Overview

overview

8

Static

static

3

Rat.exe

windows11-21h2-x64

Resubmissions

02/06/2026, 20:13

260602-yzlllsdx5w8

02/06/2026, 20:12

260602-yy4e2aez3r8

02/06/2026, 15:00

260602-sdsvxagt5s8

Analysis

  • user interaction
    yes
  • max time kernel
    8s
  • max time network
    9s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    02/06/2026, 20:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    Rat.exe
  • Size 207KB
  • Sample260602-yy4e2aez3r
  • SHA256 3e4a12aeb12d363d5366e622f6b07f7bdf233809bd9967100181eb32db5ebce1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistence

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 13 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 9 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Rat.exe
    "C:\Users\Admin\AppData\Local\Temp\Rat.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1276
    • C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1A3A.tmp\1A3B.tmp\1A3C.bat C:\Users\Admin\AppData\Local\Temp\Rat.exe"
      2⤵
      • NTFS ADS
      • Suspicious use of WriteProcessMemory
      PID:3472
      • C:\Windows\system32\taskkill.exe
        taskkill /f /im explorer.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1108
      • C:\Windows\system32\msg.exe
        msg * I added 60 .exe infected files on your desktop :)
        3⤵
          PID:4840
        • C:\Windows\system32\msg.exe
          msg * your files are infected
          3⤵
            PID:2248
          • C:\Windows\system32\msg.exe
            msg * alert virus
            3⤵
              PID:3280
            • C:\Windows\system32\msg.exe
              msg * press ok to restore your data
              3⤵
                PID:1412
              • C:\Windows\explorer.exe
                explorer
                3⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Enumerates connected drives
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:1680
              • C:\Windows\system32\shutdown.exe
                shutdown -r -t 1 -c "restoring your data..."
                3⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:3736
          • C:\Windows\system32\LogonUI.exe
            "LogonUI.exe" /flags:0x4 /state0:0xa3a20055 /state1:0x41c64e6d
            1⤵
            • Modifies data under HKEY_USERS
            • Suspicious use of SetWindowsHookEx
            PID:912
          • C:\Windows\System32\PickerHost.exe
            C:\Windows\System32\PickerHost.exe -Embedding
            1⤵
              PID:2152

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  1A3C.bat
                  • Path C:\Users\Admin\AppData\Local\Temp\1A3A.tmp\1A3B.tmp\1A3C.bat
                  • Size 3KB
                  • SHA256 92843bca43e27d48e21ab6b3ac4626c8b644e9906c50286950c98edca53a375f
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  4982.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\4982.exe
                  • Size 30B
                  • SHA256 eaf10016490d511567b091b4600255b411c80ac46bb89ec597cee89349898894
                  • MD5 SHA1 SHA512
                  Submit Download

                  Spam.exe
                  • Path C:\Users\Admin\Desktop\Spam.exe
                  • Size 91KB
                  • SHA256 99a0a5e4e63449c5e0caaa4f3ae888562f24de9b03be7ccf2e72a5f6d51a5523
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  memory/1276-0-0x0000000000417000-0x0000000000418000-memory.dmp
                  Download