toxiceye | 3e37cefc156c265e1b048f8f59caf0e87c9bd097e9a43d4c0eeb2f05999add5b

Analysis

max time kernel
300s
max time network
248s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-09-2024 14:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TelegramRAT.exe
Size

111KB
MD5

9c6f004d573a9660f4201028b795cfad
SHA1

235d54b393067c9ebceaf89c25877f8f310bb037
SHA256

3e37cefc156c265e1b048f8f59caf0e87c9bd097e9a43d4c0eeb2f05999add5b
SHA512

ddc6c0856576611329be1ca108c2d97854a6efef1bc3ad3d4266c562b8ff92a31990dbe4d3cbce57c13f733bdbfd9d3e98a8200929ced2f26b4c63743bb08ef5
SSDEEP

1536:G+bAQAsnqLoM91qQIwxHxZxdyyKDWfibhDqI64QW3zCrAZuP74DS:5bKsnwo0RZxjQbxqH4QW3zCrAZuPoS

Score

10^/10

toxiceye discovery evasion rat spyware stealer trojan

Malware Config

Extracted

Family

toxiceye

https://api.telegram.org/bot7313933025:AAHouyLOfu1tAXngtnciu-autL9gI2FqI-I/sendMessage?chat_id=5597821522

Signatures

ToxicEye
ToxicEye is a trojan written in C#.
rat trojan toxiceye
Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

TelegramRAT.exerat.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	TelegramRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	rat.exe

Executes dropped EXE 1 IoCs

Processes:

rat.exe

pid process

3112 rat.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

92 raw.githubusercontent.com
93 raw.githubusercontent.com
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
Enumerates processes with tasklist 1 TTPs 1 IoCs
discovery

Process Discovery
T1057

Processes:

tasklist.exe

pid process

4664 tasklist.exe
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

4388 timeout.exe

flow	ioc
92	raw.githubusercontent.com
93	raw.githubusercontent.com

pid	process
4664	tasklist.exe

pid	process
4388	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "58"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

2848 schtasks.exe
3312 schtasks.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

rat.exe

pid process

3112 rat.exe

pid	process
2848	schtasks.exe
3312	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rat.exemsedge.exemsedge.exeidentity_helper.exe

pid	process
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3312	msedge.exe
3312	msedge.exe
4956	msedge.exe
4956	msedge.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
4584	identity_helper.exe
4584	identity_helper.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe
3112	rat.exe

Suspicious behavior: LoadsDriver 64 IoCs

Processes:

pid	process
4888
1300
2724
712
3036
3700
1308
1592
3460
5052
4772
3748
336
4128
4136
2388
3796
2576
3600
916
2332
2964
3628
4748
2940
408
3924
3176
4668
4552
4080
824
4452
5028
1992
3608
2740
5024
2528
4960
4572
4912
1636
3784
2212
880
1456
3344
3280
4488
4968
1232
3880
3068
1948
1488
4952
412
1776
5072
4704
4112
2780
3800

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

4956 msedge.exe
4956 msedge.exe
4956 msedge.exe
4956 msedge.exe
4956 msedge.exe
4956 msedge.exe
4956 msedge.exe
4956 msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

TelegramRAT.exetasklist.exerat.exeAUDIODG.EXE

description	pid	process
Token: SeDebugPrivilege	3248	TelegramRAT.exe
Token: SeDebugPrivilege	4664	tasklist.exe
Token: SeDebugPrivilege	3112	rat.exe
Token: SeDebugPrivilege	3112	rat.exe
Token: 33	1732	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1732	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

