b6a06f9799e05b4b4404a73f227da838ec9ba0e4cc6de376b04807897e55ddc6

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/04/2026, 11:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ratooon.exe
Size 94KB
Sample260424-ng89vags5x
SHA256 b6a06f9799e05b4b4404a73f227da838ec9ba0e4cc6de376b04807897e55ddc6
MD5 8835cf4e4ab72cf546bd209f1965e308
SHA1 4a9fe8de87aea589a0d7ab83ceb57a5f705d7e31
SHA512 ed6eaf61e1b06419419f44c58eb11602023396cf0d0056065424f8ec6ffe189ac09ca73f6050654e846b9613dcb050eb46fb9c571123f8967116f969dd7ea4f1
SSDEEP 1536:Qgc6pMpG5sLTsqa4tsi5tzCANqASbhKp+CbC82v1h:QgcwMpGoAX4tnjzJkASbhKzbCvvb
TLSH
T1B3934B0473FC2926E7FF8FBE69B550500F72B9279E31D64D498A60980A70B869D20F77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5412	powershell.exe
5412	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4776	ratooon.exe
2680	ratooon.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
19	ip-api.com

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
4216	timeout.exe
4788	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4940	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5412	powershell.exe
5412	powershell.exe
4776	ratooon.exe
4776	ratooon.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4776	ratooon.exe
Token: SeDebugPrivilege	5412	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 5684	4660	ratooon.exe	85
PID 5684 wrote to memory of 3800	5684	cmd.exe	87
PID 5684 wrote to memory of 4216	5684	cmd.exe	88
PID 5684 wrote to memory of 4776	5684	cmd.exe	89
PID 5684 wrote to memory of 4788	5684	cmd.exe	90
PID 4776 wrote to memory of 4940	4776	ratooon.exe	91
PID 4776 wrote to memory of 5412	4776	ratooon.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ratooon.exe
"C:\Users\Admin\AppData\Local\Temp\ratooon.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\cleanup_oxEupfip0eA2Qy5UVw8BfBx6X3vdJn.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5684
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3800
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4216
- - C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratooon.exe
    "C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratooon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4776
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "ratooon" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratooon.exe\"" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4940
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass "Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratooon.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5412
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4788

C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratooon.exe
"C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratooon.exe"
1⤵
- Executes dropped EXE
PID:2680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ratooon.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ratooon.exe.log
Size 859B
SHA256 685f70bf685f654651dcd0acc495b6f52f02f73cc3ca8b3d2c8433aac9ba144d
MD5 e204f3d12abd1691ce1f149399441188
SHA1 798042095539abfe857e456fca4e1035f67d29bf
SHA512 804c5ea57a59f86fd0c34479be4c479230bff79093548e8461758829928969da565c211ccc9cb9befa0fef15f0400a5b1f17d5ddf88aef6ff01b67a191176b9f
TLSH
T1E7116B70227AA1D889162F952C1E2BC403BF4336B650DE0C7998729EED364175F212E7
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ympjhpmj.txp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ympjhpmj.txp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ratooon.exe

Path C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratooon.exe
Size 94KB
SHA256 b6a06f9799e05b4b4404a73f227da838ec9ba0e4cc6de376b04807897e55ddc6
MD5 8835cf4e4ab72cf546bd209f1965e308
SHA1 4a9fe8de87aea589a0d7ab83ceb57a5f705d7e31
SHA512 ed6eaf61e1b06419419f44c58eb11602023396cf0d0056065424f8ec6ffe189ac09ca73f6050654e846b9613dcb050eb46fb9c571123f8967116f969dd7ea4f1
SSDEEP 1536:Qgc6pMpG5sLTsqa4tsi5tzCANqASbhKp+CbC82v1h:QgcwMpGoAX4tnjzJkASbhKzbCvvb
TLSH
T1B3934B0473FC2926E7FF8FBE69B550500F72B9279E31D64D498A60980A70B869D20F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cleanup_oxEupfip0eA2Qy5UVw8BfBx6X3vdJn.bat

Path C:\Users\Admin\AppData\Roaming\Temp\cleanup_oxEupfip0eA2Qy5UVw8BfBx6X3vdJn.bat
Size 530B
SHA256 6373b50f6d55df0a8caa64fefd9a1d1fbdfd440e98aac4d94d27c3642f7edfea
MD5 7cc94887bcd88e5b5f789adcae3997f8
SHA1 4c1b75d86e089f5efd405d649d85129188479ec1
SHA512 9f5f967d6672b180219e762e1268577c4c63e0747e53dfd3c06bbc19d4e137f25cf3df4112179ae8b79f49144e4300215d96fe8d7381bfc1be287ca356d4c2d6
TLSH
T183F05902638E43094410517B0EB7318DC0E94457BFD077613B2CC42A67D601BA6C37E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4660-1-0x0000010F56A00000-0x0000010F56A10000-memory.dmp

Download

memory/4660-2-0x0000010F3DE50000-0x0000010F3DE58000-memory.dmp

Download

memory/4660-0-0x0000010F3C2E0000-0x0000010F3C2FE000-memory.dmp

Download

memory/4776-13-0x0000023D24B30000-0x0000023D24B40000-memory.dmp

Download

memory/4776-16-0x0000023D24B30000-0x0000023D24B40000-memory.dmp

Download

memory/4776-18-0x0000023D3F070000-0x0000023D3F3E6000-memory.dmp

Download

memory/4776-15-0x0000023D3ECE0000-0x0000023D3ECEC000-memory.dmp

Download

memory/5412-26-0x0000023FF6560000-0x0000023FF6582000-memory.dmp

Download

memory/5412-29-0x0000023FF6080000-0x0000023FF608C000-memory.dmp

Download