Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
12/07/2024, 01:10
Behavioral task
behavioral1
Sample
telegram-Number-TOOL.exe
Resource
win7-20240708-en
windows7-x64
General
-
Target
telegram-Number-TOOL.exe
-
Size
140KB
-
MD5
acecccd9b38ba794a692a9de0856859c
-
SHA1
07129ec32682a27d66a040e4ba3d833b9a0c35df
-
SHA256
ca5dcc8bf1430114a69380f98308370834dc864ba041a9508eca080fa1d3fa60
-
SHA512
f26696aa239ef96834f3d3d5173197a7cc9b190522ddbd05e09bd72dc87d7c30a9929a04f8c38f767db90a3c76aa588e5a25c435a3db3b37410d3fbf6fec812e
-
SSDEEP
1536:nUKgcxybQCHWPMVgfa9iI2H1bC/PA/fmQzc5ugdPTLVclN:nUjcxyEkWPMVgfBH1bC6+QpsBY
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
147.185.221.21:6643
147.185.221.21:5552
wviykvrredoqeatxrwy
-
delay
1
-
install
true
-
install_file
telegram-Number-TOOL.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x0009000000023419-10.dat family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation telegram-Number-TOOL.exe -
Executes dropped EXE 1 IoCs
pid Process 612 telegram-Number-TOOL.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1932 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2596 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1864 telegram-Number-TOOL.exe 1864 telegram-Number-TOOL.exe 1864 telegram-Number-TOOL.exe 1864 telegram-Number-TOOL.exe 1864 telegram-Number-TOOL.exe 1864 telegram-Number-TOOL.exe 1864 telegram-Number-TOOL.exe 1864 telegram-Number-TOOL.exe 1864 telegram-Number-TOOL.exe 1864 telegram-Number-TOOL.exe 1864 telegram-Number-TOOL.exe 1864 telegram-Number-TOOL.exe 1864 telegram-Number-TOOL.exe 1864 telegram-Number-TOOL.exe 1864 telegram-Number-TOOL.exe 1864 telegram-Number-TOOL.exe 1864 telegram-Number-TOOL.exe 1864 telegram-Number-TOOL.exe 1864 telegram-Number-TOOL.exe 1864 telegram-Number-TOOL.exe 1864 telegram-Number-TOOL.exe 612 telegram-Number-TOOL.exe 612 telegram-Number-TOOL.exe 612 telegram-Number-TOOL.exe 612 telegram-Number-TOOL.exe 612 telegram-Number-TOOL.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 612 telegram-Number-TOOL.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 1864 telegram-Number-TOOL.exe Token: SeDebugPrivilege 612 telegram-Number-TOOL.exe Token: SeDebugPrivilege 2208 taskmgr.exe Token: SeSystemProfilePrivilege 2208 taskmgr.exe Token: SeCreateGlobalPrivilege 2208 taskmgr.exe Token: 33 2208 taskmgr.exe Token: SeIncBasePriorityPrivilege 2208 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe 2208 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 612 telegram-Number-TOOL.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1864 wrote to memory of 3660 1864 telegram-Number-TOOL.exe 86 PID 1864 wrote to memory of 3660 1864 telegram-Number-TOOL.exe 86 PID 1864 wrote to memory of 2656 1864 telegram-Number-TOOL.exe 88 PID 1864 wrote to memory of 2656 1864 telegram-Number-TOOL.exe 88 PID 2656 wrote to memory of 1932 2656 cmd.exe 90 PID 2656 wrote to memory of 1932 2656 cmd.exe 90 PID 3660 wrote to memory of 2596 3660 cmd.exe 91 PID 3660 wrote to memory of 2596 3660 cmd.exe 91 PID 2656 wrote to memory of 612 2656 cmd.exe 92 PID 2656 wrote to memory of 612 2656 cmd.exe 92 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\telegram-Number-TOOL.exe"C:\Users\Admin\AppData\Local\Temp\telegram-Number-TOOL.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "telegram-Number-TOOL" /tr '"C:\Users\Admin\AppData\Roaming\telegram-Number-TOOL.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "telegram-Number-TOOL" /tr '"C:\Users\Admin\AppData\Roaming\telegram-Number-TOOL.exe"'3⤵
- Scheduled Task/Job: Scheduled Task
PID:2596
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpFF40.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:1932
-
-
C:\Users\Admin\AppData\Roaming\telegram-Number-TOOL.exe"C:\Users\Admin\AppData\Roaming\telegram-Number-TOOL.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:612
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2208
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
164B
MD5c0dfa38af1d1ba61880f043a57000dc4
SHA1929f9ac65a127b66df79bcd9309908311b16f7f9
SHA256edd60a283588fe5b857ff62b7b6544b2b48aff1142d15363dded49478c2f52d3
SHA5127e680db815e658bd5807fcc8ec44370811bc6eaa741c06bf048f8d04b7974579c372bd19c64031f69ff6cb7bd623def203287b0240c36edd7aac27dea8d30b57
-
Filesize
8B
MD5cf759e4c5f14fe3eec41b87ed756cea8
SHA1c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA256c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
SHA512c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b
-
Filesize
140KB
MD5acecccd9b38ba794a692a9de0856859c
SHA107129ec32682a27d66a040e4ba3d833b9a0c35df
SHA256ca5dcc8bf1430114a69380f98308370834dc864ba041a9508eca080fa1d3fa60
SHA512f26696aa239ef96834f3d3d5173197a7cc9b190522ddbd05e09bd72dc87d7c30a9929a04f8c38f767db90a3c76aa588e5a25c435a3db3b37410d3fbf6fec812e