c5ee6af8e3d3bdf216ce505c98458fb68f13360ad6c0cf50487b6bd3f33c52f8

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 09:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TelegramRAT.pdb
Size

239KB
MD5

f7a782a1898a88c9e492087bae1d7735
SHA1

647cec65b984f258dcd8cf75eb13fe100e0f8d66
SHA256

391846de21171c6e41bcc667fc53c5028554226b673e402a486cf4b41b9a25d9
SHA512

701e57d1c53ed368d95d4d5aa7379c32f81322bdcf6320a29d6ca690ed3780738aa5dd86797fbbe4f693a3804b89c4124e849e9f146b226aac7df21ea54ee794
SSDEEP

3072:0Uy6brhZ3mXPTVv5p7lanhtOtT99/MxYq8rT5r+ZrNpCZEC4wh1J1j+dyIeyagpH:u99UxYqsTFONkZEC4cs4

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

1228 OpenWith.exe

pid	process
1228	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\TelegramRAT.pdb
1⤵
- Modifies registry class
PID:1404

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads