Analysis
- user interaction
yes - max time kernel
149s - max time network
129s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
29/04/2026, 18:08
General
- Target ratonClientttest.exe
- Size 94KB
- Sample260429-wq897set2t
- SHA256 11bbb3a4b3122d2a9d97532db9e412fe5d70ab7ff25bb1613eccd2052cce8543
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 2 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Delays execution with timeout.exe 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ratonClientttest.exe"C:\Users\Admin\AppData\Local\Temp\ratonClientttest.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\cleanup_M5JrxL6zAdyWpQK5h3YhN7W9H4oXIb.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak3⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClientttest.exe"C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClientttest.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "ratonClientttest" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClientttest.exe\"" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass "Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClientttest.exe'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak3⤵
- Delays execution with timeout.exe
-
-
-
C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClientttest.exe"C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClientttest.exe"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ratonClientttest.exe.log
__PSScriptPolicyTest_ykjz1nwq.hsc.ps1
ratonClientttest.exe
cleanup_M5JrxL6zAdyWpQK5h3YhN7W9H4oXIb.bat
memory/1028-39-0x00000264B7230000-0x00000264B724A000-memory.dmp
memory/1028-41-0x00000264B7210000-0x00000264B7216000-memory.dmp
memory/1028-46-0x00000264B6B10000-0x00000264B6B22000-memory.dmp
memory/1028-45-0x000002649E7D0000-0x000002649E87F000-memory.dmp
memory/1028-42-0x00000264B7220000-0x00000264B722A000-memory.dmp
memory/1028-40-0x00000264B6EC0000-0x00000264B6EC8000-memory.dmp
memory/1028-38-0x00000264B6EB0000-0x00000264B6EBA000-memory.dmp
memory/1028-37-0x00000264B71F0000-0x00000264B720C000-memory.dmp
memory/1028-27-0x00000264B6BF0000-0x00000264B6C12000-memory.dmp
memory/1028-34-0x00000264B6E80000-0x00000264B6E9C000-memory.dmp
memory/1028-35-0x00000264B6EE0000-0x00000264B6F93000-memory.dmp
memory/1028-36-0x00000264B6EA0000-0x00000264B6EAA000-memory.dmp
memory/3088-1-0x00000223655F0000-0x0000022365600000-memory.dmp
memory/3088-0-0x00000223639C0000-0x00000223639DE000-memory.dmp
memory/3088-2-0x00000223655B0000-0x00000223655B8000-memory.dmp
memory/4892-20-0x000002024F380000-0x000002024F6F6000-memory.dmp
memory/4892-17-0x000002024EE00000-0x000002024EEAF000-memory.dmp
memory/4892-18-0x0000020234DC0000-0x0000020234DD2000-memory.dmp
memory/4892-19-0x0000020234D40000-0x0000020234D50000-memory.dmp
memory/4892-13-0x0000020234D40000-0x0000020234D50000-memory.dmp
memory/4892-49-0x000002024EF00000-0x000002024EF0A000-memory.dmp