Overview

overview

10

Static

static

10

XcHvYYrNa.exe

windows10-1703-x64

XcHvYYrNa.exe

windows11-21h2-x64

10

Resubmissions

18-05-2024 01:48

240518-b8ehbsee95 10

18-05-2024 01:47

240518-b7snkaee49 10

18-05-2024 01:40

240518-b3mlraec26 10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240508-en
  • resource tags

    arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    18-05-2024 01:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    XcHvYYrNa.exe

  • Size

    111KB

  • MD5

    98e558eaea97f0b282b42fa6d49070b6

  • SHA1

    2e48bb1b50177fe17392ac9407ba9f7e45685a3a

  • SHA256

    d50d11636b59a11c81577342de7c72f694c99540311c2c3ffa53126e8cc394f1

  • SHA512

    01dcd7a191ef331fe7626f760064e4368cd06c7a30374b74074d6dddf35683b443fb8c0677d1a7bfa88eac81f482dadf6788f343d9958fc9818be749ac7e9882

  • SSDEEP

    1536:v+bDH/4gqLM91qQIwBI5xxxxdyyKDWfebhDqI68QWfzCrAZuYPwDr:Wb7/4jLSIFxxj8bxqH8QWfzCrAZuYUr

Score
10/10
toxiceyerattrojan

Malware Config

Extracted

Family

toxiceye

C2

https://api.telegram.org/bot6444357834:AAGtL3te5_xl4dvacn8BJElHrky5SlLcE_4/sendMessage?chat_id=5563559839

Signatures

  • ToxicEye

    ToxicEye is a trojan written in C#.

    rattrojantoxiceye
  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\XcHvYYrNa.exe
    "C:\Users\Admin\AppData\Local\Temp\XcHvYYrNa.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3680
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\NVIDIA\IShadowRTX.exe"
      2⤵
      • Creates scheduled task(s)
      PID:3004
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp6A04.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp6A04.tmp.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4176
      • C:\Windows\system32\tasklist.exe
        Tasklist /fi "PID eq 3680"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:4540
      • C:\Windows\system32\find.exe
        find ":"
        3⤵
          PID:2424
        • C:\Windows\system32\timeout.exe
          Timeout /T 1 /Nobreak
          3⤵
          • Delays execution with timeout.exe
          PID:2744
        • C:\Users\NVIDIA\IShadowRTX.exe
          "IShadowRTX.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1408
          • C:\Windows\System32\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\NVIDIA\IShadowRTX.exe"
            4⤵
            • Creates scheduled task(s)
            PID:4060

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp6A04.tmp.bat
      Filesize

      191B

      MD5

      cabaaae16cab38d407354e410c87726f

      SHA1

      99e5c1cd21dd803ab75a5143967d405ecbe17625

      SHA256

      7cf2ee5cedce27d048da998337201c67266b8a580d3a6d2c5eeb5fa9e2e36766

      SHA512

      528960ee3f43c99591b29507bdb61b4da0420867773b53608a1e03fadd674dc2e2c257f7e2a705da407834dfbb69fe211f11e4a8718676d33c1f6d0988bddcf7

      Download Submit

    • C:\Users\NVIDIA\IShadowRTX.exe
      Filesize

      111KB

      MD5

      98e558eaea97f0b282b42fa6d49070b6

      SHA1

      2e48bb1b50177fe17392ac9407ba9f7e45685a3a

      SHA256

      d50d11636b59a11c81577342de7c72f694c99540311c2c3ffa53126e8cc394f1

      SHA512

      01dcd7a191ef331fe7626f760064e4368cd06c7a30374b74074d6dddf35683b443fb8c0677d1a7bfa88eac81f482dadf6788f343d9958fc9818be749ac7e9882

      Download Submit

    • memory/3680-0-0x00007FF864383000-0x00007FF864385000-memory.dmp

      Filesize

      8KB

      Download

    • memory/3680-1-0x000001FC3A770000-0x000001FC3A792000-memory.dmp

      Filesize

      136KB

      Download

    • memory/3680-2-0x00007FF864380000-0x00007FF864E42000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3680-6-0x00007FF864380000-0x00007FF864E42000-memory.dmp

      Filesize

      10.8MB

      Download