rat.exeLogonUI.exe

pid process

3112 rat.exe
4424 LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

TelegramRAT.execmd.exerat.exemsedge.exe

description	pid	process	target process
PID 3248 wrote to memory of 3312	3248	TelegramRAT.exe	schtasks.exe
PID 3248 wrote to memory of 3312	3248	TelegramRAT.exe	schtasks.exe
PID 3248 wrote to memory of 3348	3248	TelegramRAT.exe	cmd.exe
PID 3248 wrote to memory of 3348	3248	TelegramRAT.exe	cmd.exe
PID 3348 wrote to memory of 4664	3348	cmd.exe	tasklist.exe
PID 3348 wrote to memory of 4664	3348	cmd.exe	tasklist.exe
PID 3348 wrote to memory of 3516	3348	cmd.exe	find.exe
PID 3348 wrote to memory of 3516	3348	cmd.exe	find.exe
PID 3348 wrote to memory of 4388	3348	cmd.exe	timeout.exe
PID 3348 wrote to memory of 4388	3348	cmd.exe	timeout.exe
PID 3348 wrote to memory of 3112	3348	cmd.exe	rat.exe
PID 3348 wrote to memory of 3112	3348	cmd.exe	rat.exe
PID 3112 wrote to memory of 2848	3112	rat.exe	schtasks.exe
PID 3112 wrote to memory of 2848	3112	rat.exe	schtasks.exe
PID 3112 wrote to memory of 4956	3112	rat.exe	msedge.exe
PID 3112 wrote to memory of 4956	3112	rat.exe	msedge.exe
PID 4956 wrote to memory of 1416	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 1416	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 1700	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 1700	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 1700	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 1700	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 1700	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 1700	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 1700	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 1700	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 1700	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 1700	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 1700	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 1700	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 1700	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 1700	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 1700	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 1700	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 1700	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 1700	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 1700	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 1700	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 1700	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 1700	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 1700	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 1700	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 1700	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 1700	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 1700	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 1700	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 1700	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 1700	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 1700	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 1700	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 1700	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 1700	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 1700	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 1700	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 1700	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 1700	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 1700	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 1700	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 3312	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 3312	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 2136	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 2136	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 2136	4956	msedge.exe	msedge.exe
PID 4956 wrote to memory of 2136	4956	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe
"C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3312
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpD11B.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpD11B.tmp.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3348
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 3248"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4664
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:3516
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4388
- - C:\Users\ToxicEye\rat.exe
    "rat.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3112
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4956
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff590146f8,0x7fff59014708,0x7fff59014718
        5⤵
        
        PID:1416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1528,6387422147568599936,12144146151980883283,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1876 /prefetch:2
        5⤵
        
        PID:1700
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1528,6387422147568599936,12144146151980883283,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2452 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3312
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1528,6387422147568599936,12144146151980883283,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
        5⤵
        
        PID:2136
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1528,6387422147568599936,12144146151980883283,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
        5⤵
        
        PID:1140
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1528,6387422147568599936,12144146151980883283,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
        5⤵
        
        PID:1996
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1528,6387422147568599936,12144146151980883283,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3100 /prefetch:1
        5⤵
        
        PID:3692
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1528,6387422147568599936,12144146151980883283,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
        5⤵
        
        PID:4176
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1528,6387422147568599936,12144146151980883283,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3404 /prefetch:8
        5⤵
        
        PID:3468
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1528,6387422147568599936,12144146151980883283,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5328 /prefetch:8
        5⤵
        
        PID:1992
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1528,6387422147568599936,12144146151980883283,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5648 /prefetch:8
        5⤵
        
        PID:5024
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1528,6387422147568599936,12144146151980883283,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5648 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4584
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1528,6387422147568599936,12144146151980883283,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
        5⤵
        
        PID:1376
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1528,6387422147568599936,12144146151980883283,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
        5⤵
        
        PID:5092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1528,6387422147568599936,12144146151980883283,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
        5⤵
        
        PID:60
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1528,6387422147568599936,12144146151980883283,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
        5⤵
        
        PID:3988
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1528,6387422147568599936,12144146151980883283,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1296 /prefetch:2
        5⤵
        
        PID:2628
  - - C:\Windows\System32\shutdown.exe
      "C:\Windows\System32\shutdown.exe" /l
      4⤵
      PID:3608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1308

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:8

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x49c 0x2fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3176

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa394c855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
0de42e1d7cbf79706b13659d9daad4ed

SHA1
e69b096acdbf7fff1faaf4a8b226dc22c507e085

SHA256
093350b9340b694bd5edf4f0bfee6aac3591626c7bb5470cdfd5dee6cbf73bc9

SHA512
1a8615a11eb14e6e490c50692892695eb87adcf4c0b0f2a01d62ca9a1a4705ee71fb0b289efdfbf0198bf50fba6b6a95541e8aab6f475a67de491dc12c5ddc42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
3143f373abf1b7c8752002a022f481f7

