Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
24/04/2026, 11:23
General
- Target ratooon.exe
- Size 94KB
- Sample260424-ng89vags5x
- SHA256 b6a06f9799e05b4b4404a73f227da838ec9ba0e4cc6de376b04807897e55ddc6
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 2 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Delays execution with timeout.exe 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ratooon.exe"C:\Users\Admin\AppData\Local\Temp\ratooon.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\cleanup_ZVsCObPMVB5TxdE7HuFKnH7TiXssha.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak3⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratooon.exe"C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratooon.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "ratooon" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratooon.exe\"" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass "Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratooon.exe'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak3⤵
- Delays execution with timeout.exe
-
-
-
C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratooon.exe"C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratooon.exe"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ratooon.exe.log
__PSScriptPolicyTest_l0mdxczb.egz.ps1
ratooon.exe
cleanup_ZVsCObPMVB5TxdE7HuFKnH7TiXssha.bat
memory/1140-43-0x00000265E11E0000-0x00000265E11FA000-memory.dmp
memory/1140-45-0x00000265E0C90000-0x00000265E0C96000-memory.dmp
memory/1140-51-0x00000265E0C30000-0x00000265E0C86000-memory.dmp
memory/1140-49-0x00000265C6BF0000-0x00000265C6BFC000-memory.dmp
memory/1140-50-0x00000265C8570000-0x00000265C8582000-memory.dmp
memory/1140-46-0x00000265E0CA0000-0x00000265E0CAA000-memory.dmp
memory/1140-44-0x00000265E0BF0000-0x00000265E0BF8000-memory.dmp
memory/1140-25-0x00000265E0B00000-0x00000265E0B22000-memory.dmp
memory/1140-42-0x00000265E0BE0000-0x00000265E0BEA000-memory.dmp
memory/1140-38-0x00000265E0BB0000-0x00000265E0BCC000-memory.dmp
memory/1140-39-0x00000265E0ED0000-0x00000265E0F83000-memory.dmp
memory/1140-40-0x00000265E0BD0000-0x00000265E0BDA000-memory.dmp
memory/1140-41-0x00000265E0C00000-0x00000265E0C1C000-memory.dmp
memory/1488-1-0x0000023566B10000-0x0000023566B20000-memory.dmp
memory/1488-0-0x000002354C410000-0x000002354C42E000-memory.dmp
memory/1488-2-0x000002354E180000-0x000002354E188000-memory.dmp
memory/3084-24-0x00000191E9980000-0x00000191E9CF6000-memory.dmp
memory/3084-16-0x00000191E8D60000-0x00000191E8D72000-memory.dmp
memory/3084-17-0x00000191E8CB0000-0x00000191E8CC0000-memory.dmp
memory/3084-15-0x00000191E9620000-0x00000191E962C000-memory.dmp
memory/3084-13-0x00000191E8CB0000-0x00000191E8CC0000-memory.dmp