ratonrat | 551b7dc8f7962b953895db71d1d02ba75993f08f080093d4022d6abf1d6a5532

Analysis

max time kernel
899s
max time network
901s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/06/2026, 19:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Steam.exe
Size 3.5MB
Sample260629-yfbbjadz2w
SHA256 551b7dc8f7962b953895db71d1d02ba75993f08f080093d4022d6abf1d6a5532
MD5 232f3e506ab6fceea3ec5a24354b0e50
SHA1 5353dea996d281e5847257fe9f0ec3605adcc469
SHA512 c08df3ede98187b1d6fc09f850930ff6f77534232b14c099c90732fb11a91fdc280a3a7aa131025dd6d6c9590e48d375f93900fa5b698a6df30e9b96fc9662bd
SSDEEP 49152:qmu4tq0WgVUlsHjkmiGWU5+5WeLGpMZ7iKPNgo9sv:Pq0WgVUuHjkDGjYQeqpgmltv
TLSH
T16806CF417BD0CE1BE19F87B6B4F2021057B5EC15A796E70B2E90BAAC1CB37445E1839B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

costura defense_evasion execution ratonrat packer persistence stealer

Malware Config

Extracted

Family

ratonrat

Version

v4.0.0

ports.crabdance.com:20213

Mutex

LzyPt4WF0EbG2dfH1JqsEiE

Attributes

assist
false
box
false
box_icon
Error
box_msg
I'm the message box description
box_title
Hello World
defender
true
delay
0
hide_file
true
open_website
false
process_critical
true
raw
silly21
reconnect
3
startup
true
tag
kupil
uac
false
vm
false
website
https://t.me/example

Signatures

Family: RatonRAT
RatonRAT is an information stealer written in C#.
stealer ratonrat

Detects RatonRAT payload 2 IoCs

resource	yara_rule
behavioral2/memory/2448-0-0x000001B03D900000-0x000001B03DC8C000-memory.dmp	family_ratonrat
behavioral2/files/0x002200000002b1f3-10.dat	family_ratonrat

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1564	powershell.exe
1564	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1100	Steam.exe
3700	Steam.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral2/files/0x002200000002b1f3-10.dat	costura

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
4904	timeout.exe
3612	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2960	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1564	powershell.exe
1564	powershell.exe
1100	Steam.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1100	Steam.exe
Token: SeDebugPrivilege	1100	Steam.exe
Token: SeDebugPrivilege	1564	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 1268	2448	Steam.exe	81
PID 1268 wrote to memory of 432	1268	cmd.exe	84
PID 1268 wrote to memory of 4904	1268	cmd.exe	85
PID 1268 wrote to memory of 1100	1268	cmd.exe	86
PID 1268 wrote to memory of 3612	1268	cmd.exe	87
PID 1100 wrote to memory of 2960	1100	Steam.exe	88
PID 1100 wrote to memory of 1564	1100	Steam.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Steam.exe
"C:\Users\Admin\AppData\Local\Temp\Steam.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\cleanup_xe0E018XcMLl6FEzSiBoLvFfXcyGvJ.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1268
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:432
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4904
- - C:\Users\Admin\AppData\Roaming\PlatformRuntime\Steam.exe
    "C:\Users\Admin\AppData\Roaming\PlatformRuntime\Steam.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1100
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Steam" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Roaming\PlatformRuntime\Steam.exe\"" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2960
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass "Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Roaming\PlatformRuntime\Steam.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1564
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3612

C:\Users\Admin\AppData\Roaming\PlatformRuntime\Steam.exe
"C:\Users\Admin\AppData\Roaming\PlatformRuntime\Steam.exe"
1⤵
- Executes dropped EXE
PID:3700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Steam.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Steam.exe.log
Size 859B
SHA256 a6f7d3892a001df1aafe2eaf221a3b09a4fdad23ad642a62b9cc50fd25f9415f
MD5 b80ab36515c0740685e38a5cd01e292a
SHA1 ebea40ce14021888f2c869576ad62b98b7c73c8a
SHA512 a9ad31c000c2264f8a9b7bac6bc60edd7ecf0d1c946a4bb3e57d824283c6b65e59344e834bcbf563586211078ddb895af13e4c697bea2c4a907982bbc5fbd4a0
TLSH
T1CE1166313376A0D889163F821C1E56C957BF4329A550AD08B998624DED3601B6B213E3
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_5syag53c.kyg.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5syag53c.kyg.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Steam.exe

Path C:\Users\Admin\AppData\Roaming\PlatformRuntime\Steam.exe
Size 3.5MB
SHA256 551b7dc8f7962b953895db71d1d02ba75993f08f080093d4022d6abf1d6a5532
MD5 232f3e506ab6fceea3ec5a24354b0e50
SHA1 5353dea996d281e5847257fe9f0ec3605adcc469
SHA512 c08df3ede98187b1d6fc09f850930ff6f77534232b14c099c90732fb11a91fdc280a3a7aa131025dd6d6c9590e48d375f93900fa5b698a6df30e9b96fc9662bd
SSDEEP 49152:qmu4tq0WgVUlsHjkmiGWU5+5WeLGpMZ7iKPNgo9sv:Pq0WgVUuHjkDGjYQeqpgmltv
TLSH
T16806CF417BD0CE1BE19F87B6B4F2021057B5EC15A796E70B2E90BAAC1CB37445E1839B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cleanup_xe0E018XcMLl6FEzSiBoLvFfXcyGvJ.bat

Path C:\Users\Admin\AppData\Roaming\Temp\cleanup_xe0E018XcMLl6FEzSiBoLvFfXcyGvJ.bat
Size 522B
SHA256 ad314b5e7656d69b33d36654564d36dc9014f83416d044481cf6bd0bcd34ef77
MD5 8fdcd04ec27a5c15d2e44163afaf44a4
SHA1 f149a8964b7d747718a65292dbbf786289896024
SHA512 c6a60ad8d7d880d797da807b53a4b011ba8db7878bdd0d85007f7226bcaaff752864f6e4239b3228e92e55dd5a2bba5ecde13b097ebc1742bb1177bbc7d1c26a
TLSH
T1AFF0590A228E83292410603B0FBF308EC0E5449B7F997B537B28C85B579244BE6D37D1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1100-17-0x0000020946BA0000-0x0000020946F16000-memory.dmp

Download

memory/1100-42-0x0000020946740000-0x0000020946750000-memory.dmp

Download

memory/1100-13-0x0000020946740000-0x0000020946750000-memory.dmp

Download

memory/1564-31-0x0000028E5C170000-0x0000028E5C18C000-memory.dmp

Download

memory/1564-23-0x0000028E5BEC0000-0x0000028E5BEE2000-memory.dmp

Download

memory/1564-32-0x0000028E5C200000-0x0000028E5C2B3000-memory.dmp

Download

memory/1564-33-0x0000028E5C150000-0x0000028E5C15A000-memory.dmp

Download

memory/1564-34-0x0000028E5C1B0000-0x0000028E5C1CC000-memory.dmp

Download

memory/1564-35-0x0000028E5C160000-0x0000028E5C16A000-memory.dmp

Download

memory/1564-36-0x0000028E5C1D0000-0x0000028E5C1EA000-memory.dmp

Download

memory/1564-37-0x0000028E5C190000-0x0000028E5C198000-memory.dmp

Download

memory/1564-38-0x0000028E5C1A0000-0x0000028E5C1A6000-memory.dmp

Download

memory/1564-39-0x0000028E5C510000-0x0000028E5C51A000-memory.dmp

Download

memory/2448-2-0x000001B03F970000-0x000001B03F978000-memory.dmp

Download

memory/2448-0-0x000001B03D900000-0x000001B03DC8C000-memory.dmp

Download

memory/2448-1-0x000001B059730000-0x000001B059740000-memory.dmp

Download