toxiceye | 80f0a1615b3f308ddfee828e7c3af89fceaf2bef6b8c5e46d0cc3e1ad70fa5c0

General

Target

TelegramRAT.exe
Size

136KB
MD5

d6c713ccdb3f239da0c223cdb12d82d6
SHA1

e7c63a8ab0f369f2a6b2a1efeaa6a413bb0d2f1a
SHA256

80f0a1615b3f308ddfee828e7c3af89fceaf2bef6b8c5e46d0cc3e1ad70fa5c0
SHA512

c015e16c3fa6078964a6bf5112850e4e78581e0f16e3bd0b3a7927848f3f27545048ff8a494b78bfd70ca8313db903bd725f47b7927bec29938d309c4ef7d386
SSDEEP

3072:v3r1ZCgpMHg/kB625V+64emllImcKbZnQcQWXPCrAZuQcEeZcA/KY/:vZhpFkB62wlLbdXI

Score

10^/10

toxiceye discovery rat trojan

Malware Config

Extracted

Family

toxiceye

C2

https://api.telegram.org/bot7582691185:AAFMBoknnYf6nr-rXlzotfzCNnqEPGSYrqc/sendMessage?chat_id=8029727797

Signatures

Contains code to disable Windows Defender 2 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/5680-1-0x000001D36BBD0000-0x000001D36BBF8000-memory.dmp	disable_win_def
behavioral1/files/0x000a0000000241cc-9.dat	disable_win_def

ToxicEye
ToxicEye is a trojan written in C#.
rat trojan toxiceye
Toxiceye family
toxiceye

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation	TelegramRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation	total.exe

Executes dropped EXE 1 IoCs

pid	Process
5012	total.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
31	raw.githubusercontent.com

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
4812	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1408	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
408	schtasks.exe
2244	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
5012	total.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5680	TelegramRAT.exe
Token: SeDebugPrivilege	4812	tasklist.exe
Token: SeDebugPrivilege	5012	total.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5012	total.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 5680 wrote to memory of 408	5680	TelegramRAT.exe	93
PID 5680 wrote to memory of 408	5680	TelegramRAT.exe	93
PID 5680 wrote to memory of 4780	5680	TelegramRAT.exe	96
PID 5680 wrote to memory of 4780	5680	TelegramRAT.exe	96
PID 4780 wrote to memory of 4812	4780	cmd.exe	98
PID 4780 wrote to memory of 4812	4780	cmd.exe	98
PID 4780 wrote to memory of 4820	4780	cmd.exe	99
PID 4780 wrote to memory of 4820	4780	cmd.exe	99
PID 4780 wrote to memory of 1408	4780	cmd.exe	101
PID 4780 wrote to memory of 1408	4780	cmd.exe	101
PID 4780 wrote to memory of 5012	4780	cmd.exe	102
PID 4780 wrote to memory of 5012	4780	cmd.exe	102
PID 5012 wrote to memory of 2244	5012	total.exe	107
PID 5012 wrote to memory of 2244	5012	total.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe
"C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5680
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "discord" /tr "C:\Users\virustotal\total.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:408
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp7BA8.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp7BA8.tmp.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 5680"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4812
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:4820
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1408
- - C:\Users\virustotal\total.exe
    "total.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5012
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "discord" /tr "C:\Users\virustotal\total.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7BA8.tmp.bat

Filesize
192B

MD5
1482837044ff34ce95fae39516586c2e

SHA1
096e465a118eb86895700d15627ebea4b160c470

SHA256
da1c25abb746c4f51901a13c6cf1ee1da5b87716359980b4133cc4c53856ec5d

SHA512
21d81dfbb0b1f71e5807b534d09515bb22d8bc67de0e1e1a2644ef09bc4ee5a310a6f084ac443691a22341b78aa204477be0570a5de4253ac965bf2af3114b1c

Download Submit
C:\Users\virustotal\total.exe

Filesize
136KB

MD5
d6c713ccdb3f239da0c223cdb12d82d6

SHA1
e7c63a8ab0f369f2a6b2a1efeaa6a413bb0d2f1a

SHA256
80f0a1615b3f308ddfee828e7c3af89fceaf2bef6b8c5e46d0cc3e1ad70fa5c0

SHA512
c015e16c3fa6078964a6bf5112850e4e78581e0f16e3bd0b3a7927848f3f27545048ff8a494b78bfd70ca8313db903bd725f47b7927bec29938d309c4ef7d386

Download Submit
memory/5012-12-0x00000206EBA60000-0x00000206EBA6A000-memory.dmp

Filesize
40KB

Download
memory/5680-0-0x00007FF982493000-0x00007FF982495000-memory.dmp

Filesize
8KB

Download
memory/5680-1-0x000001D36BBD0000-0x000001D36BBF8000-memory.dmp

Filesize
160KB

Download
memory/5680-2-0x00007FF982490000-0x00007FF982F51000-memory.dmp

Filesize
10.8MB

Download
memory/5680-6-0x00007FF982490000-0x00007FF982F51000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads