Malware Analysis Report

2024-08-06 12:02

Sample ID 240302-edvgvaac49
Target TelegramRAT.exe
SHA256 d45b164e99aed8684a4d79685278fa764be83092f1f64d1b299eb93229831cf1
Tags
toxiceye rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d45b164e99aed8684a4d79685278fa764be83092f1f64d1b299eb93229831cf1

Threat Level: Known bad

The file TelegramRAT.exe was found to be: Known bad.

Malicious Activity Summary

toxiceye rat trojan

ToxicEye

Toxiceye family

Deletes itself

Executes dropped EXE

Checks computer location settings

Legitimate hosting services abused for malware hosting/C2

Unsigned PE

Enumerates physical storage devices

Enumerates processes with tasklist

Suspicious use of WriteProcessMemory

Opens file in notepad (likely ransom note)

Delays execution with timeout.exe

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

Suspicious use of SetWindowsHookEx

Uses Task Scheduler COM API

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Scheduled Task/Job
T1053
Persistence
TA0003
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Process Discovery
T1057
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Web Service
T1102
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-03-02 03:49

Signatures

Toxiceye family

toxiceye

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-02 03:49

Reported

2024-03-02 03:52

Platform

win7-20240221-en

Max time kernel

122s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe"

Signatures

ToxicEye

rat trojan toxiceye

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\System32\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\a\rat.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A
N/A N/A C:\Windows\System32\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\a\rat.exe N/A
Token: SeDebugPrivilege N/A C:\a\rat.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\a\rat.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1132 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe C:\Windows\System32\schtasks.exe
PID 1132 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe C:\Windows\System32\schtasks.exe
PID 1132 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe C:\Windows\System32\schtasks.exe
PID 1132 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe C:\Windows\System32\cmd.exe
PID 1132 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe C:\Windows\System32\cmd.exe
PID 1132 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe C:\Windows\System32\cmd.exe
PID 2600 wrote to memory of 2672 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2600 wrote to memory of 2672 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2600 wrote to memory of 2672 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2600 wrote to memory of 2560 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\find.exe
PID 2600 wrote to memory of 2560 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\find.exe
PID 2600 wrote to memory of 2560 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\find.exe
PID 2600 wrote to memory of 2776 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\timeout.exe
PID 2600 wrote to memory of 2776 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\timeout.exe
PID 2600 wrote to memory of 2776 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\timeout.exe
PID 2600 wrote to memory of 2496 N/A C:\Windows\System32\cmd.exe C:\a\rat.exe
PID 2600 wrote to memory of 2496 N/A C:\Windows\System32\cmd.exe C:\a\rat.exe
PID 2600 wrote to memory of 2496 N/A C:\Windows\System32\cmd.exe C:\a\rat.exe
PID 2496 wrote to memory of 1200 N/A C:\a\rat.exe C:\Windows\System32\schtasks.exe
PID 2496 wrote to memory of 1200 N/A C:\a\rat.exe C:\Windows\System32\schtasks.exe
PID 2496 wrote to memory of 1200 N/A C:\a\rat.exe C:\Windows\System32\schtasks.exe
PID 2496 wrote to memory of 2508 N/A C:\a\rat.exe C:\Windows\system32\WerFault.exe
PID 2496 wrote to memory of 2508 N/A C:\a\rat.exe C:\Windows\system32\WerFault.exe
PID 2496 wrote to memory of 2508 N/A C:\a\rat.exe C:\Windows\system32\WerFault.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe

"C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe"

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\a\rat.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp2AD8.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp2AD8.tmp.bat

C:\Windows\system32\tasklist.exe

Tasklist /fi "PID eq 1132"

C:\Windows\system32\find.exe

find ":"

C:\Windows\system32\timeout.exe

Timeout /T 1 /Nobreak

C:\a\rat.exe

"rat.exe"

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\a\rat.exe"

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2496 -s 1508

Network

Country Destination Domain Proto
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 api.Telegram.org udp
NL 149.154.167.220:443 api.Telegram.org tcp
NL 149.154.167.220:443 api.Telegram.org tcp

Files

memory/1132-0-0x0000000001230000-0x000000000125A000-memory.dmp

memory/1132-1-0x000007FEF5CE0000-0x000007FEF66CC000-memory.dmp

memory/1132-2-0x000000001AF70000-0x000000001AFF0000-memory.dmp

memory/1132-5-0x000007FEF5CE0000-0x000007FEF66CC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp2AD8.tmp.bat

MD5 8b6093d4c5d3361c39dcc6ca6ab57475
SHA1 f116b744e8b9e75d2ad7532c05f1c5358c38136a
SHA256 98182e51f07d07f990ceb13f96eec268a135c2a153802dfaad9f01559ebcacff
SHA512 528c965bfdbd41c027b13f69ecca10e641f113a321576f2e582e4b24a3682afd48f8a74a8f7678dc29ad38767a91126e70a26f77b0f1dd7494266203eeb6b8b1

C:\a\rat.exe

MD5 3748d676147a437e12c83372fb084b17
SHA1 d6d7fae8acf766850ebe20d4e32882b26eb7d71b
SHA256 d45b164e99aed8684a4d79685278fa764be83092f1f64d1b299eb93229831cf1
SHA512 d09daf64c757ec7138ebc512493fba48b357a98ddf16c4c9eebd4af82a6185894032f4e936d33e323066a715d29c13552e6533f5dc16eaf7fbf86f2fe0204423

memory/2496-10-0x0000000000800000-0x000000000082A000-memory.dmp

memory/2496-11-0x000007FEF52F0000-0x000007FEF5CDC000-memory.dmp

memory/2496-12-0x000000001ACC0000-0x000000001AD40000-memory.dmp

memory/2496-13-0x000007FEF52F0000-0x000007FEF5CDC000-memory.dmp

memory/2496-14-0x000000001ACC0000-0x000000001AD40000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-02 03:49

Reported

2024-03-02 03:52

Platform

win10v2004-20240226-en

Max time kernel

93s

Max time network

113s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe"

Signatures

ToxicEye

rat trojan toxiceye

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\a\rat.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\a\rat.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A
N/A N/A C:\Windows\System32\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\a\rat.exe N/A
Token: SeDebugPrivilege N/A C:\a\rat.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\a\rat.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1144 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe C:\Windows\System32\schtasks.exe
PID 1144 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe C:\Windows\System32\schtasks.exe
PID 1144 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe C:\Windows\System32\cmd.exe
PID 1144 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe C:\Windows\System32\cmd.exe
PID 1580 wrote to memory of 1876 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1580 wrote to memory of 1876 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1580 wrote to memory of 1612 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\find.exe
PID 1580 wrote to memory of 1612 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\find.exe
PID 1580 wrote to memory of 1196 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\timeout.exe
PID 1580 wrote to memory of 1196 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\timeout.exe
PID 1580 wrote to memory of 3304 N/A C:\Windows\System32\cmd.exe C:\a\rat.exe
PID 1580 wrote to memory of 3304 N/A C:\Windows\System32\cmd.exe C:\a\rat.exe
PID 3304 wrote to memory of 1924 N/A C:\a\rat.exe C:\Windows\System32\schtasks.exe
PID 3304 wrote to memory of 1924 N/A C:\a\rat.exe C:\Windows\System32\schtasks.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe

"C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe"

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\a\rat.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp3C7C.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp3C7C.tmp.bat

C:\Windows\system32\tasklist.exe

Tasklist /fi "PID eq 1144"

C:\Windows\system32\find.exe

find ":"

C:\Windows\system32\timeout.exe

Timeout /T 1 /Nobreak

C:\a\rat.exe

"rat.exe"

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\a\rat.exe"

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\a\bookmarks.txt

Network

Country Destination Domain Proto
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 api.Telegram.org udp
NL 149.154.167.220:443 api.Telegram.org tcp
NL 149.154.167.220:443 api.Telegram.org tcp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp

Files

memory/1144-0-0x000001FBD8700000-0x000001FBD872A000-memory.dmp

memory/1144-1-0x00007FFA75000000-0x00007FFA75AC1000-memory.dmp

memory/1144-2-0x000001FBF2DF0000-0x000001FBF2E00000-memory.dmp

memory/1144-6-0x00007FFA75000000-0x00007FFA75AC1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp3C7C.tmp.bat

MD5 fff8b77e88f59f6f4c92cebd4f9f3443
SHA1 2c0219551237ed8ac1169160e9dc2fb6f7821390
SHA256 bf7a03a2547ed63a815b32bccc575d4440e28f39af7b9fbe1ac13e8aab33da02
SHA512 45bfc4891cb0a9e1dc751dd1bbbfb2e392b69a114c1dcc1d19e4666d305d5e29c9300bcf01ff4fa87c7c6d0978b560b7b8b412823c7469cb22793e04bd0d4b4b

C:\a\rat.exe

MD5 3748d676147a437e12c83372fb084b17
SHA1 d6d7fae8acf766850ebe20d4e32882b26eb7d71b
SHA256 d45b164e99aed8684a4d79685278fa764be83092f1f64d1b299eb93229831cf1
SHA512 d09daf64c757ec7138ebc512493fba48b357a98ddf16c4c9eebd4af82a6185894032f4e936d33e323066a715d29c13552e6533f5dc16eaf7fbf86f2fe0204423

memory/3304-11-0x00007FFA75000000-0x00007FFA75AC1000-memory.dmp

memory/3304-12-0x000001D4350F0000-0x000001D435100000-memory.dmp

memory/3304-14-0x000001D435640000-0x000001D43564A000-memory.dmp

memory/3304-16-0x00007FFA75000000-0x00007FFA75AC1000-memory.dmp

C:\a\bookmarks.txt

MD5 61f8a15f0bf3ef90a36796b6cbb7b105
SHA1 9a0893ee4bfb0e58c64902fc4da215dcbec12e3f
SHA256 678150f8aa675320e486b135418a7ed5b546514a5aa808588eccc12fe8cd2130
SHA512 5afb5a40e95b289db50db7aa151a5a526ef04824533fccd0ad3d6ea813cc5621b8009521d7f5db69fbcb1a46640e963427fd6b42721df26f1fbfc89f59a8abab