toxiceye | 168a57c472350a733ffe154a065b243f0d64faf235004315471785abeb93fe19

Reason

Machine shutdown

General

Target

TelegramRAT.exe
Size

111KB
MD5

70e2065cad845ee34e4a39f9b8c963a3
SHA1

c4fe48fc7ec3182670a1a6dc9ec26fde32ad653d
SHA256

168a57c472350a733ffe154a065b243f0d64faf235004315471785abeb93fe19
SHA512

f8bdfae8658f49d4a7a4b83fae078766fbdcfd6438090cc49971e57befc1fe13f22de66cba30b09c6cbf166dce6570a894d11d9985ce9db8a2ad8555d755252f
SSDEEP

1536:Y+b6QDWv5IDlOM91qQIwOs0dxv72rEBDG+bhDqI6oQW8zCrAZuhazDy:Pb2IpORLv7ztbxqHoQW8zCrAZuhay

Score

10^/10

toxiceye rat trojan

Malware Config

Signatures

ToxicEye
ToxicEye is a trojan written in C#.
rat trojan toxiceye

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

TelegramRAT.exedupe.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation	TelegramRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation	dupe.exe

Executes dropped EXE 1 IoCs

Processes:

dupe.exe

pid process

536 dupe.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

4492 timeout.exe
Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

1280 tasklist.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

4256 schtasks.exe
3908 schtasks.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

dupe.exe

pid process

536 dupe.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

dupe.exe

pid process

536 dupe.exe
536 dupe.exe

pid	process
536	dupe.exe

pid	process
4492	timeout.exe

pid	process
1280	tasklist.exe

pid	process
4256	schtasks.exe
3908	schtasks.exe

pid	process
536	dupe.exe

pid	process
536	dupe.exe
536	dupe.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

TelegramRAT.exetasklist.exedupe.exe

description	pid	process
Token: SeDebugPrivilege	2536	TelegramRAT.exe
Token: SeDebugPrivilege	1280	tasklist.exe
Token: SeDebugPrivilege	536	dupe.exe
Token: SeDebugPrivilege	536	dupe.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

dupe.exe

pid process

536 dupe.exe

pid	process
536	dupe.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

TelegramRAT.execmd.exedupe.exe

description	pid	process	target process
PID 2536 wrote to memory of 4256	2536	TelegramRAT.exe	schtasks.exe
PID 2536 wrote to memory of 4256	2536	TelegramRAT.exe	schtasks.exe
PID 2536 wrote to memory of 2100	2536	TelegramRAT.exe	cmd.exe
PID 2536 wrote to memory of 2100	2536	TelegramRAT.exe	cmd.exe
PID 2100 wrote to memory of 1280	2100	cmd.exe	tasklist.exe
PID 2100 wrote to memory of 1280	2100	cmd.exe	tasklist.exe
PID 2100 wrote to memory of 3388	2100	cmd.exe	find.exe
PID 2100 wrote to memory of 3388	2100	cmd.exe	find.exe
PID 2100 wrote to memory of 4492	2100	cmd.exe	timeout.exe
PID 2100 wrote to memory of 4492	2100	cmd.exe	timeout.exe
PID 2100 wrote to memory of 536	2100	cmd.exe	dupe.exe
PID 2100 wrote to memory of 536	2100	cmd.exe	dupe.exe
PID 536 wrote to memory of 3908	536	dupe.exe	schtasks.exe
PID 536 wrote to memory of 3908	536	dupe.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe
"C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Windows Update" /tr "C:\Users\Public\Downloads\dupe.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4256
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp92DA.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp92DA.tmp.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2536"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1280
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:3388
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4492
- - C:\Users\Public\Downloads\dupe.exe
    "dupe.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:536
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Windows Update" /tr "C:\Users\Public\Downloads\dupe.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp92DA.tmp.bat

Filesize
197B

MD5
1b8fbe28edfac3831a4f0a6807202c48

SHA1
7fa61d23307fb743782d16000bfe3844115e52d7

SHA256
d6a0e07e181c8db163424082d24df3dd8022c939a247d87fddaa4aae4f966efa

SHA512
938d9d557ac75f34571341b32b112a3fc0fcd0f470e19caaa68a339fc28c34e7f1eef12a9d144816ab6fe120d276da11aef1b6666905b061431a05207012c786

Download Submit
C:\Users\Public\Downloads\dupe.exe

Filesize
111KB

MD5
70e2065cad845ee34e4a39f9b8c963a3

SHA1
c4fe48fc7ec3182670a1a6dc9ec26fde32ad653d

SHA256
168a57c472350a733ffe154a065b243f0d64faf235004315471785abeb93fe19

SHA512
f8bdfae8658f49d4a7a4b83fae078766fbdcfd6438090cc49971e57befc1fe13f22de66cba30b09c6cbf166dce6570a894d11d9985ce9db8a2ad8555d755252f

Download Submit
memory/2536-0-0x00007FFD30A13000-0x00007FFD30A15000-memory.dmp

Filesize
8KB

Download
memory/2536-1-0x000001BD1E760000-0x000001BD1E782000-memory.dmp

Filesize
136KB

Download
memory/2536-2-0x00007FFD30A10000-0x00007FFD314D1000-memory.dmp

Filesize
10.8MB

Download
memory/2536-6-0x00007FFD30A10000-0x00007FFD314D1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads