Malware Analysis Report

2024-08-06 12:00

Sample ID 240302-ecfbjaab96
Target TelegramRAT.exe
SHA256 872d241e41e2b657746d8d66b3bce7377790d9793d987929482f088f960c8591
Tags
toxiceye rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

872d241e41e2b657746d8d66b3bce7377790d9793d987929482f088f960c8591

Threat Level: Known bad

The file TelegramRAT.exe was found to be: Known bad.

Malicious Activity Summary

toxiceye rat trojan

ToxicEye

Toxiceye family

Executes dropped EXE

Deletes itself

Checks computer location settings

Legitimate hosting services abused for malware hosting/C2

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Enumerates processes with tasklist

Creates scheduled task(s)

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Scheduled Task/Job
T1053
Persistence
TA0003
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Process Discovery
T1057
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Web Service
T1102
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-03-02 03:47

Signatures

Toxiceye family

toxiceye

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-02 03:47

Reported

2024-03-02 03:50

Platform

win7-20240221-en

Max time kernel

117s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe"

Signatures

ToxicEye

rat trojan toxiceye

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\System32\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\a\rat.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A
N/A N/A C:\Windows\System32\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\a\rat.exe N/A
Token: SeDebugPrivilege N/A C:\a\rat.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\a\rat.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2368 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe C:\Windows\System32\schtasks.exe
PID 2368 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe C:\Windows\System32\schtasks.exe
PID 2368 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe C:\Windows\System32\schtasks.exe
PID 2368 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe C:\Windows\System32\cmd.exe
PID 2368 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe C:\Windows\System32\cmd.exe
PID 2368 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe C:\Windows\System32\cmd.exe
PID 2456 wrote to memory of 2836 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2456 wrote to memory of 2836 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2456 wrote to memory of 2836 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2456 wrote to memory of 2476 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\find.exe
PID 2456 wrote to memory of 2476 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\find.exe
PID 2456 wrote to memory of 2476 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\find.exe
PID 2456 wrote to memory of 2504 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\timeout.exe
PID 2456 wrote to memory of 2504 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\timeout.exe
PID 2456 wrote to memory of 2504 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\timeout.exe
PID 2456 wrote to memory of 1212 N/A C:\Windows\System32\cmd.exe C:\a\rat.exe
PID 2456 wrote to memory of 1212 N/A C:\Windows\System32\cmd.exe C:\a\rat.exe
PID 2456 wrote to memory of 1212 N/A C:\Windows\System32\cmd.exe C:\a\rat.exe
PID 1212 wrote to memory of 948 N/A C:\a\rat.exe C:\Windows\System32\schtasks.exe
PID 1212 wrote to memory of 948 N/A C:\a\rat.exe C:\Windows\System32\schtasks.exe
PID 1212 wrote to memory of 948 N/A C:\a\rat.exe C:\Windows\System32\schtasks.exe
PID 1212 wrote to memory of 528 N/A C:\a\rat.exe C:\Windows\system32\WerFault.exe
PID 1212 wrote to memory of 528 N/A C:\a\rat.exe C:\Windows\system32\WerFault.exe
PID 1212 wrote to memory of 528 N/A C:\a\rat.exe C:\Windows\system32\WerFault.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe

"C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe"

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\a\rat.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp4EFA.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp4EFA.tmp.bat

C:\Windows\system32\tasklist.exe

Tasklist /fi "PID eq 2368"

C:\Windows\system32\find.exe

find ":"

C:\Windows\system32\timeout.exe

Timeout /T 1 /Nobreak

C:\a\rat.exe

"rat.exe"

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\a\rat.exe"

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 1212 -s 1568

Network

Country Destination Domain Proto
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 api.Telegram.org udp
NL 149.154.167.220:443 api.Telegram.org tcp
NL 149.154.167.220:443 api.Telegram.org tcp

Files

memory/2368-0-0x0000000001390000-0x00000000013BA000-memory.dmp

memory/2368-1-0x000007FEF6210000-0x000007FEF6BFC000-memory.dmp

memory/2368-2-0x000000001AFE0000-0x000000001B060000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp4EFA.tmp.bat

MD5 d5b9d918d4eea15d4269d712755493a9
SHA1 df3a28bf5c0533161e944ac8ee6665101960bb5c
SHA256 6ae3e6cc9b3bccdef1fe47e3829d2ee0aee4daf82aa69335ef61572bc9d0b6fa
SHA512 031be5c54d39c37569da2ddc63e7615c6bb8f651efa5c71e8c548f59bd53dae6e0db2545748abf665d384bb4aee36be8a9cd19e47189e41cf983bce10d699bc7

memory/2368-6-0x000007FEF6210000-0x000007FEF6BFC000-memory.dmp

C:\a\rat.exe

MD5 2e421076fded17a6c3643d2d65b6d344
SHA1 8c2d9e0e6b16ab6ddeaacf661f5bf7b472911dd5
SHA256 872d241e41e2b657746d8d66b3bce7377790d9793d987929482f088f960c8591
SHA512 1f275c68f898d96cb34ac2027016ee78b0ac2211dc5003ba94c07ea93a66eecd1935c3a14b6b16826447d3beb93f1162499d3fe69fdc49b06c8fd1647812601d

memory/1212-10-0x0000000001010000-0x000000000103A000-memory.dmp

memory/1212-11-0x000007FEF5820000-0x000007FEF620C000-memory.dmp

memory/1212-12-0x000007FEF5820000-0x000007FEF620C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-02 03:47

Reported

2024-03-02 03:50

Platform

win10v2004-20240226-en

Max time kernel

143s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe"

Signatures

ToxicEye

rat trojan toxiceye

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\a\rat.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\a\rat.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A
N/A N/A C:\Windows\System32\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\a\rat.exe N/A
Token: SeDebugPrivilege N/A C:\a\rat.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\a\rat.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4032 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe C:\Windows\System32\schtasks.exe
PID 4032 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe C:\Windows\System32\schtasks.exe
PID 4032 wrote to memory of 3400 N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe C:\Windows\System32\cmd.exe
PID 4032 wrote to memory of 3400 N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe C:\Windows\System32\cmd.exe
PID 3400 wrote to memory of 3688 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\tasklist.exe
PID 3400 wrote to memory of 3688 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\tasklist.exe
PID 3400 wrote to memory of 3176 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\find.exe
PID 3400 wrote to memory of 3176 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\find.exe
PID 3400 wrote to memory of 4220 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\timeout.exe
PID 3400 wrote to memory of 4220 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\timeout.exe
PID 3400 wrote to memory of 3568 N/A C:\Windows\System32\cmd.exe C:\a\rat.exe
PID 3400 wrote to memory of 3568 N/A C:\Windows\System32\cmd.exe C:\a\rat.exe
PID 3568 wrote to memory of 1796 N/A C:\a\rat.exe C:\Windows\System32\schtasks.exe
PID 3568 wrote to memory of 1796 N/A C:\a\rat.exe C:\Windows\System32\schtasks.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe

"C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe"

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\a\rat.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpE81E.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpE81E.tmp.bat

C:\Windows\system32\tasklist.exe

Tasklist /fi "PID eq 4032"

C:\Windows\system32\find.exe

find ":"

C:\Windows\system32\timeout.exe

Timeout /T 1 /Nobreak

C:\a\rat.exe

"rat.exe"

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\a\rat.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3844 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 api.Telegram.org udp
NL 149.154.167.220:443 api.Telegram.org tcp
NL 149.154.167.220:443 api.Telegram.org tcp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 133.110.199.185.in-addr.arpa udp
US 8.8.8.8:53 www.microsoft.com udp
GB 92.123.241.137:80 www.microsoft.com tcp
GB 92.123.241.137:80 www.microsoft.com tcp
US 8.8.8.8:53 137.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 170.117.168.52.in-addr.arpa udp

Files

memory/4032-0-0x000002618B1D0000-0x000002618B1FA000-memory.dmp

memory/4032-1-0x00007FFEABB00000-0x00007FFEAC5C1000-memory.dmp

memory/4032-2-0x00000261A5610000-0x00000261A5620000-memory.dmp

memory/4032-6-0x00007FFEABB00000-0x00007FFEAC5C1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpE81E.tmp.bat

MD5 5fa6ce82c7f52aa7fbbc320e1d17b196
SHA1 a9329971cac9e20ff49c8479296b13885f20bf1f
SHA256 04ae9b0d1974e8bc61488df89c92bc731bcfa47e4cc6e7ec64cf22c0d78c0455
SHA512 837ffd4badc02d532a9adeecbd81bed517f7d2fc4026df5d23a0d104326377ff3e9c6a88781eadf7abd9bde7c3716996f03a4bab4b779a38446be1ac0b307085

C:\a\rat.exe

MD5 2e421076fded17a6c3643d2d65b6d344
SHA1 8c2d9e0e6b16ab6ddeaacf661f5bf7b472911dd5
SHA256 872d241e41e2b657746d8d66b3bce7377790d9793d987929482f088f960c8591
SHA512 1f275c68f898d96cb34ac2027016ee78b0ac2211dc5003ba94c07ea93a66eecd1935c3a14b6b16826447d3beb93f1162499d3fe69fdc49b06c8fd1647812601d

memory/3568-11-0x00007FFEAB9D0000-0x00007FFEAC491000-memory.dmp

memory/3568-12-0x0000025A43EF0000-0x0000025A43F00000-memory.dmp

memory/3568-14-0x0000025A5EE90000-0x0000025A5EE9A000-memory.dmp

memory/3568-16-0x0000025A5F1C0000-0x0000025A5F1D2000-memory.dmp

memory/3568-17-0x00007FFEAB9D0000-0x00007FFEAC491000-memory.dmp