Overview

overview

10

Static

static

10

TelegramRAT.exe

windows10-2004-x64

Analysis

  • max time kernel
    240s
  • max time network
    245s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-01-2025 20:35

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    TelegramRAT.exe

  • Size

    111KB

  • MD5

    e3d580a17a351366392ec9e2af674524

  • SHA1

    354e8f441c2fa510e1b3ecab222280649a7efb9a

  • SHA256

    6e644b385d296b76bb3ba68ff006d6b86de763c8b5792e07053e20e3d8218d75

  • SHA512

    a7e2726a2b28a39f6624f419ab9194b4c8e3d4c117e324c2719b3f944c5262cbc064df8989d34b984d8541767327d18381adf6678e4445dc8a49afe0a0824309

  • SSDEEP

    1536:dn+bAQACiEXM91qQIwvL9x1Cc0Di4OybhDqI64QW6zCrAZuQPEDrL:sbaCHXELrJp6bxqH4QW6zCrAZuQwv

Score
10/10
gurcutoxiceyediscoveryratstealertrojan

Malware Config

Extracted

Family

gurcu

C2

https://api.telegram.org/bot8014667160:AAFqSbz3GwG_v0L0NNlpN0dSG5-tCdm4TtY/sendMessage?chat_id=-4791200354

https://api.telegram.org/bot8014667160:AAFqSbz3GwG_v0L0NNlpN0dSG5-tCdm4TtY/getUpdate

https://api.telegram.org/bot8014667160:AAFqSbz3GwG_v0L0NNlpN0dSG5-tCdm4TtY/getUpdates?offset=97250663

https://api.telegram.org/bot8014667160:AAFqSbz3GwG_v0L0NNlpN0dSG5-tCdm4TtY/getUpdates?offset=97250664

https://api.telegram.org/bot8014667160:AAFqSbz3GwG_v0L0NNlpN0dSG5-tCdm4TtY/getUpdates?offset=97250665

https://api.telegram.org/bot8014667160:AAFqSbz3GwG_v0L0NNlpN0dSG5-tCdm4TtY/getUpdates?offset=97250666

https://api.telegram.org/bot8014667160:AAFqSbz3GwG_v0L0NNlpN0dSG5-tCdm4TtY/sendPhoto?chat_id=-479120035

Signatures

  • Gurcu family
    gurcu
  • Gurcu, WhiteSnake

    Gurcu aka WhiteSnake is a malware stealer written in C#.

    stealergurcu
  • ToxicEye

    ToxicEye is a trojan written in C#.

    rattrojantoxiceye
  • Toxiceye family
    toxiceye
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe
    "C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3096
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2492
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp87FC.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp87FC.tmp.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2396
      • C:\Windows\system32\tasklist.exe
        Tasklist /fi "PID eq 3096"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:2540
      • C:\Windows\system32\find.exe
        find ":"
        3⤵
          PID:4604
        • C:\Windows\system32\timeout.exe
          Timeout /T 1 /Nobreak
          3⤵
          • Delays execution with timeout.exe
          PID:4976
        • C:\Users\ToxicEye\rat.exe
          "rat.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3172
          • C:\Windows\System32\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:1436
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:244
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:768

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
      Filesize

      64KB

      MD5

      d2fb266b97caff2086bf0fa74eddb6b2

      SHA1

      2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

      SHA256

      b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

      SHA512

      c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

      Download Submit

    • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
      Filesize

      4B

      MD5

      f49655f856acb8884cc0ace29216f511

      SHA1

      cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

      SHA256

      7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

      SHA512

      599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

      Download Submit

    • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
      Filesize

      944B

      MD5

      6bd369f7c74a28194c991ed1404da30f

      SHA1

      0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

      SHA256

      878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

      SHA512

      8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\tmp87FC.tmp.bat
      Filesize

      188B

      MD5

      10fd09ddb4b0b8ac3ead8c1a78948e6c

      SHA1

      88bee343c139df86ee8165ee177a2883316fc103

      SHA256

      89cfac18a0ebb2a1902a7266f07dbd3f5efad58accbaae95bccbc9540fa925f7

      SHA512

      af927e47817f9ec4716cea85ab723aa547ea5a5de59d3d67cb514f0dbf8de0f6b3051dad6ef05ea91f410c0ffd51ad0ee24af02af8eebec94439c7c382f00986

      Download Submit

    • C:\Users\ToxicEye\rat.exe
      Filesize

      111KB

      MD5

      e3d580a17a351366392ec9e2af674524

      SHA1

      354e8f441c2fa510e1b3ecab222280649a7efb9a

      SHA256

      6e644b385d296b76bb3ba68ff006d6b86de763c8b5792e07053e20e3d8218d75

      SHA512

      a7e2726a2b28a39f6624f419ab9194b4c8e3d4c117e324c2719b3f944c5262cbc064df8989d34b984d8541767327d18381adf6678e4445dc8a49afe0a0824309

      Download Submit

    • memory/244-12-0x000001E356BE0000-0x000001E356BE1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/244-19-0x000001E356BE0000-0x000001E356BE1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/244-11-0x000001E356BE0000-0x000001E356BE1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/244-13-0x000001E356BE0000-0x000001E356BE1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/244-17-0x000001E356BE0000-0x000001E356BE1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/244-18-0x000001E356BE0000-0x000001E356BE1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/244-23-0x000001E356BE0000-0x000001E356BE1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/244-22-0x000001E356BE0000-0x000001E356BE1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/244-21-0x000001E356BE0000-0x000001E356BE1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/244-20-0x000001E356BE0000-0x000001E356BE1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/768-30-0x0000018ABF8E0000-0x0000018ABF8E1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/768-41-0x0000018ABF8E0000-0x0000018ABF8E1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/768-37-0x0000018ABF8E0000-0x0000018ABF8E1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/768-36-0x0000018ABF8E0000-0x0000018ABF8E1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/768-39-0x0000018ABF8E0000-0x0000018ABF8E1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/768-40-0x0000018ABF8E0000-0x0000018ABF8E1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/768-38-0x0000018ABF8E0000-0x0000018ABF8E1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/768-31-0x0000018ABF8E0000-0x0000018ABF8E1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/768-29-0x0000018ABF8E0000-0x0000018ABF8E1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3096-1-0x00000122BCE20000-0x00000122BCE42000-memory.dmp

      Filesize

      136KB

      Download

    • memory/3096-2-0x00007FFAA2AA0000-0x00007FFAA3561000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3096-6-0x00007FFAA2AA0000-0x00007FFAA3561000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3096-0-0x00007FFAA2AA3000-0x00007FFAA2AA5000-memory.dmp

      Filesize

      8KB

      Download

    • memory/3172-24-0x000001A5DD800000-0x000001A5DD8AA000-memory.dmp

      Filesize

      680KB

      Download

    • memory/3172-25-0x000001A5DD8B0000-0x000001A5DD926000-memory.dmp

      Filesize

      472KB

      Download