Malware Analysis Report

2024-08-06 12:02

Sample ID 240302-bqc7jsgd87
Target file.exe
SHA256 d56b2acb792a0e9e636c40190064525352293bbabd04d31a89978c0c167f50aa
Tags
toxiceye rat trojan spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d56b2acb792a0e9e636c40190064525352293bbabd04d31a89978c0c167f50aa

Threat Level: Known bad

The file file.exe was found to be: Known bad.

Malicious Activity Summary

toxiceye rat trojan spyware stealer

ToxicEye

Contains code to disable Windows Defender

Downloads MZ/PE file

Executes dropped EXE

Reads user/profile data of web browsers

Checks computer location settings

Loads dropped DLL

Legitimate hosting services abused for malware hosting/C2

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Enumerates processes with tasklist

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Delays execution with timeout.exe

Uses Task Scheduler COM API

Creates scheduled task(s)

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Scheduled Task/Job
T1053
Persistence
TA0003
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
System Information Discovery
T1082
Process Discovery
T1057
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Web Service
T1102
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-03-02 01:20

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-02 01:20

Reported

2024-03-02 01:23

Platform

win7-20240221-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\file.exe"

Signatures

Contains code to disable Windows Defender

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

ToxicEye

rat trojan toxiceye

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A
N/A N/A C:\Windows\System32\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Users\CyberEye\rat.exe N/A
Token: SeDebugPrivilege N/A C:\Users\CyberEye\rat.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\CyberEye\rat.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2848 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe
PID 2848 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe
PID 2848 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe
PID 2848 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe
PID 2916 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe C:\Windows\System32\schtasks.exe
PID 2916 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe C:\Windows\System32\schtasks.exe
PID 2916 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe C:\Windows\System32\schtasks.exe
PID 2916 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe C:\Windows\System32\cmd.exe
PID 2916 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe C:\Windows\System32\cmd.exe
PID 2916 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe C:\Windows\System32\cmd.exe
PID 2644 wrote to memory of 2392 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2644 wrote to memory of 2392 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2644 wrote to memory of 2392 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2644 wrote to memory of 2400 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\find.exe
PID 2644 wrote to memory of 2400 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\find.exe
PID 2644 wrote to memory of 2400 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\find.exe
PID 2644 wrote to memory of 2468 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\timeout.exe
PID 2644 wrote to memory of 2468 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\timeout.exe
PID 2644 wrote to memory of 2468 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\timeout.exe
PID 2644 wrote to memory of 3016 N/A C:\Windows\System32\cmd.exe C:\Users\CyberEye\rat.exe
PID 2644 wrote to memory of 3016 N/A C:\Windows\System32\cmd.exe C:\Users\CyberEye\rat.exe
PID 2644 wrote to memory of 3016 N/A C:\Windows\System32\cmd.exe C:\Users\CyberEye\rat.exe
PID 3016 wrote to memory of 2436 N/A C:\Users\CyberEye\rat.exe C:\Windows\System32\schtasks.exe
PID 3016 wrote to memory of 2436 N/A C:\Users\CyberEye\rat.exe C:\Windows\System32\schtasks.exe
PID 3016 wrote to memory of 2436 N/A C:\Users\CyberEye\rat.exe C:\Windows\System32\schtasks.exe
PID 3016 wrote to memory of 2320 N/A C:\Users\CyberEye\rat.exe C:\Windows\system32\WerFault.exe
PID 3016 wrote to memory of 2320 N/A C:\Users\CyberEye\rat.exe C:\Windows\system32\WerFault.exe
PID 3016 wrote to memory of 2320 N/A C:\Users\CyberEye\rat.exe C:\Windows\system32\WerFault.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe

"C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe"

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\CyberEye\rat.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp1AE0.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp1AE0.tmp.bat

C:\Windows\system32\tasklist.exe

Tasklist /fi "PID eq 2916"

C:\Windows\system32\find.exe

find ":"

C:\Windows\system32\timeout.exe

Timeout /T 1 /Nobreak

C:\Users\CyberEye\rat.exe

"rat.exe"

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\CyberEye\rat.exe"

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 3016 -s 1528

Network

Country Destination Domain Proto
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp

Files

C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe

MD5 74f22ec8451a5d788ee312e2b637519c
SHA1 a7bd09f6f3d7f9b3ec33b5d4c2787223459d1fc0
SHA256 48614dc3fd49968db9c35b840a6609f397f2f1813daa7c56b659036edf82f2e2
SHA512 5b356e4811c58bcede2c3a5a0614e40049ef2a68c63c76fa78f612441d1ca9e1200f7a0544ffbca66ab4e0668fd0ec196bf0cdbff60ff7097c5f476b1675492b

memory/2916-6-0x00000000009E0000-0x0000000000A0A000-memory.dmp

memory/2916-7-0x000007FEF5490000-0x000007FEF5E7C000-memory.dmp

memory/2916-8-0x0000000000400000-0x0000000000480000-memory.dmp

memory/2916-11-0x000007FEF5490000-0x000007FEF5E7C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp1AE0.tmp.bat

MD5 b3a15bc872565551120ae56caf11e5af
SHA1 35146d564e110100f9723d12556cae0f9500b56f
SHA256 ee03b9b978da32de4680bade01df986c89323cf2d5da2bd7e6707c068690ecf3
SHA512 68806ce96c447ecbcd8268135137ce47d38e49a7e1bc9e77e31ecafbeb59e2d8e19ddbc0b41440e4ddb9fd022a15e206de35c4dcc19894c007883e8ef7761a0d

memory/3016-16-0x0000000000F20000-0x0000000000F4A000-memory.dmp

memory/3016-17-0x000007FEF4AA0000-0x000007FEF548C000-memory.dmp

memory/3016-18-0x000000001AD10000-0x000000001AD90000-memory.dmp

memory/3016-19-0x000007FEF4AA0000-0x000007FEF548C000-memory.dmp

memory/3016-20-0x000000001AD10000-0x000000001AD90000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-02 01:20

Reported

2024-03-02 01:23

Platform

win10v2004-20240226-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\file.exe"

Signatures

Contains code to disable Windows Defender

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

ToxicEye

rat trojan toxiceye

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation C:\Users\CyberEye\rat.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A

Reads user/profile data of web browsers

spyware stealer

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A
N/A N/A C:\Windows\System32\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A
N/A N/A C:\Users\CyberEye\rat.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Users\CyberEye\rat.exe N/A
Token: SeDebugPrivilege N/A C:\Users\CyberEye\rat.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\CyberEye\rat.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1376 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe
PID 1376 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe
PID 5008 wrote to memory of 4504 N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe C:\Windows\System32\schtasks.exe
PID 5008 wrote to memory of 4504 N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe C:\Windows\System32\schtasks.exe
PID 5008 wrote to memory of 4584 N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe C:\Windows\System32\cmd.exe
PID 5008 wrote to memory of 4584 N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe C:\Windows\System32\cmd.exe
PID 4584 wrote to memory of 1952 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4584 wrote to memory of 1952 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4584 wrote to memory of 3684 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\find.exe
PID 4584 wrote to memory of 3684 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\find.exe
PID 4584 wrote to memory of 4676 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\timeout.exe
PID 4584 wrote to memory of 4676 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\timeout.exe
PID 4584 wrote to memory of 1188 N/A C:\Windows\System32\cmd.exe C:\Users\CyberEye\rat.exe
PID 4584 wrote to memory of 1188 N/A C:\Windows\System32\cmd.exe C:\Users\CyberEye\rat.exe
PID 1188 wrote to memory of 4560 N/A C:\Users\CyberEye\rat.exe C:\Windows\System32\schtasks.exe
PID 1188 wrote to memory of 4560 N/A C:\Users\CyberEye\rat.exe C:\Windows\System32\schtasks.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe

"C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe"

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\CyberEye\rat.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp5767.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp5767.tmp.bat

C:\Windows\system32\tasklist.exe

Tasklist /fi "PID eq 5008"

C:\Windows\system32\find.exe

find ":"

C:\Windows\system32\timeout.exe

Timeout /T 1 /Nobreak

C:\Users\CyberEye\rat.exe

"rat.exe"

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\CyberEye\rat.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 185.199.111.133:443 raw.githubusercontent.com tcp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 133.111.199.185.in-addr.arpa udp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe

MD5 74f22ec8451a5d788ee312e2b637519c
SHA1 a7bd09f6f3d7f9b3ec33b5d4c2787223459d1fc0
SHA256 48614dc3fd49968db9c35b840a6609f397f2f1813daa7c56b659036edf82f2e2
SHA512 5b356e4811c58bcede2c3a5a0614e40049ef2a68c63c76fa78f612441d1ca9e1200f7a0544ffbca66ab4e0668fd0ec196bf0cdbff60ff7097c5f476b1675492b

memory/5008-11-0x000002C22F9C0000-0x000002C22F9EA000-memory.dmp

memory/5008-12-0x00007FFA4D5C0000-0x00007FFA4E081000-memory.dmp

memory/5008-13-0x000002C24A130000-0x000002C24A140000-memory.dmp

memory/5008-17-0x00007FFA4D5C0000-0x00007FFA4E081000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp5767.tmp.bat

MD5 6a93845937599f23fa5c02fcfce7e327
SHA1 e9e0111aa4fb1243e0bd930623a4e8d027690004
SHA256 10bbefcb0365ebd2704177894f0c0ab3b68e4a348e981a435a77e5fc7bb7b2c2
SHA512 a0d6afed6eee0361e98c3ef86b2a2fe14fbef349d9d26150f28a40379993bdc77d5cc9ae171b313b45b2cb42d2d3a65c3ab930cdeb6d535b760ba8b70d03e93a

memory/1188-22-0x00007FFA4CF60000-0x00007FFA4DA21000-memory.dmp

memory/1188-23-0x000002372FA60000-0x000002372FA70000-memory.dmp

memory/1188-25-0x0000023749FF0000-0x0000023749FFA000-memory.dmp

memory/1188-27-0x000002374A220000-0x000002374A232000-memory.dmp

memory/1188-53-0x00007FFA4CF60000-0x00007FFA4DA21000-memory.dmp

memory/1188-54-0x000002372FA60000-0x000002372FA70000-memory.dmp