Analysis
- user interaction
yes - max time kernel
1799s - max time network
1797s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
15/07/2026, 15:54
General
- Target ratonClient.exe
- Size 2.4MB
- Sample260715-tcbexabv5v
- SHA256 beb43ff61fe6eeb97da646bdf2ff5854ddaac0d5150e0679041efc352e81df10
Malware Config
Extracted
-
ratonrat
-
Professional
-
tcp.niceports.shop:22051
-
wSrVEGlxMuTTbwDdfC2z8kO
-
assist
false
-
box
false
-
box_icon
Error
-
box_msg
I'm the message box description
-
box_title
Hello World
-
defender
true
-
delay
0
-
hide_file
true
-
open_website
false
-
password
t.me/junk_code
-
process_critical
false
-
raw
silly21
-
reconnect
3
-
startup
true
-
tag
Infected
-
uac
false
-
vm
true
-
website
https://t.me/example
Signatures
- Family: RatonRAT
RatonRAT is an information stealer written in C#.
- Detects RatonRAT payload 2 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 2 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies data under HKEY_USERS 11 IoCs
- Modifies registry class 42 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 52 IoCs
- Suspicious use of SendNotifyMessage 63 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 33 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\System32\WUDFHost.exe"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-b19ee237-6d80-4a82-ac5c-2715a1b63df8 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-835ca961-7c3a-4366-b5c9-e6811f6a7534 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-1550fb83-2de1-4ea9-848f-5de262d2767d -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-3b302835-b2f6-4617-8ab2-931b8f4be6b2 -LifetimeId:7583900f-36c4-41b4-bad3-1737d7891390 -DeviceGroupId:WudfDefaultDevicePool -HostArg:01⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\ctfmon.exe/QuitInfo:0000000000000268;000000000000026C;1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"1⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Local\Temp\ratonClient.exe"C:\Users\Admin\AppData\Local\Temp\ratonClient.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\cleanup_Sg02rnTLO6whfrRo1xpoHYhbTgicQC.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak3⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe"C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe"3⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass "Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "ratonClient" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe\"" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c netsh wlan show profiles4⤵
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh wlan show profiles5⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\я гей_2QY.txt4⤵
-
-
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak3⤵
- Delays execution with timeout.exe
-
-
-
C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe"C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\smartscreen.exeC:\Windows\System32\smartscreen.exe -Embedding1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004D01⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:Global.Accounts.AppXqe94epy97qwa6w3j6w132e8zvcs117nd.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:OobeHost.AppXdcwkjpb46w3zw4hbmx5jfxajhymjka0d.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:Global.RulesEngine.AppXgphnekvm0vv49drvfehh4b6kyf6ckafp.mca1⤵
- Modifies registry class
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:WebExperienceHost.AppXt2rk6m02ana976jna04hdq35jfnzy7f7.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
aforge.dll
aforge.video.directshow.dll
aforge.video.dll
costura.dll
microsoft.win32.registry.dll
naudio.asio.dll
naudio.core.dll
naudio.dll
naudio.midi.dll
naudio.wasapi.dll
naudio.winforms.dll
naudio.winmm.dll
newtonsoft.json.dll
stuff.dll
system.buffers.dll
system.memory.dll
system.numerics.vectors.dll
system.resources.extensions.dll
system.runtime.compilerservices.unsafe.dll
system.security.accesscontrol.dll
system.security.principal.windows.dll
я гей_2QY.txt
ratonClient.exe
cleanup_Sg02rnTLO6whfrRo1xpoHYhbTgicQC.bat
memory/412-388-0x00000117DC860000-0x00000117DC882000-memory.dmp
memory/412-380-0x00000117DC860000-0x00000117DC882000-memory.dmp
memory/412-387-0x00000117DC860000-0x00000117DC882000-memory.dmp
memory/412-386-0x00000117DC860000-0x00000117DC882000-memory.dmp
memory/412-385-0x00000117DC860000-0x00000117DC882000-memory.dmp
memory/692-375-0x000001C0B9E60000-0x000001C0B9E82000-memory.dmp
memory/692-368-0x000001C0B9E60000-0x000001C0B9E82000-memory.dmp
memory/692-373-0x000001C0B9E60000-0x000001C0B9E82000-memory.dmp
memory/692-376-0x000001C0B9E60000-0x000001C0B9E82000-memory.dmp
memory/692-374-0x000001C0B9E60000-0x000001C0B9E82000-memory.dmp
memory/1004-308-0x0000000000FC0000-0x0000000000FE2000-memory.dmp
memory/1004-302-0x0000000000FC0000-0x0000000000FE2000-memory.dmp
memory/1004-307-0x0000000000FC0000-0x0000000000FE2000-memory.dmp
memory/1004-309-0x0000000000FC0000-0x0000000000FE2000-memory.dmp
memory/1004-310-0x0000000000FC0000-0x0000000000FE2000-memory.dmp
memory/2760-405-0x000001FDDF510000-0x000001FDDF532000-memory.dmp
memory/3000-351-0x000001A95E550000-0x000001A95E572000-memory.dmp
memory/3000-354-0x000001A95E550000-0x000001A95E572000-memory.dmp
memory/3000-346-0x000001A95E550000-0x000001A95E572000-memory.dmp
memory/3000-352-0x000001A95E550000-0x000001A95E572000-memory.dmp
memory/3000-353-0x000001A95E550000-0x000001A95E572000-memory.dmp
memory/3748-402-0x0000017275A20000-0x0000017275A42000-memory.dmp
memory/3748-399-0x0000017275A20000-0x0000017275A42000-memory.dmp
memory/3748-394-0x0000017275A20000-0x0000017275A42000-memory.dmp
memory/3748-401-0x0000017275A20000-0x0000017275A42000-memory.dmp
memory/3748-400-0x0000017275A20000-0x0000017275A42000-memory.dmp
memory/3992-340-0x000001BA06DA0000-0x000001BA06DC2000-memory.dmp
memory/3992-342-0x000001BA06DA0000-0x000001BA06DC2000-memory.dmp
memory/3992-341-0x000001BA06DA0000-0x000001BA06DC2000-memory.dmp
memory/3992-335-0x000001BA06DA0000-0x000001BA06DC2000-memory.dmp
memory/3992-343-0x000001BA06DA0000-0x000001BA06DC2000-memory.dmp
memory/4356-357-0x000001AB8B0F0000-0x000001AB8B112000-memory.dmp
memory/4356-362-0x000001AB8B0F0000-0x000001AB8B112000-memory.dmp
memory/4356-363-0x000001AB8B0F0000-0x000001AB8B112000-memory.dmp
memory/4356-365-0x000001AB8B0F0000-0x000001AB8B112000-memory.dmp
memory/4356-364-0x000001AB8B0F0000-0x000001AB8B112000-memory.dmp
memory/4408-332-0x0000020B13410000-0x0000020B13432000-memory.dmp
memory/4408-329-0x0000020B13410000-0x0000020B13432000-memory.dmp
memory/4408-324-0x0000020B13410000-0x0000020B13432000-memory.dmp
memory/4408-330-0x0000020B13410000-0x0000020B13432000-memory.dmp
memory/4408-331-0x0000020B13410000-0x0000020B13432000-memory.dmp
memory/4652-88-0x0000026367990000-0x000002636799A000-memory.dmp
memory/4652-87-0x0000026367BD0000-0x0000026367C82000-memory.dmp
memory/4652-86-0x00000263679A0000-0x00000263679BE000-memory.dmp
memory/4652-81-0x0000026367810000-0x0000026367832000-memory.dmp
memory/4672-282-0x0000020BB3380000-0x0000020BB339D000-memory.dmp
memory/4672-313-0x0000020BB33A0000-0x0000020BB33C2000-memory.dmp
memory/4672-318-0x0000020BB33A0000-0x0000020BB33C2000-memory.dmp
memory/4672-319-0x0000020BB33A0000-0x0000020BB33C2000-memory.dmp
memory/4672-321-0x0000020BB33A0000-0x0000020BB33C2000-memory.dmp
memory/4672-320-0x0000020BB33A0000-0x0000020BB33C2000-memory.dmp
memory/4904-279-0x0000000180000000-0x0000000180022000-memory.dmp
memory/4904-90-0x0000015862C60000-0x0000015862C6A000-memory.dmp
memory/4904-272-0x0000000180000000-0x0000000180022000-memory.dmp
memory/4904-270-0x0000015863C20000-0x0000015863C32000-memory.dmp
memory/4904-269-0x0000015863E20000-0x0000015863E34000-memory.dmp
memory/4904-268-0x0000015863E40000-0x0000015863E74000-memory.dmp
memory/4904-267-0x0000015863DF0000-0x0000015863DF8000-memory.dmp
memory/4904-94-0x0000015863020000-0x000001586303A000-memory.dmp
memory/4904-96-0x0000015863BB0000-0x0000015863C00000-memory.dmp
memory/4904-280-0x0000000180000000-0x0000000180022000-memory.dmp
memory/4904-91-0x00000158630E0000-0x0000015863194000-memory.dmp
memory/4904-271-0x0000015863ED0000-0x0000015863EFC000-memory.dmp
memory/4904-451-0x0000015863DC0000-0x0000015863DCE000-memory.dmp
memory/4904-95-0x00000158633E0000-0x0000015863422000-memory.dmp
memory/4904-93-0x0000015863060000-0x0000015863092000-memory.dmp
memory/4904-278-0x0000000180000000-0x0000000180022000-memory.dmp
memory/4904-281-0x0000000180000000-0x0000000180022000-memory.dmp
memory/4988-294-0x000001CCD6F20000-0x000001CCD6F42000-memory.dmp
memory/4988-286-0x000001CCD6F20000-0x000001CCD6F42000-memory.dmp
memory/4988-291-0x000001CCD6F20000-0x000001CCD6F42000-memory.dmp
memory/4988-292-0x000001CCD6F20000-0x000001CCD6F42000-memory.dmp
memory/4988-293-0x000001CCD6F20000-0x000001CCD6F42000-memory.dmp
memory/4988-285-0x000001CCD6F20000-0x000001CCD6F42000-memory.dmp
memory/5036-27-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
memory/5036-58-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
memory/5036-1-0x0000020B56770000-0x0000020B569E6000-memory.dmp
memory/5036-0-0x00007FFB7947F000-0x00007FFB79480000-memory.dmp
memory/5036-2-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
memory/5036-26-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
memory/5036-48-0x0000020B71180000-0x0000020B7118A000-memory.dmp
memory/5036-57-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
memory/5612-128-0x000001F5801E0000-0x000001F5802E0000-memory.dmp
memory/5612-160-0x000001F5946B0000-0x000001F5946D0000-memory.dmp
memory/5612-134-0x000001F582E10000-0x000001F582F10000-memory.dmp
memory/5612-133-0x000001F5828D0000-0x000001F5828F0000-memory.dmp
memory/5612-127-0x000001F5801E0000-0x000001F5802E0000-memory.dmp
memory/5612-150-0x000001F582C30000-0x000001F582C50000-memory.dmp