toxiceye | hxxps://gofile[.]io/d/Pi29X3

Reason

Machine shutdown

General

Target

https://gofile.io/d/Pi29X3

Score

10^/10

toxiceye discovery rat trojan

Malware Config

Extracted

Family

toxiceye

C2

https://api.telegram.org/bot7742822790:AAHkizf3bilCkIqp8NNVcbWObKSVKo8Xifo/sendMessage?chat_id=7053620590

Signatures

ToxicEye
ToxicEye is a trojan written in C#.
rat trojan toxiceye
Toxiceye family
toxiceye

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
2572	tasklist.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4956	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4504	schtasks.exe
4852	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gofile.io/d/Pi29X3
1⤵
PID:2224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --field-trial-handle=5544,i,11057550979060774106,2035785093901894313,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
1⤵
PID:4628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --field-trial-handle=5532,i,11057550979060774106,2035785093901894313,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:1
1⤵
PID:1756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations=is-enterprise-managed=no --field-trial-handle=5696,i,11057550979060774106,2035785093901894313,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:8
1⤵
PID:1092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations=is-enterprise-managed=no --field-trial-handle=5608,i,11057550979060774106,2035785093901894313,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8
1⤵
PID:4056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --field-trial-handle=6096,i,11057550979060774106,2035785093901894313,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:1
1⤵
PID:2512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --field-trial-handle=5068,i,11057550979060774106,2035785093901894313,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:1
1⤵
PID:2308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --string-annotations=is-enterprise-managed=no --field-trial-handle=6152,i,11057550979060774106,2035785093901894313,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:8
1⤵
PID:4144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --field-trial-handle=5620,i,11057550979060774106,2035785093901894313,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:1
1⤵
PID:3692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=6872,i,11057550979060774106,2035785093901894313,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:8
1⤵
PID:3976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --string-annotations=is-enterprise-managed=no --field-trial-handle=7072,i,11057550979060774106,2035785093901894313,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:8
1⤵
PID:2008

C:\Users\Admin\Downloads\TelegramRAT.exe
"C:\Users\Admin\Downloads\TelegramRAT.exe"
1⤵
PID:2040

C:\Users\Admin\Downloads\TelegramRAT.exe
"C:\Users\Admin\Downloads\TelegramRAT.exe"
1⤵
PID:1560
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4504
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp83E1.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp83E1.tmp.bat
  2⤵
  PID:1940
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 1560"
    3⤵
    - Enumerates processes with tasklist
    PID:2572
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:332
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4956
- - C:\Users\ToxicEye\rat.exe
    "rat.exe"
    3⤵
    PID:1780
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\TelegramRAT.exe.log

Filesize
660B

MD5
631aa7b352bb697733b86bf28738ccca

SHA1
08ecaf07c7f1219401c3c3b13754579ac1f19797

SHA256
3e004976bae302cf7c53f5d15b5175eecb851bd4eb49a9b9365f716a6ee27523

SHA512
2b456313b5d85160f96abfb4d4190c629063842bd48afbd1c9f87cc0978b2f9e758d4922c977418221a2df361fd0687975ad0c7a1c1367d8ae813c153cd98747

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp83E1.tmp.bat

Filesize
188B

MD5
da69f1489fd173a88bca2d39a2354495

SHA1
0b6ef75b05c18d36d507e785f0bf049aaeda1066

SHA256
67a204465c5becbfa8ebacef1e008465bcc1d6778d713f90ebb12411b6ce78be

SHA512
3867e2832a829d0665268357b9441be0ed9faee61c6cdbc4efd6fb943ebf0829afa1559d8def1151d389b02d4949fc55768b2c3b5c7ed32270ebd0c61880215d

Download Submit
C:\Users\ToxicEye\rat.exe

Filesize
111KB

MD5
43b7c93356db3b366d065d484d12cf0d

SHA1
cbefe3ef152e12104c16cedc1de739086b37494d

SHA256
aff7268f7d07ff44b8e5c331bf9b95db52c66b8490b7f9d8d5c2440b1f161801

SHA512
b63d5a168d10bd0523c14d758127250e0208c3a0f95e4596224e3f5976016129d3203dbdda6b6c4a1f6678cb04fb27bc833c0efd1436b1ae1e7e2dfa203d4563

Download Submit
memory/1560-3-0x00007FFD136A0000-0x00007FFD14162000-memory.dmp

Filesize
10.8MB

Download
memory/1560-6-0x00007FFD136A0000-0x00007FFD14162000-memory.dmp

Filesize
10.8MB

Download
memory/2040-0-0x00007FFD136A3000-0x00007FFD136A5000-memory.dmp

Filesize
8KB

Download
memory/2040-1-0x0000017F462D0000-0x0000017F462F2000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads