Analysis
- user interaction
yes - max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
18/07/2026, 14:12
General
- Target catlavan client crack.exe
- Size 2.4MB
- Sample260718-rh9hsagx2v
- SHA256 268692fba422469d7a04d897549e9a05deed67c5497c7b6749165b22311b9513
Malware Config
Extracted
-
ratonrat
-
Professional
-
tcp.niceports.shop:20544
-
r1kAh6g5rM9IJnusHQUaMYY
-
assist
false
-
box
false
-
box_icon
Error
-
box_msg
I'm the message box description
-
box_title
Hello World
-
defender
false
-
delay
0
-
hide_file
false
-
open_website
false
-
password
t.me/junk_code
-
process_critical
false
-
raw
silly21
-
reconnect
3
-
startup
false
-
tag
Infected
-
uac
false
-
vm
false
-
website
https://t.me/example
Signatures
- Family: RatonRAT
RatonRAT is an information stealer written in C#.
- Detects RatonRAT payload 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 32 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\catlavan client crack.exe"C:\Users\Admin\AppData\Local\Temp\catlavan client crack.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
naudio.wasapi.dll
newtonsoft.json.dll
stuff.dll
system.buffers.dll
memory/5800-59-0x0000020D9B150000-0x0000020D9B15A000-memory.dmp
memory/5800-72-0x0000020D9B620000-0x0000020D9B642000-memory.dmp
memory/5800-45-0x00007FF880C50000-0x00007FF8815F4000-memory.dmp
memory/5800-50-0x0000020D9B0A0000-0x0000020D9B0AA000-memory.dmp
memory/5800-37-0x00007FF880C50000-0x00007FF8815F4000-memory.dmp
memory/5800-56-0x00007FF880C50000-0x00007FF8815F4000-memory.dmp
memory/5800-57-0x00007FF880C50000-0x00007FF8815F4000-memory.dmp
memory/5800-24-0x00007FF880C50000-0x00007FF8815F4000-memory.dmp
memory/5800-66-0x0000020D9B690000-0x0000020D9B744000-memory.dmp
memory/5800-2-0x00007FF880C50000-0x00007FF8815F4000-memory.dmp
memory/5800-1-0x0000020D806A0000-0x0000020D80916000-memory.dmp
memory/5800-43-0x00007FF880C50000-0x00007FF8815F4000-memory.dmp
memory/5800-0-0x00007FF880DDF000-0x00007FF880DE0000-memory.dmp
memory/5800-74-0x0000020D9B890000-0x0000020D9B8C2000-memory.dmp
memory/5800-80-0x0000020D9B670000-0x0000020D9B68A000-memory.dmp
memory/5800-81-0x00007FF880C50000-0x00007FF8815F4000-memory.dmp
memory/5800-82-0x0000020D9B920000-0x0000020D9B970000-memory.dmp
memory/5800-83-0x0000020D9B850000-0x0000020D9B892000-memory.dmp
memory/5800-84-0x00007FF880C50000-0x00007FF8815F4000-memory.dmp
memory/5800-85-0x00007FF880C50000-0x00007FF8815F4000-memory.dmp
memory/5800-86-0x00007FF880C50000-0x00007FF8815F4000-memory.dmp
memory/5800-87-0x00007FF880C50000-0x00007FF8815F4000-memory.dmp
memory/5800-88-0x00007FF880C50000-0x00007FF8815F4000-memory.dmp
memory/5800-89-0x00007FF880C50000-0x00007FF8815F4000-memory.dmp