407ba9f7e45685a3a

  • SHA256

    d50d11636b59a11c81577342de7c72f694c99540311c2c3ffa53126e8cc394f1

  • SHA512

    01dcd7a191ef331fe7626f760064e4368cd06c7a30374b74074d6dddf35683b443fb8c0677d1a7bfa88eac81f482dadf6788f343d9958fc9818be749ac7e9882

  • SSDEEP

    1536:v+bDH/4gqLM91qQIwBI5xxxxdyyKDWfebhDqI68QWfzCrAZuYPwDr:Wb7/4jLSIFxxj8bxqH8QWfzCrAZuYUr

Score
10/10
toxiceyerattrojan

Malware Config

Extracted

Family

toxiceye

C2

https://api.telegram.org/bot6444357834:AAGtL3te5_xl4dvacn8BJElHrky5SlLcE_4/sendMessage?chat_id=5563559839

Signatures

  • ToxicEye

    ToxicEye is a trojan written in C#.

    rattrojantoxiceye
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\XcHvYYrNa.exe
    "C:\Users\Admin\AppData\Local\Temp\XcHvYYrNa.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:972
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\NVIDIA\IShadowRTX.exe"
      2⤵
      • Creates scheduled task(s)
      PID:736
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp53EC.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp53EC.tmp.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4088
      • C:\Windows\system32\tasklist.exe
        Tasklist /fi "PID eq 972"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:4932
      • C:\Windows\system32\find.exe
        find ":"
        3⤵
          PID:8
        • C:\Windows\system32\timeout.exe
          Timeout /T 1 /Nobreak
          3⤵
          • Delays execution with timeout.exe
          PID:3676
        • C:\Users\NVIDIA\IShadowRTX.exe
          "IShadowRTX.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4356
          • C:\Windows\System32\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\NVIDIA\IShadowRTX.exe"
            4⤵
            • Creates scheduled task(s)
            PID:4056

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp53EC.tmp.bat
      Filesize

      190B

      MD5

      f486af828bd426de553a860afca0ca91

      SHA1

      c810106a16092c3aa2bdd6e3948b7f9b87e12e5b

      SHA256

      2be17709d25cf07ca0a2287d6415152c757be36127c224d716f8b3b49f027abe

      SHA512

      6dd1726a7a540a4212a6d9fd343d844a94d4eefba2eb3b59b30afe6dd9e79f15b7cbc5065d1e3c85647039ba8727bb7c8012fb400d8a90f85e1dce1426f04fc3

      Download Submit

    • C:\Users\NVIDIA\IShadowRTX.exe
      Filesize

      111KB

      MD5

      98e558eaea97f0b282b42fa6d49070b6

      SHA1

      2e48bb1b50177fe17392ac9407ba9f7e45685a3a

      SHA256

      d50d11636b59a11c81577342de7c72f694c99540311c2c3ffa53126e8cc394f1

      SHA512

      01dcd7a191ef331fe7626f760064e4368cd06c7a30374b74074d6dddf35683b443fb8c0677d1a7bfa88eac81f482dadf6788f343d9958fc9818be749ac7e9882

      Download Submit

    • memory/972-0-0x00007FFCCB8F3000-0x00007FFCCB8F5000-memory.dmp

      Filesize

      8KB

      Download

    • memory/972-1-0x0000019C30750000-0x0000019C30772000-memory.dmp

      Filesize

      136KB

      Download

    • memory/972-2-0x00007FFCCB8F0000-0x00007FFCCC3B1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/972-6-0x00007FFCCB8F0000-0x00007FFCCC3B1000-memory.dmp

      Filesize

      10.8MB

      Download