SHA1
f9bc297bb08a201eac2150b9492b7a1fb9be8bc8

SHA256
616f372cb7b869902fc024dbc7bca6434bb72783ab2b8d596feec1a53d969131

SHA512
7e4a39ead1b3b7a7b9450654f251d615800f1f17e7bbebb019af20c9ac2b8411351d68cfc5530e5391f4f1c680f9b3ee8dd17787864f65a4a559411999e3b8ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
0544e63f70c95bd5f6fe0ff4da023f1f

SHA1
bdd2494fa4ba4776475ac8bdc10cb6099b0fde2e

SHA256
00839ba01089218182c1ee53327054e86f9ef18dfde12b704c05643b5af68ed0

SHA512
faa74fc0aec511deca99287424476cfe5ed919f880f63129e8c1f8d1f8df7503527c69ee58ba050ba5c3ef85f5a347ab54502ee5fbff7695650f056849b6575e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
06e3d38b35fc4700d355113ce1ee754e

SHA1
29b7f273236b043cfcce25f7c31744bb0b1618d8

SHA256
e173b63af00d2590db5aff08472dfc1787d265e52df063ebee57130caecb3200

SHA512
c62de5053a8c2531645ae7d108b43fd7f71a5a032a43d17ebb8f3c73e783140c009d60f898dfd42c98e6e1f7f17d1d090538beb6f125d8cccc35e33df24fedef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
16aa855c87cbf297a9ccc03f19fa77c4

SHA1
68daffcf772a8a57e0282839ba0e57467593949c

SHA256
5a6297f5b7878ca9f00d09122e469a953b3f089c2e4a7142a408a0a799ae25ec

SHA512
ca5e36872b9058593ccc24519002d576857d58f62f5bbbffab30fb4be3332050cb891d1358052caa566f1d9f4c4036d21d24848ac1f204e2b8cd6ad5562da60a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\d4ac8666-9aeb-4b78-a462-298f7b92820b\index-dir\the-real-index

Filesize
2KB

MD5
2814cb2fa4a1602cabeb606e839ef9dc

SHA1
3509c6fba1dfa96ded33bf86f43213b51c8560ad

SHA256
e8708c2bba2974365f93092a442cf7bf70dd387f9cec5ed2cafe6205c71e23a0

SHA512
492f2c58fccc46f64502da8131e6fcddf80ea0b75a263639dba49c73f9af23b88a3403391f45a32933f851dd19386a054faa5e152174ba8efbbd69c4a45350e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\d4ac8666-9aeb-4b78-a462-298f7b92820b\index-dir\the-real-index~RFe594934.TMP

Filesize
48B

MD5
cf551c34e367ca10c56971da0a0060bf

SHA1
ec4ab674066615abb1e0c42a7c274c2d0362740c

SHA256
3402d6c9731bf34d699d3353b20f6d3679199b260ac8118ea933cef12a92ef66

SHA512
a11985e7db46b804fcaa80353df47bca74b750fd442c74a6f1876c83d6ecc427302df652acf577c1eec2f32422ced69121eb9072ae16fb959631f2eee0cbf43b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
ab7f585ef2a76157076db8565b682c41

SHA1
646048e100ca4be3d384bdc90bd009340d3523d8

SHA256
8aa0da01033ac3fbe12452af46b8ec03310a902deb69b4b2f53f05ec7548400a

SHA512
5c0d554fbb8db0d0a819ddb8458eb64b81525ed1e04a6d2ddb8bb8304c24384d6428fce9312992ce782a53a9823dc7df214d224f1019755c2fc7fae85bb2560d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
59bb36afcdc63623f523aa7e0dd766e8

SHA1
acf1e761a96101aa8673431fe299c3855dabfb30

SHA256
26f6178d3b589d8d3573ef47987c3a7de220894cbcb2d8832fb887fb3bbaea28

SHA512
948a722570e35c5ebf7e1df081a6405c916b46e41045b383e52a86299ece8ad3ef394ce4d3d019bf64830ba1e9f51a90e00537a0a22f66244c0dc1ecbe2add96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
f61132c132bf32dfd61d54bbb9616d93

SHA1
e6afbe2342fe13ff6f4999374aeb81fdddca9050

SHA256
28fac1bba3fdc2f217b53a48f0309c3d0a6f57db7ecece07aebda4366db4a457

SHA512
435fbcd1a2880ad3e632a8020b290123e092d475c0ba53534301d80e30acbe4860d66e085dec7ff45cf9b6d295a021c736e834a8c05fb08d0cedde16a5593563

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
0fb2b9aab57ad682d464e4f1e1f2cab8

SHA1
cf53b31e72831c86188f4a60d0bc71bdc1b58647

SHA256
0f11962bce5dff3d2e489f93688b651e31710c28372c9910dc3325612c83572e

SHA512
6cce6ca95fc03e095ac5ea02e4449a0c4888e7954a3e9475a5375ec78f2553a694079e2cc56a2b2b649115d7276e35d8686a9aa8f88b0788e1004480212b030f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
50deac6abca08b25ccc24d21ed0e22ab

SHA1
076576cf346c068360d303ac6317732cbfe7a5d2

SHA256
30f617f5496ac43c44c3725032f7b0ab91ffc9038743a79d65c4dc3f649f3478

SHA512
8166014cf90b6ad5eab5d09efcaeb8a32a0ca8f9b1c7f63eb5968585a24e148bf67a1cf99b20e3d655b5d7a66236c89795dcd64870b8cefaafc470a035d7e5b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe594378.TMP

Filesize
48B

MD5
716fdc513085e370e6a999dc4fd5b1db

SHA1
086f118a0558b038eb9f91ca5bac64de8f41896c

SHA256
650eb485c21901dc0ed89429c9607638e8805b467a686b35aefc4704dafc1604

SHA512
17ca80c6f70191d2daac718041d557f090a8557a8150b26ff0a1ed10daa47361dc0088f669dd505c84a94989df26d3c86b52fd189c1a042e357738780917b94d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3d34875a485ba9ac7a0cd6784bd595eb

SHA1
e926e0879d2ca610327e93ecd5b1bc8474e2bd45

SHA256
d77058f98dba938d222ee48f4b0fb8bb80747d951f7443fe540b23e91bb440e0

SHA512
df99a374d2ed15e8a8c1ed7afd0d543dd4dc7c32f27a0a6ecb302c199ccd496eedcc98476b11d934a10224c13d2bf684b70b919488d658c9ee33499a6244e4f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD11B.tmp.bat

Filesize
188B

MD5
71d99eae013d0d909eca8bfaa713bcff

SHA1
17446b1de496d3a74c7042d087c51ef3195ae131

SHA256
93a05226140fbc423be541f89d844c4450c902cbe7717f00a94b410dcbb91032

SHA512
8c9871fb7b07c3496993e4e868591bc1675e39626b3406f83878fcf7057ab6e4ae7d8231bc554fe98c2459fff2e28283cf9e75d23ac9cc544578244b2abc5d12

Download Submit
C:\Users\ToxicEye\rat.exe

Filesize
111KB

MD5
9c6f004d573a9660f4201028b795cfad

SHA1
235d54b393067c9ebceaf89c25877f8f310bb037

SHA256
3e37cefc156c265e1b048f8f59caf0e87c9bd097e9a43d4c0eeb2f05999add5b

SHA512
ddc6c0856576611329be1ca108c2d97854a6efef1bc3ad3d4266c562b8ff92a31990dbe4d3cbce57c13f733bdbfd9d3e98a8200929ced2f26b4c63743bb08ef5

Download Submit
\??\pipe\LOCAL\crashpad_4956_BPXQQEKEMMUTTJYC

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/3112-12-0x00000225C1950000-0x00000225C19C6000-memory.dmp

Filesize
472KB

Download
memory/3112-13-0x00000225C13C0000-0x00000225C1569000-memory.dmp

Filesize
1.7MB

Download
memory/3112-11-0x00000225C1820000-0x00000225C18CA000-memory.dmp

Filesize
680KB

Download
memory/3112-316-0x00000225C16F0000-0x00000225C16FA000-memory.dmp

Filesize
40KB

Download
memory/3112-398-0x00000225C13C0000-0x00000225C1569000-memory.dmp

Filesize
1.7MB

Download
memory/3248-0-0x00007FFF5D963000-0x00007FFF5D965000-memory.dmp

Filesize
8KB

Download
memory/3248-6-0x00007FFF5D960000-0x00007FFF5E421000-memory.dmp

Filesize
10.8MB

Download
memory/3248-2-0x00007FFF5D960000-0x00007FFF5E421000-memory.dmp

Filesize
10.8MB

Download
memory/3248-1-0x000002207EED0000-0x000002207EEF2000-memory.dmp

Filesize
136KB

Download