Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
28/06/2026, 02:23
General
- Target ratonClient.exe
- Size 2.4MB
- Sample260628-ct65gaez2r
- SHA256 3d58e27112df639a1aa3cf02f2b38d1229869e3305d5d0dfc608409823723a33
Malware Config
Extracted
-
ratonrat
-
Free
-
vylnjuowp0.localto.net:2475
-
NC40N2Cf8GJlOkiIp0ux6Pz
-
assist
false
-
box
true
-
box_icon
Error
-
box_msg
Unable to connect to
-
box_title
Error: 1051
-
defender
true
-
delay
0
-
hide_file
true
-
open_website
false
-
process_critical
true
-
reconnect
3
-
startup
true
-
tag
Infected
-
uac
false
-
vm
false
-
website
https://t.me/sillyisafed
Signatures
- Family: RatonRAT
RatonRAT is an information stealer written in C#.
- Detects RatonRAT payload 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 2 IoCs
- Delays execution with timeout.exe 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 53 IoCs
- Suspicious use of AdjustPrivilegeToken 24 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ratonClient.exe"C:\Users\Admin\AppData\Local\Temp\ratonClient.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\cleanup_3NkIqjdDSyW0Ftuwfq6ZNWVEaTph0j.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak3⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe"C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass "Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "ratonClient" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe\"" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak3⤵
- Delays execution with timeout.exe
-
-
-
C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe"C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
aforge.dll
aforge.video.directshow.dll
aforge.video.dll
costura.dll
microsoft.win32.registry.dll
naudio.asio.dll
naudio.core.dll
naudio.dll
naudio.midi.dll
naudio.wasapi.dll
naudio.winforms.dll
naudio.winmm.dll
newtonsoft.json.dll
stuff.dll
system.buffers.dll
system.memory.dll
system.numerics.vectors.dll
system.resources.extensions.dll
system.runtime.compilerservices.unsafe.dll
system.security.accesscontrol.dll
system.security.principal.windows.dll
ratonClient.exe
cleanup_3NkIqjdDSyW0Ftuwfq6ZNWVEaTph0j.bat
memory/3244-84-0x000001D9EAE50000-0x000001D9EAE72000-memory.dmp
memory/3244-88-0x000001D9EAEE0000-0x000001D9EAF92000-memory.dmp
memory/3244-89-0x000001D9EB1B0000-0x000001D9EB1BA000-memory.dmp
memory/3244-91-0x000001D9EB410000-0x000001D9EB500000-memory.dmp
memory/3244-87-0x000001D9EAEC0000-0x000001D9EAEDE000-memory.dmp
memory/5856-48-0x00000167D13B0000-0x00000167D13BA000-memory.dmp
memory/5856-24-0x00007FF8F92A0000-0x00007FF8F9C44000-memory.dmp
memory/5856-11-0x00007FF8F92A0000-0x00007FF8F9C44000-memory.dmp
memory/5856-1-0x00000167B69D0000-0x00000167B6C3A000-memory.dmp
memory/5856-37-0x00007FF8F92A0000-0x00007FF8F9C44000-memory.dmp
memory/5856-0-0x00007FF8F942F000-0x00007FF8F9430000-memory.dmp
memory/5856-56-0x00007FF8F92A0000-0x00007FF8F9C44000-memory.dmp
memory/5856-58-0x00007FF8F92A0000-0x00007FF8F9C44000-memory.dmp
memory/5856-59-0x00007FF8F92A0000-0x00007FF8F9C44000-memory.dmp