Malware Analysis Report

2024-08-06 11:58

Sample ID 240302-em36caad64
Target TelegramRAT.exe
SHA256 4090a62dc4c113b58b3cbc28832fcb03dcb33c4c257c5ec65e3c574dbc12db2a
Tags
toxiceye rat trojan spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4090a62dc4c113b58b3cbc28832fcb03dcb33c4c257c5ec65e3c574dbc12db2a

Threat Level: Known bad

The file TelegramRAT.exe was found to be: Known bad.

Malicious Activity Summary

toxiceye rat trojan spyware stealer

Toxiceye family

ToxicEye

Downloads MZ/PE file

Reads user/profile data of web browsers

Deletes itself

Checks computer location settings

Executes dropped EXE

Legitimate hosting services abused for malware hosting/C2

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Delays execution with timeout.exe

Suspicious use of FindShellTrayWindow

Opens file in notepad (likely ransom note)

Creates scheduled task(s)

Enumerates processes with tasklist

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Scheduled Task/Job
T1053
Persistence
TA0003
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
System Information Discovery
T1082
Process Discovery
T1057
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Web Service
T1102
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-03-02 04:04

Signatures

Toxiceye family

toxiceye

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-02 04:04

Reported

2024-03-02 04:06

Platform

win7-20240221-en

Max time kernel

118s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe"

Signatures

ToxicEye

rat trojan toxiceye

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\System32\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\a\rat.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A
N/A N/A C:\Windows\System32\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\a\rat.exe N/A
Token: SeDebugPrivilege N/A C:\a\rat.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\a\rat.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2512 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe C:\Windows\System32\schtasks.exe
PID 2512 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe C:\Windows\System32\schtasks.exe
PID 2512 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe C:\Windows\System32\schtasks.exe
PID 2512 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe C:\Windows\System32\cmd.exe
PID 2512 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe C:\Windows\System32\cmd.exe
PID 2512 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe C:\Windows\System32\cmd.exe
PID 2584 wrote to memory of 2856 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2584 wrote to memory of 2856 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2584 wrote to memory of 2856 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2584 wrote to memory of 2588 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\find.exe
PID 2584 wrote to memory of 2588 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\find.exe
PID 2584 wrote to memory of 2588 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\find.exe
PID 2584 wrote to memory of 1960 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\timeout.exe
PID 2584 wrote to memory of 1960 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\timeout.exe
PID 2584 wrote to memory of 1960 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\timeout.exe
PID 2584 wrote to memory of 2012 N/A C:\Windows\System32\cmd.exe C:\a\rat.exe
PID 2584 wrote to memory of 2012 N/A C:\Windows\System32\cmd.exe C:\a\rat.exe
PID 2584 wrote to memory of 2012 N/A C:\Windows\System32\cmd.exe C:\a\rat.exe
PID 2012 wrote to memory of 2440 N/A C:\a\rat.exe C:\Windows\System32\schtasks.exe
PID 2012 wrote to memory of 2440 N/A C:\a\rat.exe C:\Windows\System32\schtasks.exe
PID 2012 wrote to memory of 2440 N/A C:\a\rat.exe C:\Windows\System32\schtasks.exe
PID 2012 wrote to memory of 2496 N/A C:\a\rat.exe C:\Windows\system32\WerFault.exe
PID 2012 wrote to memory of 2496 N/A C:\a\rat.exe C:\Windows\system32\WerFault.exe
PID 2012 wrote to memory of 2496 N/A C:\a\rat.exe C:\Windows\system32\WerFault.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe

"C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe"

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\a\rat.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp27AC.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp27AC.tmp.bat

C:\Windows\system32\tasklist.exe

Tasklist /fi "PID eq 2512"

C:\Windows\system32\find.exe

find ":"

C:\Windows\system32\timeout.exe

Timeout /T 1 /Nobreak

C:\a\rat.exe

"rat.exe"

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\a\rat.exe"

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2012 -s 1488

Network

Country Destination Domain Proto
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 api.Telegram.org udp
NL 149.154.167.220:443 api.Telegram.org tcp
NL 149.154.167.220:443 api.Telegram.org tcp

Files

memory/2512-0-0x0000000000220000-0x000000000024A000-memory.dmp

memory/2512-1-0x000007FEF5D70000-0x000007FEF675C000-memory.dmp

memory/2512-2-0x000000001AED0000-0x000000001AF50000-memory.dmp

memory/2512-5-0x000007FEF5D70000-0x000007FEF675C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp27AC.tmp.bat

MD5 46db400615002aa8dbdf765b9971ba6c
SHA1 b17d0b04a2929b4f7997511203e5f663d6dfc49d
SHA256 ae3a54d11fa6350d0786a29451da067e2c008a218b7b60e6746dfe445014c7bd
SHA512 f66d2b3514df68bf871c31f3af2fb081120f23aed635abcfcb97e3f9dbe9d891fc5bfbbcc452db81d9ce1e7b3fca230d9f2c7a7bdf1a0b2dc566779ddf4a9f38

C:\a\rat.exe

MD5 dfa6fcf1c40b948797c4826414a630de
SHA1 200faa577f4c2c9e6f15d0c01376ca9c16d87250
SHA256 4090a62dc4c113b58b3cbc28832fcb03dcb33c4c257c5ec65e3c574dbc12db2a
SHA512 f4e8ff21aee6d26cc985baa2bcc2b13d51d25b849f8f3ef7fffecc23ecbc092729ec409c2827671736c68a43d98edc896723e04912672aecbad894e381094e53

memory/2012-10-0x0000000001380000-0x00000000013AA000-memory.dmp

memory/2012-11-0x000007FEF5380000-0x000007FEF5D6C000-memory.dmp

memory/2012-12-0x000000001AE80000-0x000000001AF00000-memory.dmp

memory/2012-13-0x000007FEF5380000-0x000007FEF5D6C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-02 04:04

Reported

2024-03-02 04:07

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe"

Signatures

ToxicEye

rat trojan toxiceye

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\a\rat.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\a\rat.exe N/A

Reads user/profile data of web browsers

spyware stealer

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A
N/A N/A C:\Windows\System32\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A
N/A N/A C:\a\rat.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\a\rat.exe N/A
Token: SeDebugPrivilege N/A C:\a\rat.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\a\rat.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2024 wrote to memory of 452 N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe C:\Windows\System32\schtasks.exe
PID 2024 wrote to memory of 452 N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe C:\Windows\System32\schtasks.exe
PID 2024 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe C:\Windows\System32\cmd.exe
PID 2024 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe C:\Windows\System32\cmd.exe
PID 540 wrote to memory of 3804 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\tasklist.exe
PID 540 wrote to memory of 3804 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\tasklist.exe
PID 540 wrote to memory of 1004 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\find.exe
PID 540 wrote to memory of 1004 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\find.exe
PID 540 wrote to memory of 1584 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\timeout.exe
PID 540 wrote to memory of 1584 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\timeout.exe
PID 540 wrote to memory of 4760 N/A C:\Windows\System32\cmd.exe C:\a\rat.exe
PID 540 wrote to memory of 4760 N/A C:\Windows\System32\cmd.exe C:\a\rat.exe
PID 4760 wrote to memory of 3640 N/A C:\a\rat.exe C:\Windows\System32\schtasks.exe
PID 4760 wrote to memory of 3640 N/A C:\a\rat.exe C:\Windows\System32\schtasks.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe

"C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe"

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\a\rat.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpD66A.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpD66A.tmp.bat

C:\Windows\system32\tasklist.exe

Tasklist /fi "PID eq 2024"

C:\Windows\system32\find.exe

find ":"

C:\Windows\system32\timeout.exe

Timeout /T 1 /Nobreak

C:\a\rat.exe

"rat.exe"

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\a\rat.exe"

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\vcredist2012_x86_0_vcRuntimeMinimum_x86.log

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3940 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 api.Telegram.org udp
NL 149.154.167.220:443 api.Telegram.org tcp
NL 149.154.167.220:443 api.Telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 185.199.108.133:443 raw.githubusercontent.com tcp
NL 149.154.167.220:443 api.Telegram.org tcp
NL 149.154.167.220:443 api.Telegram.org tcp
NL 149.154.167.220:443 api.Telegram.org tcp
NL 149.154.167.220:443 api.Telegram.org tcp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
NL 149.154.167.220:443 api.Telegram.org tcp
NL 149.154.167.220:443 api.Telegram.org tcp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
IE 209.85.202.95:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 95.202.85.209.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 24.73.42.20.in-addr.arpa udp

Files

memory/2024-0-0x00000272B6D00000-0x00000272B6D2A000-memory.dmp

memory/2024-1-0x00007FF9840E0000-0x00007FF984BA1000-memory.dmp

memory/2024-2-0x00000272B8A80000-0x00000272B8A90000-memory.dmp

memory/2024-6-0x00007FF9840E0000-0x00007FF984BA1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpD66A.tmp.bat

MD5 c4b6ff2a55362ba004ca27f1be91f2c9
SHA1 81995d9e6e318501a072207234fc497cffe48fc9
SHA256 7c79d0287fa6de54fce9122c845a9b7c64017d10fa4fc14aa9d94058c3f120c0
SHA512 c11909152cd8d0a6d63729b5fea0977b4053cd53a8dc9bc772d7b1720785a211412734219c0c0af8e6e47d176db1e9c36ccf74924bcca8486237bbbf22e1f6a3

C:\a\rat.exe

MD5 dfa6fcf1c40b948797c4826414a630de
SHA1 200faa577f4c2c9e6f15d0c01376ca9c16d87250
SHA256 4090a62dc4c113b58b3cbc28832fcb03dcb33c4c257c5ec65e3c574dbc12db2a
SHA512 f4e8ff21aee6d26cc985baa2bcc2b13d51d25b849f8f3ef7fffecc23ecbc092729ec409c2827671736c68a43d98edc896723e04912672aecbad894e381094e53

memory/4760-11-0x00007FF983D00000-0x00007FF9847C1000-memory.dmp

memory/4760-12-0x000001ECBFF10000-0x000001ECBFF20000-memory.dmp

memory/4760-15-0x000001ECC1070000-0x000001ECC107A000-memory.dmp

memory/4760-16-0x000001ECBFF10000-0x000001ECBFF20000-memory.dmp

memory/4760-17-0x000001ECC1030000-0x000001ECC1042000-memory.dmp

memory/4760-43-0x00007FF983D00000-0x00007FF9847C1000-memory.dmp

memory/4760-44-0x000001ECBFF10000-0x000001ECBFF20000-memory.dmp

memory/4760-45-0x000001ECBFF10000-0x000001ECBFF20000-memory.dmp

memory/4760-46-0x000001ECBFF10000-0x000001ECBFF20000-memory.dmp