toxiceye | 43eca90ecc5958fd358a9240f31b1811ad2d01c6db10397cfd88e445ff8be5e0

Reason

Machine shutdown

General

Target

TelegramRAT.exe
Size

119KB
MD5

47436ad8508cbdbede6535db163766bc
SHA1

c6c6f8eb7dac9f294da1547e30c320a7d316bf52
SHA256

43eca90ecc5958fd358a9240f31b1811ad2d01c6db10397cfd88e445ff8be5e0
SHA512

255a5618cf57a4930e08e02628bef7533289e2968fcf0d1db617447f7c04245978fc9d83c29247ffd9478a5428a3491a28458bcb2eb05efb0a4566ad43bf5a9c
SSDEEP

3072:gAWfRzlXCwwFwOwWAmm+G/bxqH8QW8zCrAZu/tM1:gAD1SWHe/bg/p

Score

10^/10

toxiceye discovery rat trojan

Malware Config

Extracted

Family

toxiceye

C2

https://api.telegram.org/bot7919388970:AAGC7fUBzVyMANzjN6bhRPjR0LNTw4C5Zlo/sendMessage?chat_id=8130842755

Signatures

ToxicEye
ToxicEye is a trojan written in C#.
rat trojan toxiceye
Toxiceye family
toxiceye

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\Control Panel\International\Geo\Nation	TelegramRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\Control Panel\International\Geo\Nation	rat.exe

Executes dropped EXE 1 IoCs

pid	Process
3188	rat.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
2548	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4692	timeout.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "174"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3212	schtasks.exe
2028	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3188	rat.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
3188	rat.exe
3188	rat.exe
3188	rat.exe
3188	rat.exe
3188	rat.exe
3188	rat.exe
3188	rat.exe
3188	rat.exe
3188	rat.exe
3188	rat.exe
3188	rat.exe
3188	rat.exe
3188	rat.exe
3188	rat.exe
3188	rat.exe
3188	rat.exe
3188	rat.exe
3188	rat.exe
3188	rat.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4792	TelegramRAT.exe
Token: SeDebugPrivilege	2548	tasklist.exe
Token: SeDebugPrivilege	3188	rat.exe
Token: SeDebugPrivilege	3188	rat.exe
Token: SeShutdownPrivilege	3344	shutdown.exe
Token: SeRemoteShutdownPrivilege	3344	shutdown.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3188	rat.exe
2464	LogonUI.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 3212	4792	TelegramRAT.exe	84
PID 4792 wrote to memory of 3212	4792	TelegramRAT.exe	84
PID 4792 wrote to memory of 4248	4792	TelegramRAT.exe	86
PID 4792 wrote to memory of 4248	4792	TelegramRAT.exe	86
PID 4248 wrote to memory of 2548	4248	cmd.exe	88
PID 4248 wrote to memory of 2548	4248	cmd.exe	88
PID 4248 wrote to memory of 4964	4248	cmd.exe	89
PID 4248 wrote to memory of 4964	4248	cmd.exe	89
PID 4248 wrote to memory of 4692	4248	cmd.exe	90
PID 4248 wrote to memory of 4692	4248	cmd.exe	90
PID 4248 wrote to memory of 3188	4248	cmd.exe	93
PID 4248 wrote to memory of 3188	4248	cmd.exe	93
PID 3188 wrote to memory of 2028	3188	rat.exe	96
PID 3188 wrote to memory of 2028	3188	rat.exe	96
PID 3188 wrote to memory of 3344	3188	rat.exe	102
PID 3188 wrote to memory of 3344	3188	rat.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe
"C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3212
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp8731.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp8731.tmp.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 4792"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2548
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:4964
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4692
- - C:\Users\ToxicEye\rat.exe
    "rat.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3188
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2028
  - - C:\Windows\System32\shutdown.exe
      "C:\Windows\System32\shutdown.exe" /s /t 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3344

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a20855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp8731.tmp.bat

Filesize
188B

MD5
d33f4a0544627c9786f04cb6638cb2d6

SHA1
50d9fa494024647b3e8976d1f11a4ea05ce941fd

SHA256
4a31556579084a5d4f3c92af8cb32e6fa0ac8c1260b8001d790ad7105e53f3d3

SHA512
42becddf497015e9f0631a660cfd83c91cf026be871603a4f00d008e42759815035735fac39e222207e2bcc96eb50069d9feeeb7a92a6b344ef062dcc0f5d31a

Download Submit
C:\Users\ToxicEye\rat.exe

Filesize
119KB

MD5
47436ad8508cbdbede6535db163766bc

SHA1
c6c6f8eb7dac9f294da1547e30c320a7d316bf52

SHA256
43eca90ecc5958fd358a9240f31b1811ad2d01c6db10397cfd88e445ff8be5e0

SHA512
255a5618cf57a4930e08e02628bef7533289e2968fcf0d1db617447f7c04245978fc9d83c29247ffd9478a5428a3491a28458bcb2eb05efb0a4566ad43bf5a9c

Download Submit
memory/3188-8-0x0000017932BD0000-0x0000017932C7A000-memory.dmp

Filesize
680KB

Download
memory/3188-9-0x0000017932D00000-0x0000017932D76000-memory.dmp

Filesize
472KB

Download
memory/4792-0-0x00007FFC89FE3000-0x00007FFC89FE5000-memory.dmp

Filesize
8KB

Download
memory/4792-1-0x0000013C8A230000-0x0000013C8A254000-memory.dmp

Filesize
144KB

Download
memory/4792-2-0x00007FFC89FE0000-0x00007FFC8AAA2000-memory.dmp

Filesize
10.8MB

Download
memory/4792-5-0x00007FFC89FE0000-0x00007FFC8AAA2000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads