toxiceye | 6e644b385d296b76bb3ba68ff006d6b86de763c8b5792e07053e20e3d8218d75

Analysis

max time kernel
113s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-01-2025 18:34

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

TelegramRAT.exe
Size

111KB
MD5

e3d580a17a351366392ec9e2af674524
SHA1

354e8f441c2fa510e1b3ecab222280649a7efb9a
SHA256

6e644b385d296b76bb3ba68ff006d6b86de763c8b5792e07053e20e3d8218d75
SHA512

a7e2726a2b28a39f6624f419ab9194b4c8e3d4c117e324c2719b3f944c5262cbc064df8989d34b984d8541767327d18381adf6678e4445dc8a49afe0a0824309
SSDEEP

1536:dn+bAQACiEXM91qQIwvL9x1Cc0Di4OybhDqI64QW6zCrAZuQPEDrL:sbaCHXELrJp6bxqH4QW6zCrAZuQwv

Score

10^/10

toxiceye discovery rat trojan

Malware Config

Signatures

ToxicEye
ToxicEye is a trojan written in C#.
rat trojan toxiceye
Toxiceye family
toxiceye
Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	TelegramRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	rat.exe

Executes dropped EXE 2 IoCs

pid	Process
1000	rat.exe
3020	CommandCam.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
43	raw.githubusercontent.com
42	raw.githubusercontent.com

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
4520	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CommandCam.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1704	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1924	schtasks.exe
388	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1000	rat.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe
1000	rat.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2772	TelegramRAT.exe
Token: SeDebugPrivilege	4520	tasklist.exe
Token: SeDebugPrivilege	1000	rat.exe
Token: SeDebugPrivilege	1000	rat.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1000	rat.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 1924	2772	TelegramRAT.exe	84
PID 2772 wrote to memory of 1924	2772	TelegramRAT.exe	84
PID 2772 wrote to memory of 3620	2772	TelegramRAT.exe	86
PID 2772 wrote to memory of 3620	2772	TelegramRAT.exe	86
PID 3620 wrote to memory of 4520	3620	cmd.exe	88
PID 3620 wrote to memory of 4520	3620	cmd.exe	88
PID 3620 wrote to memory of 4232	3620	cmd.exe	89
PID 3620 wrote to memory of 4232	3620	cmd.exe	89
PID 3620 wrote to memory of 1704	3620	cmd.exe	90
PID 3620 wrote to memory of 1704	3620	cmd.exe	90
PID 3620 wrote to memory of 1000	3620	cmd.exe	93
PID 3620 wrote to memory of 1000	3620	cmd.exe	93
PID 1000 wrote to memory of 388	1000	rat.exe	96
PID 1000 wrote to memory of 388	1000	rat.exe	96
PID 1000 wrote to memory of 3020	1000	rat.exe	103
PID 1000 wrote to memory of 3020	1000	rat.exe	103
PID 1000 wrote to memory of 3020	1000	rat.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe
"C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1924
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpC3DC.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpC3DC.tmp.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3620
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2772"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4520
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:4232
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1704
- - C:\Users\ToxicEye\rat.exe
    "rat.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1000
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:388
  - - C:\Users\Admin\AppData\Local\Temp\CommandCam.exe
      "C:\Users\Admin\AppData\Local\Temp\CommandCam.exe" /filename "webcam.png" /delay 4500 /devnum 1
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CommandCam.exe

Filesize
63KB

MD5
1009e5b3884fffc9926a2e97ccdf8408

SHA1
15ef775adbddd1f9515860f322fcfdb1f81fbb49

SHA256
e4e7f08d9a9a662b5615e8fcbb6cd3c711ecab6341a60562bbeff9ccca43f7e0

SHA512
3a8b777ccca6f29c8bc350711f594e1951afdbce8eb78786d2b3d85f940051635c05ec414768eef956076e41f1e53195f4d6fc20941428f525fc7cbbecc67891

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC3DC.tmp.bat

Filesize
188B

MD5
285412ab69bdedcac9615d5a3ecc6b58

SHA1
3244441f4fb5706a29b88a63953f0af9f44d5b2e

SHA256
d033581b26e577c81ad2c96d3b01e9c750b78e9e8301bd319a72f1a101e32caf

SHA512
e503559ec9ac7e5b9c9f0e07a052fd65d850351265036905b4202486c39ef82fa74ce1061bea53105c1d842f2cdaa467eade8ad2394d72504ff11a6653fc1678

Download Submit
C:\Users\ToxicEye\rat.exe

Filesize
111KB

MD5
e3d580a17a351366392ec9e2af674524

SHA1
354e8f441c2fa510e1b3ecab222280649a7efb9a

SHA256
6e644b385d296b76bb3ba68ff006d6b86de763c8b5792e07053e20e3d8218d75

SHA512
a7e2726a2b28a39f6624f419ab9194b4c8e3d4c117e324c2719b3f944c5262cbc064df8989d34b984d8541767327d18381adf6678e4445dc8a49afe0a0824309

Download Submit
memory/1000-11-0x000002A11C240000-0x000002A11C2EA000-memory.dmp

Filesize
680KB

Download
memory/1000-12-0x000002A11C2F0000-0x000002A11C366000-memory.dmp

Filesize
472KB

Download
memory/1000-23-0x000002A11BD00000-0x000002A11BD0A000-memory.dmp

Filesize
40KB

Download
memory/2772-0-0x00007FFCCA253000-0x00007FFCCA255000-memory.dmp

Filesize
8KB

Download
memory/2772-1-0x000001EB28150000-0x000001EB28172000-memory.dmp

Filesize
136KB

Download
memory/2772-2-0x00007FFCCA250000-0x00007FFCCAD11000-memory.dmp

Filesize
10.8MB

Download
memory/2772-6-0x00007FFCCA250000-0x00007FFCCAD11000-memory.dmp

Filesize
10.8MB

Download
memory/3020-21-0x00000000745E0000-0x0000000074619000-memory.dmp

Filesize
228KB

Download
memory/3020-22-0x00000000745E0000-0x0000000074619000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads