Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
27-04-2024 09:44
Behavioral task
behavioral1
Sample
AudioSwitcher.AudioApi.CoreAudio.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
AudioSwitcher.AudioApi.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
Sodium.dll
Resource
win10v2004-20240426-en
General
-
Target
TelegramRAT.exe
-
Size
111KB
-
MD5
8834c1eaf28b3b076df2a0aac5d1148e
-
SHA1
640e70c94c0e01492c4c45cf2b23b65914a94cc5
-
SHA256
49f704606ec839fa6867a5f5f67090299b69b02dab7d352e161c8a754165de8a
-
SHA512
59c6d085818d43607ee2aef904899690a116a34f6e50978c35017d1a546964bcdfc435b7fb09bab998d4d0eacc8b614a58a55c029311d7c33473a501f4f3f561
-
SSDEEP
1536:p+bvqJIP4M91qQIwzUrxxxdKy2nBfUbhDqI6CsQWVzCrAZuDZ6Dd:sbvqJe4MUlxxDrbxqHBQWVzCrAZuDQd
Malware Config
Extracted
toxiceye
https://api.telegram.org/bot7005624592:AAFT1GroRFjOnavaa8nJipFR-iCuYT3f2xQ/sendMessage?chat_id=6235796510
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation TelegramRAT.exe Key value queried \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation rat.exe -
Executes dropped EXE 1 IoCs
pid Process 528 rat.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1808 schtasks.exe 3044 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1172 timeout.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 3816 tasklist.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2180 TelegramRAT.exe Token: SeDebugPrivilege 3816 tasklist.exe Token: SeDebugPrivilege 528 rat.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2180 wrote to memory of 1808 2180 TelegramRAT.exe 88 PID 2180 wrote to memory of 1808 2180 TelegramRAT.exe 88 PID 2180 wrote to memory of 3920 2180 TelegramRAT.exe 90 PID 2180 wrote to memory of 3920 2180 TelegramRAT.exe 90 PID 3920 wrote to memory of 3816 3920 cmd.exe 92 PID 3920 wrote to memory of 3816 3920 cmd.exe 92 PID 3920 wrote to memory of 2012 3920 cmd.exe 93 PID 3920 wrote to memory of 2012 3920 cmd.exe 93 PID 3920 wrote to memory of 1172 3920 cmd.exe 95 PID 3920 wrote to memory of 1172 3920 cmd.exe 95 PID 3920 wrote to memory of 528 3920 cmd.exe 96 PID 3920 wrote to memory of 528 3920 cmd.exe 96 PID 528 wrote to memory of 3044 528 rat.exe 98 PID 528 wrote to memory of 3044 528 rat.exe 98 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe"C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\Admin\rat.exe"2⤵
- Creates scheduled task(s)
PID:1808
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp49AB.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp49AB.tmp.bat2⤵
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2180"3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3816
-
-
C:\Windows\system32\find.exefind ":"3⤵PID:2012
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak3⤵
- Delays execution with timeout.exe
PID:1172
-
-
C:\Users\Admin\rat.exe"rat.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\Admin\rat.exe"4⤵
- Creates scheduled task(s)
PID:3044
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
185B
MD58f11a1c1d3c06078f9655e2f31ad6105
SHA1c293605f98d63120adff4716d05374d2992c5f96
SHA25681b0b7b8a3f58988eb56cb9e2528c114ec9cfdf58e4bad5ee3a192de218df7b1
SHA5123f697c58a1b5d6dd61a4c00a0af5d68144697460dff5932a03fc8a88fe895243102584be799d8172e1f9f8ce345edf0a0d6b9df7d4d9567dbc7b6cb0eea7a6f4
-
Filesize
111KB
MD58834c1eaf28b3b076df2a0aac5d1148e
SHA1640e70c94c0e01492c4c45cf2b23b65914a94cc5
SHA25649f704606ec839fa6867a5f5f67090299b69b02dab7d352e161c8a754165de8a
SHA51259c6d085818d43607ee2aef904899690a116a34f6e50978c35017d1a546964bcdfc435b7fb09bab998d4d0eacc8b614a58a55c029311d7c33473a501f4f3f561