Analysis

  • max time kernel
    13s
  • max time network
    14s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    08-01-2025 18:16

General

  • Target

    TelegramRAT.exe

  • Size

    111KB

  • MD5

    e3d580a17a351366392ec9e2af674524

  • SHA1

    354e8f441c2fa510e1b3ecab222280649a7efb9a

  • SHA256

    6e644b385d296b76bb3ba68ff006d6b86de763c8b5792e07053e20e3d8218d75

  • SHA512

    a7e2726a2b28a39f6624f419ab9194b4c8e3d4c117e324c2719b3f944c5262cbc064df8989d34b984d8541767327d18381adf6678e4445dc8a49afe0a0824309

  • SSDEEP

    1536:dn+bAQACiEXM91qQIwvL9x1Cc0Di4OybhDqI64QW6zCrAZuQPEDrL:sbaCHXELrJp6bxqH4QW6zCrAZuQwv

Malware Config

Signatures

  • ToxicEye

    ToxicEye is a trojan written in C#.

  • Toxiceye family
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe
    "C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1688
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2964
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpD910.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpD910.tmp.bat
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:584
      • C:\Windows\system32\tasklist.exe
        Tasklist /fi "PID eq 1688"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:2880
      • C:\Windows\system32\find.exe
        find ":"
        3⤵
          PID:2884
        • C:\Windows\system32\timeout.exe
          Timeout /T 1 /Nobreak
          3⤵
          • Delays execution with timeout.exe
          PID:2832
        • C:\Windows\system32\tasklist.exe
          Tasklist /fi "PID eq 1688"
          3⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:2824
        • C:\Windows\system32\find.exe
          find ":"
          3⤵
            PID:2784
          • C:\Windows\system32\timeout.exe
            Timeout /T 1 /Nobreak
            3⤵
            • Delays execution with timeout.exe
            PID:3052
          • C:\Users\ToxicEye\rat.exe
            "rat.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3000
            • C:\Windows\System32\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"
              4⤵
              • Scheduled Task/Job: Scheduled Task
              PID:2316
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 3000 -s 1732
              4⤵
                PID:2664

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\tmpD910.tmp.bat

          Filesize

          188B

          MD5

          2b8a6942c612d7c2283ac27270cde1a5

          SHA1

          2ccdf150ed9434fc4c3226cbc36b0f1e14af7396

          SHA256

          afc87e65832a1b67bd741f8eee35c551948fd20cfa5ca64dc7f1aaae051b91f7

          SHA512

          b25b4c5d2cad45c6ca8082dabef60ca9cec2d75914cc45928db0e2d2634059538d31fbc4329bbaba65c33e7475986389f05a70ff17b7d69f5ca2c7d5ca53d5fa

        • C:\Users\ToxicEye\rat.exe

          Filesize

          111KB

          MD5

          e3d580a17a351366392ec9e2af674524

          SHA1

          354e8f441c2fa510e1b3ecab222280649a7efb9a

          SHA256

          6e644b385d296b76bb3ba68ff006d6b86de763c8b5792e07053e20e3d8218d75

          SHA512

          a7e2726a2b28a39f6624f419ab9194b4c8e3d4c117e324c2719b3f944c5262cbc064df8989d34b984d8541767327d18381adf6678e4445dc8a49afe0a0824309

        • memory/1688-0-0x000007FEF5DD3000-0x000007FEF5DD4000-memory.dmp

          Filesize

          4KB

        • memory/1688-1-0x0000000000A90000-0x0000000000AB2000-memory.dmp

          Filesize

          136KB

        • memory/1688-2-0x000007FEF5DD0000-0x000007FEF67BC000-memory.dmp

          Filesize

          9.9MB

        • memory/1688-6-0x000007FEF5DD0000-0x000007FEF67BC000-memory.dmp

          Filesize

          9.9MB

        • memory/3000-10-0x0000000000DC0000-0x0000000000DE2000-memory.dmp

          Filesize

          136KB