toxiceye | 276d53b6f343cffb4e81e6db87b30dce162b82dd2ed9aea49d754cdfba8e865a

Reason

Machine shutdown

General

Target

Win-XwormRat-builder.exe
Size

928KB
MD5

db9df61757cc712eb190955371d24937
SHA1

308155685a2bcc0369a63d1ac2c13c7293cedce7
SHA256

276d53b6f343cffb4e81e6db87b30dce162b82dd2ed9aea49d754cdfba8e865a
SHA512

cf2ab30da84cdee5988c52f08403a33d99f5565839959763aaa4b34745251cc32839e466e7c6c27f83145bc10b55e0f279a4165af58db28156f34aa2b44a921e
SSDEEP

12288:V8pICumxgLj3PSg+Gfqxk01P6RNGZS7yK8g3dviBOEBkCtip/y6Lr9vXjdkpgLMk:p1ixARrLl1/1q+

Score

10^/10

toxiceye rat trojan

Malware Config

Extracted

Family

toxiceye

C2

https://api.telegram.org/bot5536756167:AAFMcQrFbMZMBynbrtZUudaOT9ndCJXIqT4/sendMessage?chat_id=2024893777

Signatures

ToxicEye
ToxicEye is a trojan written in C#.
rat trojan toxiceye

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	Win-XwormRat-builder.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	win-xwarm-builder.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	Update.exe

Executes dropped EXE 2 IoCs

pid	Process
1896	win-xwarm-builder.exe
2452	Update.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3076	timeout.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
4068	tasklist.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3376	schtasks.exe
2780	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2452	Update.exe
2452	Update.exe
2452	Update.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1896	win-xwarm-builder.exe
Token: SeDebugPrivilege	4068	tasklist.exe
Token: SeDebugPrivilege	2452	Update.exe
Token: SeDebugPrivilege	2452	Update.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2452	Update.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 1896	4400	Win-XwormRat-builder.exe	83
PID 4400 wrote to memory of 1896	4400	Win-XwormRat-builder.exe	83
PID 1896 wrote to memory of 2780	1896	win-xwarm-builder.exe	91
PID 1896 wrote to memory of 2780	1896	win-xwarm-builder.exe	91
PID 1896 wrote to memory of 4684	1896	win-xwarm-builder.exe	93
PID 1896 wrote to memory of 4684	1896	win-xwarm-builder.exe	93
PID 4684 wrote to memory of 4068	4684	cmd.exe	95
PID 4684 wrote to memory of 4068	4684	cmd.exe	95
PID 4684 wrote to memory of 1712	4684	cmd.exe	96
PID 4684 wrote to memory of 1712	4684	cmd.exe	96
PID 4684 wrote to memory of 3076	4684	cmd.exe	97
PID 4684 wrote to memory of 3076	4684	cmd.exe	97
PID 4684 wrote to memory of 2452	4684	cmd.exe	98
PID 4684 wrote to memory of 2452	4684	cmd.exe	98
PID 2452 wrote to memory of 3376	2452	Update.exe	99
PID 2452 wrote to memory of 3376	2452	Update.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Win-XwormRat-builder.exe
"C:\Users\Admin\AppData\Local\Temp\Win-XwormRat-builder.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Users\Admin\AppData\Local\Temp\win-xwarm-builder.exe
  "C:\Users\Admin\AppData\Local\Temp\win-xwarm-builder.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1896
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\Static\Update.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2780
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpC275.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpC275.tmp.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4684
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 1896"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4068
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1712
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3076
  - - C:\Users\Static\Update.exe
      "Update.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2452
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\Static\Update.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpC275.tmp.bat

Filesize
195B

MD5
8808b66d3735e0bc3c7eb0494ebc9135

SHA1
8242d054bb1d09263c84edffb6effdb74d2a3fba

SHA256
cad088493b0696864ed0c44b58c6b16a38cdbcabc06da6f43e23eaca822180ee

SHA512
b60abcce622fe56eef81bc5cbaeaf2037dc89a6b6d057f00d65fb5bb197dc0486a74b9397fd6abcc2ecdc870d0595a81c7dbba4d8af716569eaaf5bcb23075f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\win-xwarm-builder.exe

Filesize
127KB

MD5
f6f686df785d0abdc66d1f90fa508c4b

SHA1
75f348132001df30cbad9c7cae2e2072fcaca38e

SHA256
61b52af14fc66126a4e7f09b3cff7d3c09e5ad35acf23fb9ba43293fac0c995f

SHA512
7daa425723caade3ec747fbe6e425e26bc419e1a7dccd6253770fe1a118a8b90e0f40f6cf4bdac259e68a0198a384ed1b5de7515958f5e17e4e35219b9077d77

Download Submit
memory/1896-14-0x000001F2FF430000-0x000001F2FF456000-memory.dmp

Filesize
152KB

Download
memory/1896-15-0x00007FFD4F140000-0x00007FFD4FC01000-memory.dmp

Filesize
10.8MB

Download
memory/1896-16-0x00007FFD4F140000-0x00007FFD4FC01000-memory.dmp

Filesize
10.8MB

Download
memory/1896-21-0x00007FFD4F140000-0x00007FFD4FC01000-memory.dmp

Filesize
10.8MB

Download
memory/4400-0-0x00007FFD4F143000-0x00007FFD4F145000-memory.dmp

Filesize
8KB

Download
memory/4400-1-0x0000025070370000-0x000002507045E000-memory.dmp

Filesize
952KB

Download
memory/4400-13-0x00007FFD4F140000-0x00007FFD4FC01000-memory.dmp

Filesize
10.8MB

Download
memory/4400-17-0x00007FFD4F140000-0x00007FFD4FC01000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads