toxiceye | 75f0b10428471619c2cb34bf7abdef10bb192f238ff09e67a8433ddc6c9e6b76

General

Target

75f0b10428471619c2cb34bf7abdef10bb192f238ff09e67a8433ddc6c9e6b76.exe
Size

2.7MB
MD5

e8750312901386f028ec2e7ba93acdd1
SHA1

8dabf23f1b0732eeae8f371005e392afa3787829
SHA256

75f0b10428471619c2cb34bf7abdef10bb192f238ff09e67a8433ddc6c9e6b76
SHA512

6664206165b2605817492a1dad5b47c9996166c3a9873f9a086d64c3ad87213e89567277c9b7760537efc2e67a5c2b5c4412169eb69f5a31d9f675b7088e429c
SSDEEP

49152:KOmkuWsQFMi4mKH3NmB6JqsG/a5lFHSqLbWKkHs1zfgRAZzgCNP+u+vR9hoU7Uvj:TmbW/MVmKHEB6c0lFHTbWLmbgRWUCh+M

Score

10^/10

toxiceye defense_evasion discovery rat spyware stealer trojan

Malware Config

Extracted

Family

toxiceye

C2

https://api.telegram.org/bot7203802626:AAE_9_dltxewBu7ddFljX_qb4SON6Zl9EzQ/sendMessage?chat_id=688494782

Signatures

ToxicEye
ToxicEye is a trojan written in C#.
rat trojan toxiceye
Toxiceye family
toxiceye

Downloads MZ/PE file 2 IoCs

flow	pid	Process
18	3692	rat.exe
19	3692	rat.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	75f0b10428471619c2cb34bf7abdef10bb192f238ff09e67a8433ddc6c9e6b76.exe

Executes dropped EXE 2 IoCs

pid	Process
3384	TelegramRATENIGMA.exe
3692	rat.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
17	raw.githubusercontent.com
18	raw.githubusercontent.com
19	raw.githubusercontent.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
4776	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs

pid	Process
3384	TelegramRATENIGMA.exe
3384	TelegramRATENIGMA.exe
3692	rat.exe
3692	rat.exe
3692	rat.exe
3692	rat.exe
3692	rat.exe
3692	rat.exe
3692	rat.exe
3692	rat.exe
3692	rat.exe
3692	rat.exe
3692	rat.exe
3692	rat.exe
3692	rat.exe
3692	rat.exe
3692	rat.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TelegramRATENIGMA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3016	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4668	schtasks.exe
2104	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3692	rat.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
1116	powershell.exe
1116	powershell.exe
3692	rat.exe
3692	rat.exe
3692	rat.exe
3692	rat.exe
3692	rat.exe
3692	rat.exe
3692	rat.exe
3692	rat.exe
3692	rat.exe
3692	rat.exe
3692	rat.exe
3692	rat.exe
3692	rat.exe
3692	rat.exe
3692	rat.exe
3692	rat.exe
3692	rat.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1116	powershell.exe
Token: SeDebugPrivilege	3384	TelegramRATENIGMA.exe
Token: SeDebugPrivilege	4776	tasklist.exe
Token: SeDebugPrivilege	3692	rat.exe
Token: SeDebugPrivilege	3692	rat.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3384	TelegramRATENIGMA.exe
3692	rat.exe
3692	rat.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 1116	4812	75f0b10428471619c2cb34bf7abdef10bb192f238ff09e67a8433ddc6c9e6b76.exe	83
PID 4812 wrote to memory of 1116	4812	75f0b10428471619c2cb34bf7abdef10bb192f238ff09e67a8433ddc6c9e6b76.exe	83
PID 4812 wrote to memory of 3384	4812	75f0b10428471619c2cb34bf7abdef10bb192f238ff09e67a8433ddc6c9e6b76.exe	85
PID 4812 wrote to memory of 3384	4812	75f0b10428471619c2cb34bf7abdef10bb192f238ff09e67a8433ddc6c9e6b76.exe	85
PID 4812 wrote to memory of 3384	4812	75f0b10428471619c2cb34bf7abdef10bb192f238ff09e67a8433ddc6c9e6b76.exe	85
PID 3384 wrote to memory of 4668	3384	TelegramRATENIGMA.exe	91
PID 3384 wrote to memory of 4668	3384	TelegramRATENIGMA.exe	91
PID 3384 wrote to memory of 4668	3384	TelegramRATENIGMA.exe	91
PID 3384 wrote to memory of 4544	3384	TelegramRATENIGMA.exe	93
PID 3384 wrote to memory of 4544	3384	TelegramRATENIGMA.exe	93
PID 3384 wrote to memory of 4544	3384	TelegramRATENIGMA.exe	93
PID 4544 wrote to memory of 4776	4544	cmd.exe	95
PID 4544 wrote to memory of 4776	4544	cmd.exe	95
PID 4544 wrote to memory of 4776	4544	cmd.exe	95
PID 4544 wrote to memory of 4432	4544	cmd.exe	96
PID 4544 wrote to memory of 4432	4544	cmd.exe	96
PID 4544 wrote to memory of 4432	4544	cmd.exe	96
PID 4544 wrote to memory of 3016	4544	cmd.exe	97
PID 4544 wrote to memory of 3016	4544	cmd.exe	97
PID 4544 wrote to memory of 3016	4544	cmd.exe	97
PID 4544 wrote to memory of 3692	4544	cmd.exe	98
PID 4544 wrote to memory of 3692	4544	cmd.exe	98
PID 4544 wrote to memory of 3692	4544	cmd.exe	98
PID 3692 wrote to memory of 2104	3692	rat.exe	100
PID 3692 wrote to memory of 2104	3692	rat.exe	100
PID 3692 wrote to memory of 2104	3692	rat.exe	100

C:\Users\Admin\AppData\Local\Temp\75f0b10428471619c2cb34bf7abdef10bb192f238ff09e67a8433ddc6c9e6b76.exe
"C:\Users\Admin\AppData\Local\Temp\75f0b10428471619c2cb34bf7abdef10bb192f238ff09e67a8433ddc6c9e6b76.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGsAegBkACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAZABkACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHgAbQBsACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHgAeABnACMAPgA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1116
- C:\Users\Admin\AppData\Local\Temp\TelegramRATENIGMA.exe
  "C:\Users\Admin\AppData\Local\Temp\TelegramRATENIGMA.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3384
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4668
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp9461.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp9461.tmp.bat
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4544
  - - C:\Windows\SysWOW64\tasklist.exe
      Tasklist /fi "PID eq 3384"
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4776
  - - C:\Windows\SysWOW64\find.exe
      find ":"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4432
  - - C:\Windows\SysWOW64\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:3016
  - - C:\Users\ToxicEye\rat.exe
      "rat.exe"
      4⤵
      Downloads MZ/PE file
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3692
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Obfuscated Files or Information

1

T1027

Command Obfuscation

1

T1027.010

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Browser Information Discovery

Process Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TelegramRATENIGMA.exe

Filesize
2.4MB

MD5
72355c8c61439593d4d5974df51801ff

SHA1
05b97fa2140225bffcd896cbb808344bf2cb57b4

SHA256
7728c7e4698fcbe0e77c033e956de69b727b2295d3c0cd95a37e2ae150d16dd0

SHA512
36274fe0c7a3933dcef852277a5fb69c7c0ee6a2c4086b19f550a8ef6976755f29c5becb12975db555ebd5e994a5e02b02b61b87e515c2afe55a58acb656d3ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x12yng02.wav.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9461.tmp.bat

Filesize
194B

MD5
9d7c6c31c8f4d016c84cad7c699eadde

SHA1
6f34b8abfb7af22e1d9b4385186641a16e9e3c20

SHA256
ac8e8d21a78b2897456f14da4f3937384088afdb79871f12a91a767898a1f184

SHA512
a1139417fdef8147760c950bbbd82b8841d8d37109294f79c4e75f964b09fb1ffdaf9ce20b87030f13db60ab0d834180b8060b14f6b4abf738a21c98b7fdc36b

Download Submit
memory/1116-24-0x00007FFB10BC0000-0x00007FFB11681000-memory.dmp

Filesize
10.8MB

Download
memory/1116-14-0x00007FFB10BC0000-0x00007FFB11681000-memory.dmp

Filesize
10.8MB

Download
memory/1116-25-0x00000156AB120000-0x00000156AB142000-memory.dmp

Filesize
136KB

Download
memory/1116-31-0x00007FFB10BC0000-0x00007FFB11681000-memory.dmp

Filesize
10.8MB

Download
memory/3384-41-0x0000000000010000-0x00000000009E2000-memory.dmp

Filesize
9.8MB

Download
memory/3384-35-0x0000000009300000-0x0000000009392000-memory.dmp

Filesize
584KB

Download
memory/3384-27-0x0000000000010000-0x00000000009E2000-memory.dmp

Filesize
9.8MB

Download
memory/3384-30-0x0000000000010000-0x00000000009E2000-memory.dmp

Filesize
9.8MB

Download
memory/3384-32-0x0000000000010000-0x00000000009E2000-memory.dmp

Filesize
9.8MB

Download
memory/3384-34-0x00000000098B0000-0x0000000009E54000-memory.dmp

Filesize
5.6MB

Download
memory/3384-36-0x000000000B2E0000-0x000000000B346000-memory.dmp

Filesize
408KB

Download
memory/3692-45-0x0000000000EB0000-0x0000000001882000-memory.dmp

Filesize
9.8MB

Download
memory/3692-79-0x0000000000EB0000-0x0000000001882000-memory.dmp

Filesize
9.8MB

Download
memory/3692-90-0x0000000000EB0000-0x0000000001882000-memory.dmp

Filesize
9.8MB

Download
memory/3692-89-0x0000000000EB0000-0x0000000001882000-memory.dmp

Filesize
9.8MB

Download
memory/3692-88-0x0000000000EB0000-0x0000000001882000-memory.dmp

Filesize
9.8MB

Download
memory/3692-47-0x0000000000EB0000-0x0000000001882000-memory.dmp

Filesize
9.8MB

Download
memory/3692-48-0x0000000000EB0000-0x0000000001882000-memory.dmp

Filesize
9.8MB

Download
memory/3692-49-0x000000001EC00000-0x000000001EC0A000-memory.dmp

Filesize
40KB

Download
memory/3692-52-0x0000000021690000-0x000000002169A000-memory.dmp

Filesize
40KB

Download
memory/3692-53-0x00000000259F0000-0x0000000025A02000-memory.dmp

Filesize
72KB

Download
memory/3692-77-0x0000000000EB0000-0x0000000001882000-memory.dmp

Filesize
9.8MB

Download
memory/3692-76-0x0000000000EB0000-0x0000000001882000-memory.dmp

Filesize
9.8MB

Download
memory/3692-78-0x0000000000EB0000-0x0000000001882000-memory.dmp

Filesize
9.8MB

Download
memory/3692-87-0x0000000000EB0000-0x0000000001882000-memory.dmp

Filesize
9.8MB

Download
memory/3692-80-0x0000000000EB0000-0x0000000001882000-memory.dmp

Filesize
9.8MB

Download
memory/3692-81-0x0000000000EB0000-0x0000000001882000-memory.dmp

Filesize
9.8MB

Download
memory/3692-82-0x0000000000EB0000-0x0000000001882000-memory.dmp

Filesize
9.8MB

Download
memory/3692-83-0x0000000000EB0000-0x0000000001882000-memory.dmp

Filesize
9.8MB

Download
memory/3692-84-0x0000000000EB0000-0x0000000001882000-memory.dmp

Filesize
9.8MB

Download
memory/3692-85-0x0000000000EB0000-0x0000000001882000-memory.dmp

Filesize
9.8MB

Download
memory/3692-86-0x0000000000EB0000-0x0000000001882000-memory.dmp

Filesize
9.8MB

Download
memory/4812-33-0x00007FFB10BC0000-0x00007FFB11681000-memory.dmp

Filesize
10.8MB

Download
memory/4812-0-0x00007FFB10BC3000-0x00007FFB10BC5000-memory.dmp

Filesize
8KB

Download
memory/4812-1-0x00000000008C0000-0x0000000000B78000-memory.dmp

Filesize
2.7MB

Download
memory/4812-2-0x00007FFB10BC0000-0x00007FFB11681000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads