Overview
overview
10Static
static
10Data/Modul...io.dll
windows7-x64
1Data/Modul...io.dll
windows10-2004-x64
1Data/Modul...pi.dll
windows7-x64
1Data/Modul...pi.dll
windows10-2004-x64
1Data/Modules/Jint.dll
windows7-x64
1Data/Modules/Jint.dll
windows10-2004-x64
1Data/Modul...et.dll
windows7-x64
1Data/Modul...et.dll
windows10-2004-x64
1Data/Modul...on.dll
windows7-x64
1Data/Modul...on.dll
windows10-2004-x64
1Data/Modul...um.dll
windows7-x64
1Data/Modul...um.dll
windows10-2004-x64
1Data/Modul...he.exe
windows7-x64
1Data/Modul...he.exe
windows10-2004-x64
1Data/Modul...e1.exe
windows7-x64
10Data/Modul...e1.exe
windows10-2004-x64
10Jint.dll
windows7-x64
1Jint.dll
windows10-2004-x64
1Start Checker.bat
windows7-x64
10Start Checker.bat
windows10-2004-x64
10Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2024 16:47
Behavioral task
behavioral1
Sample
Data/Modules/AudioSwitcher.AudioApi.CoreAudio.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Data/Modules/AudioSwitcher.AudioApi.CoreAudio.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Data/Modules/AudioSwitcher.AudioApi.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Data/Modules/AudioSwitcher.AudioApi.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Data/Modules/Jint.dll
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
Data/Modules/Jint.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Data/Modules/Leaf.xNet.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Data/Modules/Leaf.xNet.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Data/Modules/Newtonsoft.Json.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Data/Modules/Newtonsoft.Json.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Data/Modules/Sodium.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Data/Modules/Sodium.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Data/Modules/porsche.exe
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
Data/Modules/porsche.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
Data/Modules/porsche1.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Data/Modules/porsche1.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
Jint.dll
Resource
win7-20241010-en
Behavioral task
behavioral18
Sample
Jint.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
Start Checker.bat
Resource
win7-20241010-en
General
-
Target
Start Checker.bat
-
Size
63B
-
MD5
7cd830db1b8da52c0062cc6f260a9685
-
SHA1
ed401d18b0095fc94e4809b7d1ff433dd05697f4
-
SHA256
d3347618ea5777b3d58e2005afbebe1e9d484405919333f41bc0ddb189261758
-
SHA512
c735b66dc15a37221b65e9350115db78ee55cb3ef11f401bc9f744be2b1283a16937d62ca8344c071febd6ddd4ccf924b001bbb79a5d03519bf49328264ae097
Malware Config
Extracted
toxiceye
https://api.telegram.org/bot8144564059:AAGZGbvRRUEPFcw0XVG2BW_EHAzXGMZHSwk/sendMessage?chat_id=5059028006
Signatures
-
Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral20/memory/4940-2-0x0000025075DA0000-0x0000025075DC8000-memory.dmp disable_win_def behavioral20/files/0x000a000000023b97-14.dat disable_win_def -
Toxiceye family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation rat.exe -
Executes dropped EXE 1 IoCs
pid Process 3384 rat.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 232 tasklist.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 1388 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4704 schtasks.exe 1380 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3384 rat.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe 3384 rat.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4940 porsche1.exe Token: SeDebugPrivilege 232 tasklist.exe Token: SeDebugPrivilege 3384 rat.exe Token: SeDebugPrivilege 3384 rat.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3384 rat.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2116 wrote to memory of 5100 2116 cmd.exe 83 PID 2116 wrote to memory of 5100 2116 cmd.exe 83 PID 2116 wrote to memory of 4940 2116 cmd.exe 85 PID 2116 wrote to memory of 4940 2116 cmd.exe 85 PID 4940 wrote to memory of 1380 4940 porsche1.exe 88 PID 4940 wrote to memory of 1380 4940 porsche1.exe 88 PID 4940 wrote to memory of 4600 4940 porsche1.exe 90 PID 4940 wrote to memory of 4600 4940 porsche1.exe 90 PID 4600 wrote to memory of 232 4600 cmd.exe 92 PID 4600 wrote to memory of 232 4600 cmd.exe 92 PID 4600 wrote to memory of 1624 4600 cmd.exe 93 PID 4600 wrote to memory of 1624 4600 cmd.exe 93 PID 4600 wrote to memory of 1388 4600 cmd.exe 94 PID 4600 wrote to memory of 1388 4600 cmd.exe 94 PID 4600 wrote to memory of 3384 4600 cmd.exe 95 PID 4600 wrote to memory of 3384 4600 cmd.exe 95 PID 3384 wrote to memory of 4704 3384 rat.exe 99 PID 3384 wrote to memory of 4704 3384 rat.exe 99 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Start Checker.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\Data\Modules\porsche.exeData\Modules\porsche.exe2⤵PID:5100
-
-
C:\Users\Admin\AppData\Local\Temp\Data\Modules\porsche1.exeData\Modules\porsche1.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\CyberEye\rat.exe"3⤵
- Scheduled Task/Job: Scheduled Task
PID:1380
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpB333.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpB333.tmp.bat3⤵
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 4940"4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:232
-
-
C:\Windows\system32\find.exefind ":"4⤵PID:1624
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak4⤵
- Delays execution with timeout.exe
PID:1388
-
-
C:\Users\CyberEye\rat.exe"rat.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\CyberEye\rat.exe"5⤵
- Scheduled Task/Job: Scheduled Task
PID:4704
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
185B
MD514cadc379e175c7b28c1e03f5758154f
SHA1b8e4bd656afd746112b1398e6790305be68e62cf
SHA256db89ced89eda23d9da6399065bcaac0c640462a209b010a06b510b1462f34cb0
SHA512fe309f706a3de2a69b8bf3be09760b9b0199fd6f19577557324bdda079cf391ddc0ee06fb9460648d217e49ca77dfb41334f7c534e628b1fe0a54edc64f78626
-
Filesize
137KB
MD5a5c1ee36b5adf088e4938ff2c350291f
SHA1da217a5def61fc33710ee60659f59937cbcc1fb4
SHA2569b4cf6cdae00466be75f8da110fd512f58e54dc2b939fb92c44eb2cbdb82b639
SHA5122e7d647dd29db3ec126ef18e1e24e87e7482264376722754676af2d0c53e2a7bd1bc7d8b6c62526882b6ac0c0f498e247fa2de7d594c922e745966d5b6c2878e