Analysis
-
max time kernel
206s -
max time network
210s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
27-04-2024 09:37
Behavioral task
behavioral1
Sample
AudioSwitcher.AudioApi.CoreAudio.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
AudioSwitcher.AudioApi.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Sodium.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
TelegramRAT.exe
-
Size
111KB
-
MD5
8834c1eaf28b3b076df2a0aac5d1148e
-
SHA1
640e70c94c0e01492c4c45cf2b23b65914a94cc5
-
SHA256
49f704606ec839fa6867a5f5f67090299b69b02dab7d352e161c8a754165de8a
-
SHA512
59c6d085818d43607ee2aef904899690a116a34f6e50978c35017d1a546964bcdfc435b7fb09bab998d4d0eacc8b614a58a55c029311d7c33473a501f4f3f561
-
SSDEEP
1536:p+bvqJIP4M91qQIwzUrxxxdKy2nBfUbhDqI6CsQWVzCrAZuDZ6Dd:sbvqJe4MUlxxDrbxqHBQWVzCrAZuDQd
Malware Config
Extracted
Family
toxiceye
C2
https://api.telegram.org/bot7005624592:AAFT1GroRFjOnavaa8nJipFR-iCuYT3f2xQ/sendMessage?chat_id=6235796510
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Control Panel\International\Geo\Nation TelegramRAT.exe Key value queried \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Control Panel\International\Geo\Nation rat.exe -
Executes dropped EXE 1 IoCs
pid Process 2448 rat.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2944 schtasks.exe 1036 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2256 timeout.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 4636 tasklist.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 1688 TelegramRAT.exe Token: SeDebugPrivilege 4636 tasklist.exe Token: SeDebugPrivilege 2448 rat.exe Token: SeDebugPrivilege 2088 taskmgr.exe Token: SeSystemProfilePrivilege 2088 taskmgr.exe Token: SeCreateGlobalPrivilege 2088 taskmgr.exe Token: 33 2088 taskmgr.exe Token: SeIncBasePriorityPrivilege 2088 taskmgr.exe -
Suspicious use of FindShellTrayWindow 53 IoCs
pid Process 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe -
Suspicious use of SendNotifyMessage 53 IoCs
pid Process 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1688 wrote to memory of 2944 1688 TelegramRAT.exe 89 PID 1688 wrote to memory of 2944 1688 TelegramRAT.exe 89 PID 1688 wrote to memory of 2724 1688 TelegramRAT.exe 91 PID 1688 wrote to memory of 2724 1688 TelegramRAT.exe 91 PID 2724 wrote to memory of 4636 2724 cmd.exe 93 PID 2724 wrote to memory of 4636 2724 cmd.exe 93 PID 2724 wrote to memory of 1468 2724 cmd.exe 94 PID 2724 wrote to memory of 1468 2724 cmd.exe 94 PID 2724 wrote to memory of 2256 2724 cmd.exe 95 PID 2724 wrote to memory of 2256 2724 cmd.exe 95 PID 2724 wrote to memory of 2448 2724 cmd.exe 96 PID 2724 wrote to memory of 2448 2724 cmd.exe 96 PID 2448 wrote to memory of 1036 2448 rat.exe 98 PID 2448 wrote to memory of 1036 2448 rat.exe 98 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe"C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\Admin\rat.exe"2⤵
- Creates scheduled task(s)
PID:2944
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp442D.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp442D.tmp.bat2⤵
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 1688"3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4636
-
-
C:\Windows\system32\find.exefind ":"3⤵PID:1468
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak3⤵
- Delays execution with timeout.exe
PID:2256
-
-
C:\Users\Admin\rat.exe"rat.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\Admin\rat.exe"4⤵
- Creates scheduled task(s)
PID:1036
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2088
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
185B
MD52f1159a1e80474e6aaec72fc62eba057
SHA1d13f46f6e5ad93f796bf40f4055e82c9634c0a90
SHA2568396d88c9286ebbca3ed6649908f7d23336aa163f4f9d7c75cdd154eacaf6a38
SHA5126e648f127b4ca790a0d6e1cd1cfdba163932f1355aa5b3c5c70769d4eb832f84178e5c72a2634e1b5abe7fe699c39b8c792fe842876170afea920d28199a2c92
-
Filesize
111KB
MD58834c1eaf28b3b076df2a0aac5d1148e
SHA1640e70c94c0e01492c4c45cf2b23b65914a94cc5
SHA25649f704606ec839fa6867a5f5f67090299b69b02dab7d352e161c8a754165de8a
SHA51259c6d085818d43607ee2aef904899690a116a34f6e50978c35017d1a546964bcdfc435b7fb09bab998d4d0eacc8b614a58a55c029311d7c33473a501f4f3f561