toxiceye | 5d0be378578617a2264e822d1b4424d71e8fa3e8dad60b30af614b173682880b

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
18-05-2024 14:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d0be378578617a2264e822d1b4424d71e8fa3e8dad60b30af614b173682880b.exe
Size

119KB
MD5

f548ca220d471a524cb1c7d8ff613721
SHA1

3040c8945b16a58f44dd4f1ae5a7b0faf61b405e
SHA256

5d0be378578617a2264e822d1b4424d71e8fa3e8dad60b30af614b173682880b
SHA512

b1ea254c1ab6c3983cdb906f39403da5b342fed1836b14b4654a0e25dcae274edc517e30ec66fefbeb6f511b89e869a4d785098896bf55eac36108c79494c158
SSDEEP

3072:BKUpvwYGqOcW7gabRq15QWXzCrAZu8Gq:MIWMabAL

Score

10^/10

toxiceye rat trojan

Malware Config

Extracted

Family

toxiceye

https://api.telegram.org/bot6444357834:AAGtL3te5_xl4dvacn8BJElHrky5SlLcE_4/sendMessage?chat_id=5974265372

Signatures

ToxicEye
ToxicEye is a trojan written in C#.
rat trojan toxiceye

Deletes itself 1 IoCs

Processes:

cmd.exe

pid	Process
2640	cmd.exe

Executes dropped EXE 1 IoCs

Processes:

RTGManager.exe

pid	Process
2696	RTGManager.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exeschtasks.exe

pid	Process
2528	schtasks.exe
3060	schtasks.exe

Delays execution with timeout.exe 2 IoCs

evasion

Processes:

timeout.exetimeout.exe

pid	Process
2704	timeout.exe
2128	timeout.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

Processes:

tasklist.exetasklist.exe

pid	Process
2872	tasklist.exe
2444	tasklist.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

RTGManager.exe

pid	Process
2696	RTGManager.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

RTGManager.exe

pid	Process
2696	RTGManager.exe
2696	RTGManager.exe
2696	RTGManager.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

5d0be378578617a2264e822d1b4424d71e8fa3e8dad60b30af614b173682880b.exetasklist.exetasklist.exeRTGManager.exe

description	pid	Process
Token: SeDebugPrivilege	1660	5d0be378578617a2264e822d1b4424d71e8fa3e8dad60b30af614b173682880b.exe
Token: SeDebugPrivilege	2872	tasklist.exe
Token: SeDebugPrivilege	2444	tasklist.exe
Token: SeDebugPrivilege	2696	RTGManager.exe
Token: SeDebugPrivilege	2696	RTGManager.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RTGManager.exe

pid	Process
2696	RTGManager.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

5d0be378578617a2264e822d1b4424d71e8fa3e8dad60b30af614b173682880b.execmd.exeRTGManager.exe

description	pid	Process	procid_target
PID 1660 wrote to memory of 2528	1660	5d0be378578617a2264e822d1b4424d71e8fa3e8dad60b30af614b173682880b.exe	30
PID 1660 wrote to memory of 2528	1660	5d0be378578617a2264e822d1b4424d71e8fa3e8dad60b30af614b173682880b.exe	30
PID 1660 wrote to memory of 2528	1660	5d0be378578617a2264e822d1b4424d71e8fa3e8dad60b30af614b173682880b.exe	30
PID 1660 wrote to memory of 2640	1660	5d0be378578617a2264e822d1b4424d71e8fa3e8dad60b30af614b173682880b.exe	32
PID 1660 wrote to memory of 2640	1660	5d0be378578617a2264e822d1b4424d71e8fa3e8dad60b30af614b173682880b.exe	32
PID 1660 wrote to memory of 2640	1660	5d0be378578617a2264e822d1b4424d71e8fa3e8dad60b30af614b173682880b.exe	32
PID 2640 wrote to memory of 2872	2640	cmd.exe	34
PID 2640 wrote to memory of 2872	2640	cmd.exe	34
PID 2640 wrote to memory of 2872	2640	cmd.exe	34
PID 2640 wrote to memory of 2588	2640	cmd.exe	35
PID 2640 wrote to memory of 2588	2640	cmd.exe	35
PID 2640 wrote to memory of 2588	2640	cmd.exe	35
PID 2640 wrote to memory of 2704	2640	cmd.exe	36
PID 2640 wrote to memory of 2704	2640	cmd.exe	36
PID 2640 wrote to memory of 2704	2640	cmd.exe	36
PID 2640 wrote to memory of 2444	2640	cmd.exe	37
PID 2640 wrote to memory of 2444	2640	cmd.exe	37
PID 2640 wrote to memory of 2444	2640	cmd.exe	37
PID 2640 wrote to memory of 3024	2640	cmd.exe	38
PID 2640 wrote to memory of 3024	2640	cmd.exe	38
PID 2640 wrote to memory of 3024	2640	cmd.exe	38
PID 2640 wrote to memory of 2128	2640	cmd.exe	39
PID 2640 wrote to memory of 2128	2640	cmd.exe	39
PID 2640 wrote to memory of 2128	2640	cmd.exe	39
PID 2640 wrote to memory of 2696	2640	cmd.exe	40
PID 2640 wrote to memory of 2696	2640	cmd.exe	40
PID 2640 wrote to memory of 2696	2640	cmd.exe	40
PID 2696 wrote to memory of 3060	2696	RTGManager.exe	42
PID 2696 wrote to memory of 3060	2696	RTGManager.exe	42
PID 2696 wrote to memory of 3060	2696	RTGManager.exe	42
PID 2696 wrote to memory of 2828	2696	RTGManager.exe	44
PID 2696 wrote to memory of 2828	2696	RTGManager.exe	44
PID 2696 wrote to memory of 2828	2696	RTGManager.exe	44

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\5d0be378578617a2264e822d1b4424d71e8fa3e8dad60b30af614b173682880b.exe
"C:\Users\Admin\AppData\Local\Temp\5d0be378578617a2264e822d1b4424d71e8fa3e8dad60b30af614b173682880b.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\Sh1zo\RTGManager.exe"
  2⤵
  - Creates scheduled task(s)
  PID:2528
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp1249.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp1249.tmp.bat
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 1660"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2872
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2588
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2704
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 1660"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2444
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:3024
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2128
- - C:\Users\Sh1zo\RTGManager.exe
    "RTGManager.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2696
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\Sh1zo\RTGManager.exe"
      4⤵
      Creates scheduled task(s)
      PID:3060
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2696 -s 1684
      4⤵
      PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp1249.tmp.bat

Filesize
245B

MD5
118e5a7e4e32f3bcc74d5706c8b7c098

SHA1
92ebc8f57363fb12a61e93207e83c9c05eb59845

SHA256
92415fedd6a1423fae14acffa8024a148ada795e2f382ddec6b9f26a3acb7e5d

SHA512
bcbcb44ad3fa3fb33eaab7d541e93ed98926d088acb905f949714ef82e3129ec4770114ae390445f633125fbc288951af08ec22335d7691f222731c0310dbfb6

Download Submit
C:\Users\Sh1zo\RTGManager.exe

Filesize
119KB

MD5
f548ca220d471a524cb1c7d8ff613721

SHA1
3040c8945b16a58f44dd4f1ae5a7b0faf61b405e

SHA256
5d0be378578617a2264e822d1b4424d71e8fa3e8dad60b30af614b173682880b

SHA512
b1ea254c1ab6c3983cdb906f39403da5b342fed1836b14b4654a0e25dcae274edc517e30ec66fefbeb6f511b89e869a4d785098896bf55eac36108c79494c158

Download Submit
memory/1660-1-0x0000000001320000-0x0000000001344000-memory.dmp

Filesize
144KB

Download
memory/1660-0-0x000007FEF5043000-0x000007FEF5044000-memory.dmp

Filesize
4KB

Download
memory/1660-2-0x000007FEF5040000-0x000007FEF5A2C000-memory.dmp

Filesize
9.9MB

Download
memory/1660-6-0x000007FEF5040000-0x000007FEF5A2C000-memory.dmp

Filesize
9.9MB

Download
memory/2696-10-0x00000000001F0000-0x0000000000214000-memory.dmp

Filesize
144KB

Download