toxiceye | 99a161958aa54105ca4da8beaa81349916e6f8be606cfa3330e6bfd2cabf0d59

General

Target

NursultanCrack.exe
Size

316KB
MD5

606f0b6807bd48c75df315455cdf3115
SHA1

386abb6a3af6d758c31622d333b1dd40111d576c
SHA256

99a161958aa54105ca4da8beaa81349916e6f8be606cfa3330e6bfd2cabf0d59
SHA512

8ee4a172934e79d0e670674c1e39a41d2e7eb7c30295f26aef6a6318be7764acb8e66107d4bfb6de080cf7d2cee5d4806974f4575f7a56305db5bd7c6197b249
SSDEEP

3072:3bGb9aUEDppbpYHDQWgzCrAZuRDTXJtFg3MZfZpxy4MfY9d1ZOeyDqL+WeCCOOSr:Kb9apnb+ifOx7y41keymL+WeCCOOSS

Score

10^/10

toxiceye rat trojan

Malware Config

Extracted

Family

toxiceye

C2

https://api.telegram.org/bot7323288274:AAG3J41fmlCLnpBQrpmptPYElp52emNgHNU/sendMessage?chat_id=6002437029

Signatures

ToxicEye
ToxicEye is a trojan written in C#.
rat trojan toxiceye
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2592 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

rat.exe

pid process

2680 rat.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2552 timeout.exe
Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

2696 tasklist.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

2428 schtasks.exe
2796 schtasks.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

rat.exe

pid process

2680 rat.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

rat.exe

pid process

2680 rat.exe
2680 rat.exe
2680 rat.exe

pid	process
2592	cmd.exe

pid	process
2680	rat.exe

pid	process
2552	timeout.exe

pid	process
2696	tasklist.exe

pid	process
2428	schtasks.exe
2796	schtasks.exe

pid	process
2680	rat.exe

pid	process
2680	rat.exe
2680	rat.exe
2680	rat.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

NursultanCrack.exetasklist.exerat.exe

description	pid	process
Token: SeDebugPrivilege	2128	NursultanCrack.exe
Token: SeDebugPrivilege	2696	tasklist.exe
Token: SeDebugPrivilege	2680	rat.exe
Token: SeDebugPrivilege	2680	rat.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rat.exe

pid process

2680 rat.exe

pid	process
2680	rat.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

NursultanCrack.execmd.exerat.exe

description	pid	process	target process
PID 2128 wrote to memory of 2796	2128	NursultanCrack.exe	schtasks.exe
PID 2128 wrote to memory of 2796	2128	NursultanCrack.exe	schtasks.exe
PID 2128 wrote to memory of 2796	2128	NursultanCrack.exe	schtasks.exe
PID 2128 wrote to memory of 2592	2128	NursultanCrack.exe	cmd.exe
PID 2128 wrote to memory of 2592	2128	NursultanCrack.exe	cmd.exe
PID 2128 wrote to memory of 2592	2128	NursultanCrack.exe	cmd.exe
PID 2592 wrote to memory of 2696	2592	cmd.exe	tasklist.exe
PID 2592 wrote to memory of 2696	2592	cmd.exe	tasklist.exe
PID 2592 wrote to memory of 2696	2592	cmd.exe	tasklist.exe
PID 2592 wrote to memory of 2604	2592	cmd.exe	find.exe
PID 2592 wrote to memory of 2604	2592	cmd.exe	find.exe
PID 2592 wrote to memory of 2604	2592	cmd.exe	find.exe
PID 2592 wrote to memory of 2552	2592	cmd.exe	timeout.exe
PID 2592 wrote to memory of 2552	2592	cmd.exe	timeout.exe
PID 2592 wrote to memory of 2552	2592	cmd.exe	timeout.exe
PID 2592 wrote to memory of 2680	2592	cmd.exe	rat.exe
PID 2592 wrote to memory of 2680	2592	cmd.exe	rat.exe
PID 2592 wrote to memory of 2680	2592	cmd.exe	rat.exe
PID 2680 wrote to memory of 2428	2680	rat.exe	schtasks.exe
PID 2680 wrote to memory of 2428	2680	rat.exe	schtasks.exe
PID 2680 wrote to memory of 2428	2680	rat.exe	schtasks.exe
PID 2680 wrote to memory of 1096	2680	rat.exe	WerFault.exe
PID 2680 wrote to memory of 1096	2680	rat.exe	WerFault.exe
PID 2680 wrote to memory of 1096	2680	rat.exe	WerFault.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\NursultanCrack.exe
"C:\Users\Admin\AppData\Local\Temp\NursultanCrack.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2796
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp114F.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp114F.tmp.bat
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2128"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2696
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2604
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2552
- - C:\Users\ToxicEye\rat.exe
    "rat.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2680
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2428
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2680 -s 1620
      4⤵
      PID:1096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp114F.tmp.bat

Filesize
191B

MD5
8bec099d8a1a3902422cd40cac1ff829

SHA1
a072d8d75406f102973ec2920071d8ccb5cd61ec

SHA256
21adb810634bb2aabf6fbd81886e54e6dffd2689d541705e4fc1e50fbd0f11d8

SHA512
349d291c3b29a853e6955efb20c8d414121d7eec13c0002b36ec8c2b30bd81ad93851d4683d6281cebaba39f90e94ba4fa22fc39f67024ddb911ab301a0b75e6

Download Submit
C:\Users\ToxicEye\rat.exe

Filesize
316KB

MD5
606f0b6807bd48c75df315455cdf3115

SHA1
386abb6a3af6d758c31622d333b1dd40111d576c

SHA256
99a161958aa54105ca4da8beaa81349916e6f8be606cfa3330e6bfd2cabf0d59

SHA512
8ee4a172934e79d0e670674c1e39a41d2e7eb7c30295f26aef6a6318be7764acb8e66107d4bfb6de080cf7d2cee5d4806974f4575f7a56305db5bd7c6197b249

Download Submit
memory/2128-0-0x000007FEF56D3000-0x000007FEF56D4000-memory.dmp

Filesize
4KB

Download
memory/2128-1-0x0000000001270000-0x00000000012C4000-memory.dmp

Filesize
336KB

Download
memory/2128-2-0x000007FEF56D0000-0x000007FEF60BC000-memory.dmp

Filesize
9.9MB

Download
memory/2128-5-0x000007FEF56D0000-0x000007FEF60BC000-memory.dmp

Filesize
9.9MB

Download
memory/2680-10-0x0000000000910000-0x0000000000964000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads