toxiceye | 7485b221926010f27cda7f15f35a5c465558eb8c20b4fc37053850ed2b4a211a

General

Target

7485b221926010f27cda7f15f35a5c465558eb8c20b4fc37053850ed2b4a211a.exe
Size

111KB
MD5

86de4e40528fd099ae01872b6af837cf
SHA1

c616d8e3dc5643a15127dce69a327ce37a6b8ab8
SHA256

7485b221926010f27cda7f15f35a5c465558eb8c20b4fc37053850ed2b4a211a
SHA512

e9912f89c17ff6e7cd897d3256a2a4cd097090dcfee2a8dd85d98de0e618513efe8d3508cca5cbeb2711f27b4602c22cadd25f8eb1b417e7244da54a5db3a4c5
SSDEEP

1536:Y+bxQAsnqLoM91qQIwxHxZxdyyKDWfCbhDqI64QWEzCrAZuhn7Dr:PbTsnwo0RZxjQbxqH4QWEzCrAZuh/r

Score

10^/10

toxiceye discovery rat trojan

Malware Config

Extracted

Family

toxiceye

C2

https://api.telegram.org/bot7302074945:AAGKx5TnjPyRM_fqN4XQLd4uz-PUp4nl8w4/sendMessage?chat_id=6414125020

Signatures

ToxicEye
ToxicEye is a trojan written in C#.
rat trojan toxiceye
Toxiceye family
toxiceye

Deletes itself 1 IoCs

pid	Process
2624	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
3060	rat.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
2592	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2744	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3028	schtasks.exe
2760	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3060	rat.exe
3060	rat.exe
3060	rat.exe
3060	rat.exe
3060	rat.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2160	7485b221926010f27cda7f15f35a5c465558eb8c20b4fc37053850ed2b4a211a.exe
Token: SeDebugPrivilege	2592	tasklist.exe
Token: SeDebugPrivilege	3060	rat.exe
Token: SeDebugPrivilege	3060	rat.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3060	rat.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2760	2160	7485b221926010f27cda7f15f35a5c465558eb8c20b4fc37053850ed2b4a211a.exe	32
PID 2160 wrote to memory of 2760	2160	7485b221926010f27cda7f15f35a5c465558eb8c20b4fc37053850ed2b4a211a.exe	32
PID 2160 wrote to memory of 2760	2160	7485b221926010f27cda7f15f35a5c465558eb8c20b4fc37053850ed2b4a211a.exe	32
PID 2160 wrote to memory of 2624	2160	7485b221926010f27cda7f15f35a5c465558eb8c20b4fc37053850ed2b4a211a.exe	34
PID 2160 wrote to memory of 2624	2160	7485b221926010f27cda7f15f35a5c465558eb8c20b4fc37053850ed2b4a211a.exe	34
PID 2160 wrote to memory of 2624	2160	7485b221926010f27cda7f15f35a5c465558eb8c20b4fc37053850ed2b4a211a.exe	34
PID 2624 wrote to memory of 2592	2624	cmd.exe	36
PID 2624 wrote to memory of 2592	2624	cmd.exe	36
PID 2624 wrote to memory of 2592	2624	cmd.exe	36
PID 2624 wrote to memory of 2608	2624	cmd.exe	37
PID 2624 wrote to memory of 2608	2624	cmd.exe	37
PID 2624 wrote to memory of 2608	2624	cmd.exe	37
PID 2624 wrote to memory of 2744	2624	cmd.exe	38
PID 2624 wrote to memory of 2744	2624	cmd.exe	38
PID 2624 wrote to memory of 2744	2624	cmd.exe	38
PID 2624 wrote to memory of 3060	2624	cmd.exe	39
PID 2624 wrote to memory of 3060	2624	cmd.exe	39
PID 2624 wrote to memory of 3060	2624	cmd.exe	39
PID 3060 wrote to memory of 3028	3060	rat.exe	41
PID 3060 wrote to memory of 3028	3060	rat.exe	41
PID 3060 wrote to memory of 3028	3060	rat.exe	41
PID 3060 wrote to memory of 2156	3060	rat.exe	43
PID 3060 wrote to memory of 2156	3060	rat.exe	43
PID 3060 wrote to memory of 2156	3060	rat.exe	43

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\7485b221926010f27cda7f15f35a5c465558eb8c20b4fc37053850ed2b4a211a.exe
"C:\Users\Admin\AppData\Local\Temp\7485b221926010f27cda7f15f35a5c465558eb8c20b4fc37053850ed2b4a211a.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2760
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp696D.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp696D.tmp.bat
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2160"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2592
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2608
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2744
- - C:\Users\ToxicEye\rat.exe
    "rat.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3060
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3028
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 3060 -s 1540
      4⤵
      PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp696D.tmp.bat

Filesize
241B

MD5
b3821831585b26d3b60bc3618640a6ec

SHA1
d55320db3aab846f5562fcfaa891616bd4625bb3

SHA256
cbdbbe14764d54f26a25f22bd5a6a88f14518950bc421c1d36526f5ac88d92eb

SHA512
10725874fec3861cb18b7e541756a788a2eac6b7dedb4ed5d6c8d57a84db9c8a02f993e7a408c946473d21a7d144dafbbd6a028d79ed3726471de603b290f15f

Download Submit
C:\Users\ToxicEye\rat.exe

Filesize
111KB

MD5
86de4e40528fd099ae01872b6af837cf

SHA1
c616d8e3dc5643a15127dce69a327ce37a6b8ab8

SHA256
7485b221926010f27cda7f15f35a5c465558eb8c20b4fc37053850ed2b4a211a

SHA512
e9912f89c17ff6e7cd897d3256a2a4cd097090dcfee2a8dd85d98de0e618513efe8d3508cca5cbeb2711f27b4602c22cadd25f8eb1b417e7244da54a5db3a4c5

Download Submit
memory/2160-0-0x000007FEF52B3000-0x000007FEF52B4000-memory.dmp

Filesize
4KB

Download
memory/2160-1-0x0000000001380000-0x00000000013A2000-memory.dmp

Filesize
136KB

Download
memory/2160-2-0x000007FEF52B0000-0x000007FEF5C9C000-memory.dmp

Filesize
9.9MB

Download
memory/2160-5-0x000007FEF52B0000-0x000007FEF5C9C000-memory.dmp

Filesize
9.9MB

Download
memory/3060-10-0x0000000000FE0000-0x0000000001002000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads