toxiceye | f7514a2e0e612b0b4211c4655fedc3a7052578f38f1bfe131e2213102c164e34

General

Target

TelegramRAT.exe
Size

111KB
MD5

3c6f5e7ca1f0279c860554b7b4dfaf5d
SHA1

15c4baaa666353eb7dd5d28a76aead8bf14bc352
SHA256

f7514a2e0e612b0b4211c4655fedc3a7052578f38f1bfe131e2213102c164e34
SHA512

1c8ac972d4ef27ec0f80e850137a8f19c95c72b97f2dede9c4d0caf007709133a5f2e248f6f04bc6e30fbbea742b8f4ae66a4f3408ab0d00ca48c48865947b09
SSDEEP

1536:l+b6QDWv5IDlOM91qQIwy3xZxdyyKDWfybhDqI6oQWVzCrAZuW5TDx:Ib2IpOLhZxjQbxqHoQWVzCrAZuWRx

Score

10^/10

toxiceye rat trojan

Malware Config

Extracted

Family

toxiceye

C2

https://api.telegram.org/bot7074076538:AAGqOb5C3l0YTijTUMFzandCeulk-NFhSz0/sendMessage?chat_id=5623362319

Signatures

ToxicEye
ToxicEye is a trojan written in C#.
rat trojan toxiceye
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

3048 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

dupe.exe

pid process

2704 dupe.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2712 timeout.exe
Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

2780 tasklist.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

2688 schtasks.exe
2220 schtasks.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

dupe.exe

pid process

2704 dupe.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

dupe.exe

pid process

2704 dupe.exe
2704 dupe.exe
2704 dupe.exe

pid	process
3048	cmd.exe

pid	process
2704	dupe.exe

pid	process
2712	timeout.exe

pid	process
2780	tasklist.exe

pid	process
2688	schtasks.exe
2220	schtasks.exe

pid	process
2704	dupe.exe

pid	process
2704	dupe.exe
2704	dupe.exe
2704	dupe.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

TelegramRAT.exetasklist.exedupe.exe

description	pid	process
Token: SeDebugPrivilege	3032	TelegramRAT.exe
Token: SeDebugPrivilege	2780	tasklist.exe
Token: SeDebugPrivilege	2704	dupe.exe
Token: SeDebugPrivilege	2704	dupe.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

dupe.exe

pid process

2704 dupe.exe

pid	process
2704	dupe.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

TelegramRAT.execmd.exedupe.exe

description	pid	process	target process
PID 3032 wrote to memory of 2688	3032	TelegramRAT.exe	schtasks.exe
PID 3032 wrote to memory of 2688	3032	TelegramRAT.exe	schtasks.exe
PID 3032 wrote to memory of 2688	3032	TelegramRAT.exe	schtasks.exe
PID 3032 wrote to memory of 3048	3032	TelegramRAT.exe	cmd.exe
PID 3032 wrote to memory of 3048	3032	TelegramRAT.exe	cmd.exe
PID 3032 wrote to memory of 3048	3032	TelegramRAT.exe	cmd.exe
PID 3048 wrote to memory of 2780	3048	cmd.exe	tasklist.exe
PID 3048 wrote to memory of 2780	3048	cmd.exe	tasklist.exe
PID 3048 wrote to memory of 2780	3048	cmd.exe	tasklist.exe
PID 3048 wrote to memory of 2356	3048	cmd.exe	find.exe
PID 3048 wrote to memory of 2356	3048	cmd.exe	find.exe
PID 3048 wrote to memory of 2356	3048	cmd.exe	find.exe
PID 3048 wrote to memory of 2712	3048	cmd.exe	timeout.exe
PID 3048 wrote to memory of 2712	3048	cmd.exe	timeout.exe
PID 3048 wrote to memory of 2712	3048	cmd.exe	timeout.exe
PID 3048 wrote to memory of 2704	3048	cmd.exe	dupe.exe
PID 3048 wrote to memory of 2704	3048	cmd.exe	dupe.exe
PID 3048 wrote to memory of 2704	3048	cmd.exe	dupe.exe
PID 2704 wrote to memory of 2220	2704	dupe.exe	schtasks.exe
PID 2704 wrote to memory of 2220	2704	dupe.exe	schtasks.exe
PID 2704 wrote to memory of 2220	2704	dupe.exe	schtasks.exe
PID 2704 wrote to memory of 564	2704	dupe.exe	WerFault.exe
PID 2704 wrote to memory of 564	2704	dupe.exe	WerFault.exe
PID 2704 wrote to memory of 564	2704	dupe.exe	WerFault.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe
"C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Windows Update" /tr "C:\Users\Public\Downloads\dupe.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2688
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp1FC0.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp1FC0.tmp.bat
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 3032"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2780
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2356
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2712
- - C:\Users\Public\Downloads\dupe.exe
    "dupe.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Windows Update" /tr "C:\Users\Public\Downloads\dupe.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2220
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2704 -s 1428
      4⤵
      PID:564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp1FC0.tmp.bat

Filesize
197B

MD5
4d2611e432324250e91f3faf8ce93821

SHA1
2796e3ce571f438a047557bb9f2f5abf58bbded9

SHA256
ab15e789d729673c7ac19534033ad196acf2ae6da021f3f720658a02b505b47c

SHA512
6d477cee25bb106734a8df575fdc8f1c44b0bd96200918c575dbc6fc9db6436b2830d1c365a44d48fedbd8d9bb602bb1081b2bc590654874532aa1bcdccad646

Download Submit
C:\Users\Public\Downloads\dupe.exe

Filesize
111KB

MD5
3c6f5e7ca1f0279c860554b7b4dfaf5d

SHA1
15c4baaa666353eb7dd5d28a76aead8bf14bc352

SHA256
f7514a2e0e612b0b4211c4655fedc3a7052578f38f1bfe131e2213102c164e34

SHA512
1c8ac972d4ef27ec0f80e850137a8f19c95c72b97f2dede9c4d0caf007709133a5f2e248f6f04bc6e30fbbea742b8f4ae66a4f3408ab0d00ca48c48865947b09

Download Submit
memory/2704-10-0x0000000001350000-0x0000000001372000-memory.dmp

Filesize
136KB

Download
memory/3032-0-0x000007FEF6193000-0x000007FEF6194000-memory.dmp

Filesize
4KB

Download
memory/3032-1-0x0000000000EF0000-0x0000000000F12000-memory.dmp

Filesize
136KB

Download
memory/3032-2-0x000007FEF6190000-0x000007FEF6B7C000-memory.dmp

Filesize
9.9MB

Download
memory/3032-5-0x000007FEF6190000-0x000007FEF6B7C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads