toxiceye | 1aa346604a2a09f1855dd15ee3a4985c01992454ff9cd4a6934426bb7514f431

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 12:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37efb981fdd1b40ca5791209cf58bf00N.exe
Size

133KB
MD5

37efb981fdd1b40ca5791209cf58bf00
SHA1

5f295b03196694ab7b1c9ca365ed8cae2010da14
SHA256

1aa346604a2a09f1855dd15ee3a4985c01992454ff9cd4a6934426bb7514f431
SHA512

d4dff62c2ee8d11890bcaba729004f28007bc253762ca612752800572a1e434bfe8eeb8b57fbec8f8e8d91a54309efc6299f68573467747bec55fa121ba5e194
SSDEEP

3072:w3rmv+oXzTqER7q7f/05blUI1Vbv10qQWf5CrAZuv8W:wC2oXzTqER72EUEVbNV

Score

10^/10

toxiceye rat trojan

Malware Config

Extracted

Family

toxiceye

https://api.telegram.org/bot7494084658:AAEIJbf5fjCgko8bvpacCjVq2qB-Ko3aPY4/sendMessage?chat_id=6604593505

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral1/memory/2128-1-0x00000000000C0000-0x00000000000E8000-memory.dmp	disable_win_def

ToxicEye
ToxicEye is a trojan written in C#.
rat trojan toxiceye
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2488 schtasks.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

37efb981fdd1b40ca5791209cf58bf00N.exe

pid process

2128 37efb981fdd1b40ca5791209cf58bf00N.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

37efb981fdd1b40ca5791209cf58bf00N.exe

pid process

2128 37efb981fdd1b40ca5791209cf58bf00N.exe
2128 37efb981fdd1b40ca5791209cf58bf00N.exe

pid	process
2488	schtasks.exe

pid	process
2128	37efb981fdd1b40ca5791209cf58bf00N.exe

pid	process
2128	37efb981fdd1b40ca5791209cf58bf00N.exe
2128	37efb981fdd1b40ca5791209cf58bf00N.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

37efb981fdd1b40ca5791209cf58bf00N.exe

description	pid	process
Token: SeDebugPrivilege	2128	37efb981fdd1b40ca5791209cf58bf00N.exe
Token: SeDebugPrivilege	2128	37efb981fdd1b40ca5791209cf58bf00N.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

37efb981fdd1b40ca5791209cf58bf00N.exe

pid process

2128 37efb981fdd1b40ca5791209cf58bf00N.exe

pid	process
2128	37efb981fdd1b40ca5791209cf58bf00N.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

37efb981fdd1b40ca5791209cf58bf00N.exe

description	pid	process	target process
PID 2128 wrote to memory of 2488	2128	37efb981fdd1b40ca5791209cf58bf00N.exe	schtasks.exe
PID 2128 wrote to memory of 2488	2128	37efb981fdd1b40ca5791209cf58bf00N.exe	schtasks.exe
PID 2128 wrote to memory of 2488	2128	37efb981fdd1b40ca5791209cf58bf00N.exe	schtasks.exe
PID 2128 wrote to memory of 2712	2128	37efb981fdd1b40ca5791209cf58bf00N.exe	WerFault.exe
PID 2128 wrote to memory of 2712	2128	37efb981fdd1b40ca5791209cf58bf00N.exe	WerFault.exe
PID 2128 wrote to memory of 2712	2128	37efb981fdd1b40ca5791209cf58bf00N.exe	WerFault.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\37efb981fdd1b40ca5791209cf58bf00N.exe
"C:\Users\Admin\AppData\Local\Temp\37efb981fdd1b40ca5791209cf58bf00N.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\%USERPROFILE%\AppData\Local\Temp\scvhost.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2488
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2128 -s 1648
  2⤵
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2128-0-0x000007FEF6203000-0x000007FEF6204000-memory.dmp

Filesize
4KB

Download
memory/2128-1-0x00000000000C0000-0x00000000000E8000-memory.dmp

Filesize
160KB

Download
memory/2128-2-0x000007FEF6200000-0x000007FEF6BEC000-memory.dmp

Filesize
9.9MB

Download
memory/2128-4-0x000007FEF6203000-0x000007FEF6204000-memory.dmp

Filesize
4KB

Download
memory/2128-5-0x000007FEF6200000-0x000007FEF6BEC000-memory.dmp

Filesize
9.9MB

Download