Analysis
-
max time kernel
13s -
max time network
14s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
08-01-2025 18:16
Behavioral task
behavioral1
Sample
TelegramRAT.exe
Resource
win7-20241010-en
General
-
Target
TelegramRAT.exe
-
Size
111KB
-
MD5
e3d580a17a351366392ec9e2af674524
-
SHA1
354e8f441c2fa510e1b3ecab222280649a7efb9a
-
SHA256
6e644b385d296b76bb3ba68ff006d6b86de763c8b5792e07053e20e3d8218d75
-
SHA512
a7e2726a2b28a39f6624f419ab9194b4c8e3d4c117e324c2719b3f944c5262cbc064df8989d34b984d8541767327d18381adf6678e4445dc8a49afe0a0824309
-
SSDEEP
1536:dn+bAQACiEXM91qQIwvL9x1Cc0Di4OybhDqI64QW6zCrAZuQPEDrL:sbaCHXELrJp6bxqH4QW6zCrAZuQwv
Malware Config
Signatures
-
Toxiceye family
-
Deletes itself 1 IoCs
pid Process 584 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 3000 rat.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 2880 tasklist.exe 2824 tasklist.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 2 IoCs
pid Process 2832 timeout.exe 3052 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2964 schtasks.exe 2316 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3000 rat.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 3000 rat.exe 3000 rat.exe 3000 rat.exe 3000 rat.exe 3000 rat.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1688 TelegramRAT.exe Token: SeDebugPrivilege 2880 tasklist.exe Token: SeDebugPrivilege 2824 tasklist.exe Token: SeDebugPrivilege 3000 rat.exe Token: SeDebugPrivilege 3000 rat.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3000 rat.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 1688 wrote to memory of 2964 1688 TelegramRAT.exe 32 PID 1688 wrote to memory of 2964 1688 TelegramRAT.exe 32 PID 1688 wrote to memory of 2964 1688 TelegramRAT.exe 32 PID 1688 wrote to memory of 584 1688 TelegramRAT.exe 34 PID 1688 wrote to memory of 584 1688 TelegramRAT.exe 34 PID 1688 wrote to memory of 584 1688 TelegramRAT.exe 34 PID 584 wrote to memory of 2880 584 cmd.exe 36 PID 584 wrote to memory of 2880 584 cmd.exe 36 PID 584 wrote to memory of 2880 584 cmd.exe 36 PID 584 wrote to memory of 2884 584 cmd.exe 37 PID 584 wrote to memory of 2884 584 cmd.exe 37 PID 584 wrote to memory of 2884 584 cmd.exe 37 PID 584 wrote to memory of 2832 584 cmd.exe 38 PID 584 wrote to memory of 2832 584 cmd.exe 38 PID 584 wrote to memory of 2832 584 cmd.exe 38 PID 584 wrote to memory of 2824 584 cmd.exe 39 PID 584 wrote to memory of 2824 584 cmd.exe 39 PID 584 wrote to memory of 2824 584 cmd.exe 39 PID 584 wrote to memory of 2784 584 cmd.exe 40 PID 584 wrote to memory of 2784 584 cmd.exe 40 PID 584 wrote to memory of 2784 584 cmd.exe 40 PID 584 wrote to memory of 3052 584 cmd.exe 41 PID 584 wrote to memory of 3052 584 cmd.exe 41 PID 584 wrote to memory of 3052 584 cmd.exe 41 PID 584 wrote to memory of 3000 584 cmd.exe 42 PID 584 wrote to memory of 3000 584 cmd.exe 42 PID 584 wrote to memory of 3000 584 cmd.exe 42 PID 3000 wrote to memory of 2316 3000 rat.exe 45 PID 3000 wrote to memory of 2316 3000 rat.exe 45 PID 3000 wrote to memory of 2316 3000 rat.exe 45 PID 3000 wrote to memory of 2664 3000 rat.exe 47 PID 3000 wrote to memory of 2664 3000 rat.exe 47 PID 3000 wrote to memory of 2664 3000 rat.exe 47 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe"C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"2⤵
- Scheduled Task/Job: Scheduled Task
PID:2964
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpD910.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpD910.tmp.bat2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:584 -
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 1688"3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2880
-
-
C:\Windows\system32\find.exefind ":"3⤵PID:2884
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak3⤵
- Delays execution with timeout.exe
PID:2832
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 1688"3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2824
-
-
C:\Windows\system32\find.exefind ":"3⤵PID:2784
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak3⤵
- Delays execution with timeout.exe
PID:3052
-
-
C:\Users\ToxicEye\rat.exe"rat.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"4⤵
- Scheduled Task/Job: Scheduled Task
PID:2316
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3000 -s 17324⤵PID:2664
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
188B
MD52b8a6942c612d7c2283ac27270cde1a5
SHA12ccdf150ed9434fc4c3226cbc36b0f1e14af7396
SHA256afc87e65832a1b67bd741f8eee35c551948fd20cfa5ca64dc7f1aaae051b91f7
SHA512b25b4c5d2cad45c6ca8082dabef60ca9cec2d75914cc45928db0e2d2634059538d31fbc4329bbaba65c33e7475986389f05a70ff17b7d69f5ca2c7d5ca53d5fa
-
Filesize
111KB
MD5e3d580a17a351366392ec9e2af674524
SHA1354e8f441c2fa510e1b3ecab222280649a7efb9a
SHA2566e644b385d296b76bb3ba68ff006d6b86de763c8b5792e07053e20e3d8218d75
SHA512a7e2726a2b28a39f6624f419ab9194b4c8e3d4c117e324c2719b3f944c5262cbc064df8989d34b984d8541767327d18381adf6678e4445dc8a49afe0a0824309