ratonrat | 551b7dc8f7962b953895db71d1d02ba75993f08f080093d4022d6abf1d6a5532

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Steam.exe
Size 3.5MB
Sample260629-rtx9wsfw91
SHA256 551b7dc8f7962b953895db71d1d02ba75993f08f080093d4022d6abf1d6a5532
MD5 232f3e506ab6fceea3ec5a24354b0e50
SHA1 5353dea996d281e5847257fe9f0ec3605adcc469
SHA512 c08df3ede98187b1d6fc09f850930ff6f77534232b14c099c90732fb11a91fdc280a3a7aa131025dd6d6c9590e48d375f93900fa5b698a6df30e9b96fc9662bd
SSDEEP 49152:qmu4tq0WgVUlsHjkmiGWU5+5WeLGpMZ7iKPNgo9sv:Pq0WgVUuHjkDGjYQeqpgmltv
TLSH
T16806CF417BD0CE1BE19F87B6B4F2021057B5EC15A796E70B2E90BAAC1CB37445E1839B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

costura defense_evasion execution ratonrat packer persistence stealer

Malware Config

Extracted

Family

ratonrat

Version

v4.0.0

ports.crabdance.com:20213

Mutex

LzyPt4WF0EbG2dfH1JqsEiE

Attributes

assist
false
box
false
box_icon
Error
box_msg
I'm the message box description
box_title
Hello World
defender
true
delay
0
hide_file
true
open_website
false
process_critical
true
raw
silly21
reconnect
3
startup
true
tag
kupil
uac
false
vm
false
website
https://t.me/example

Signatures

Family: RatonRAT
RatonRAT is an information stealer written in C#.
stealer ratonrat

Detects RatonRAT payload 2 IoCs

resource	yara_rule
behavioral2/memory/1180-1-0x0000027CA50F0000-0x0000027CA547C000-memory.dmp	family_ratonrat
behavioral2/files/0x000e00000001c52f-9.dat	family_ratonrat

Executes dropped EXE 2 IoCs

pid	Process
5808	Steam.exe
7044	Steam.exe

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral2/files/0x000e00000001c52f-9.dat	costura

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
5544	timeout.exe
5824	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3864	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5808	Steam.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 6644	1180	Steam.exe	88
PID 6644 wrote to memory of 5520	6644	cmd.exe	90
PID 6644 wrote to memory of 5544	6644	cmd.exe	91
PID 6644 wrote to memory of 5808	6644	cmd.exe	92
PID 6644 wrote to memory of 5824	6644	cmd.exe	93
PID 5808 wrote to memory of 3864	5808	Steam.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Steam.exe
"C:\Users\Admin\AppData\Local\Temp\Steam.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\cleanup_0jSt7BAPWqCTZ9VExdniLDxbzuaVGp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6644
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:5520
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5544
- - C:\Users\Admin\AppData\Roaming\PlatformRuntime\Steam.exe
    "C:\Users\Admin\AppData\Roaming\PlatformRuntime\Steam.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5808
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Steam" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Roaming\PlatformRuntime\Steam.exe\"" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3864
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5824

C:\Users\Admin\AppData\Roaming\PlatformRuntime\Steam.exe
"C:\Users\Admin\AppData\Roaming\PlatformRuntime\Steam.exe"
1⤵
- Executes dropped EXE
PID:7044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Steam.exe

Path C:\Users\Admin\AppData\Roaming\PlatformRuntime\Steam.exe
Size 3.5MB
SHA256 551b7dc8f7962b953895db71d1d02ba75993f08f080093d4022d6abf1d6a5532
MD5 232f3e506ab6fceea3ec5a24354b0e50
SHA1 5353dea996d281e5847257fe9f0ec3605adcc469
SHA512 c08df3ede98187b1d6fc09f850930ff6f77534232b14c099c90732fb11a91fdc280a3a7aa131025dd6d6c9590e48d375f93900fa5b698a6df30e9b96fc9662bd
SSDEEP 49152:qmu4tq0WgVUlsHjkmiGWU5+5WeLGpMZ7iKPNgo9sv:Pq0WgVUuHjkDGjYQeqpgmltv
TLSH
T16806CF417BD0CE1BE19F87B6B4F2021057B5EC15A796E70B2E90BAAC1CB37445E1839B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cleanup_0jSt7BAPWqCTZ9VExdniLDxbzuaVGp.bat

Path C:\Users\Admin\AppData\Roaming\Temp\cleanup_0jSt7BAPWqCTZ9VExdniLDxbzuaVGp.bat
Size 522B
SHA256 f8bcbca78ac53b8e9b5541435f9e561c185b4a04e1655e6102113de24e7af25e
MD5 7b96ce7ef7580071b4ddb526b730ece9
SHA1 c2e89a8f01b7ead4b16c01d4665cf2aadc9a9d13
SHA512 1071fa81ac14a91d821ed943d8084cd6c088548d89ad045ce4ab128b260230030d427c98297d0529a2f49564d97be63821a095147b7b1a26712e198c850cf8ec
TLSH
T10EF0E90A228E43692410617B0EFB318EC1E5449B7F897A533B14C81B1B9645BA6D37D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1180-0-0x00007FFD2A16F000-0x00007FFD2A170000-memory.dmp

Download

memory/1180-1-0x0000027CA50F0000-0x0000027CA547C000-memory.dmp

Download

memory/1180-2-0x0000027CA58E0000-0x0000027CA58E8000-memory.dmp

Download

memory/1180-5-0x00007FFD29FE0000-0x00007FFD2A984000-memory.dmp

Download

memory/1180-6-0x00007FFD29FE0000-0x00007FFD2A984000-memory.dmp

Download

memory/1180-8-0x00007FFD29FE0000-0x00007FFD2A984000-memory.dmp

Download

memory/5808-10-0x00007FFD29FE0000-0x00007FFD2A984000-memory.dmp

Download

memory/5808-11-0x00007FFD29FE0000-0x00007FFD2A984000-memory.dmp

Download

memory/5808-12-0x00007FFD29FE0000-0x00007FFD2A984000-memory.dmp

Download

memory/5808-13-0x00007FFD29FE0000-0x00007FFD2A984000-memory.dmp

Download

memory/5808-14-0x00007FFD29FE0000-0x00007FFD2A984000-memory.dmp

Download

memory/5808-15-0x00007FFD29FE0000-0x00007FFD2A984000-memory.dmp

Download

memory/5808-16-0x00007FFD29FE0000-0x00007FFD2A984000-memory.dmp

Download

memory/5808-18-0x00007FFD29FE0000-0x00007FFD2A984000-memory.dmp

Download

memory/5808-19-0x00007FFD29FE0000-0x00007FFD2A984000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads