ratonrat | 50a9a81ff3113e95604bf7b5de547edd9886477d0a1d57d7a644c25e35dbf89b

Analysis

user interaction
yes
max time kernel
899s
max time network
902s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HELLA TUFF COMBLOX SCRIPT.exe
Size 594KB
Sample260720-ppgp8sas9m
SHA256 50a9a81ff3113e95604bf7b5de547edd9886477d0a1d57d7a644c25e35dbf89b
MD5 29816d62b8b92f06063d8c97e7f198ea
SHA1 3bb5d7c2c8ba765e0bd0b23278617954f6569538
SHA512 4966845cff0beee5af590f9c330ac2720e64b9376232f4b9d464546ff87237ab6fb61b61a8e69ad289999f29230797aa79019adcf5014d1adcc8cc968262dd4c
SSDEEP 12288:4BaR3374rIkzE7tnXknXQaBFJi4RkTAJ0MK86WoLb66OPfD9piIJ/BUD:tL4kkA7lXkXDDuAOFhWSApicB+
TLSH
T121D40204B7FD3715E6BE8B3E5DF090480F72B2A38A20E25C5D83D0A91675B429D64FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

costura defense_evasion execution ratonrat packer persistence stealer

Malware Config

Extracted

Family

ratonrat

Version

Free

s7yhs0kdub.localto.net:4512

Mutex

i1rtLUlC9e0iLJsR53Nsq15

Attributes

assist
false
box
false
box_icon
No icon
box_msg
Hello, i'm the description of your raton client message box
box_title
Hello, im a title for your message box
defender
true
delay
0
hide_file
true
open_website
false
process_critical
true
raw
silly21
reconnect
3
startup
true
tag
Infected
uac
false
vm
true
website
https://t.me/sillyisafed

Signatures

Family: RatonRAT
RatonRAT is an information stealer written in C#.
stealer ratonrat

Detects RatonRAT payload 2 IoCs

resource	yara_rule
behavioral2/memory/5544-1-0x000002415EDE0000-0x000002415EE7A000-memory.dmp	family_ratonrat
behavioral2/files/0x000e00000001c4ec-10.dat	family_ratonrat

Executes dropped EXE 2 IoCs

pid	Process
2160	HELLA TUFF COMBLOX SCRIPT.exe
1988	HELLA TUFF COMBLOX SCRIPT.exe

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral2/files/0x000e00000001c4ec-10.dat	costura

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4888	cmd.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
4680	timeout.exe
4528	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4228	schtasks.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5544 wrote to memory of 4888	5544	HELLA TUFF COMBLOX SCRIPT.exe	89
PID 4888 wrote to memory of 1444	4888	cmd.exe	91
PID 4888 wrote to memory of 4528	4888	cmd.exe	92
PID 4888 wrote to memory of 2160	4888	cmd.exe	93
PID 4888 wrote to memory of 4680	4888	cmd.exe	94
PID 2160 wrote to memory of 4228	2160	HELLA TUFF COMBLOX SCRIPT.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\HELLA TUFF COMBLOX SCRIPT.exe
"C:\Users\Admin\AppData\Local\Temp\HELLA TUFF COMBLOX SCRIPT.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\cleanup_JdgP3LSbsuNlz3el9XM67GMflZWifh.bat""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1444
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4528
- - C:\Users\Admin\AppData\Roaming\PlatformRuntime\HELLA TUFF COMBLOX SCRIPT.exe
    "C:\Users\Admin\AppData\Roaming\PlatformRuntime\HELLA TUFF COMBLOX SCRIPT.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2160
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "HELLA TUFF COMBLOX SCRIPT" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Roaming\PlatformRuntime\HELLA TUFF COMBLOX SCRIPT.exe\"" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4228
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4680

C:\Users\Admin\AppData\Roaming\PlatformRuntime\HELLA TUFF COMBLOX SCRIPT.exe
"C:\Users\Admin\AppData\Roaming\PlatformRuntime\HELLA TUFF COMBLOX SCRIPT.exe"
1⤵
- Executes dropped EXE
PID:1988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5796

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HELLA TUFF COMBLOX SCRIPT.exe

Path C:\Users\Admin\AppData\Roaming\PlatformRuntime\HELLA TUFF COMBLOX SCRIPT.exe
Size 594KB
SHA256 50a9a81ff3113e95604bf7b5de547edd9886477d0a1d57d7a644c25e35dbf89b
MD5 29816d62b8b92f06063d8c97e7f198ea
SHA1 3bb5d7c2c8ba765e0bd0b23278617954f6569538
SHA512 4966845cff0beee5af590f9c330ac2720e64b9376232f4b9d464546ff87237ab6fb61b61a8e69ad289999f29230797aa79019adcf5014d1adcc8cc968262dd4c
SSDEEP 12288:4BaR3374rIkzE7tnXknXQaBFJi4RkTAJ0MK86WoLb66OPfD9piIJ/BUD:tL4kkA7lXkXDDuAOFhWSApicB+
TLSH
T121D40204B7FD3715E6BE8B3E5DF090480F72B2A38A20E25C5D83D0A91675B429D64FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cleanup_JdgP3LSbsuNlz3el9XM67GMflZWifh.bat

Path C:\Users\Admin\AppData\Roaming\Temp\cleanup_JdgP3LSbsuNlz3el9XM67GMflZWifh.bat
Size 602B
SHA256 2c6a995eacf61f3d7f848d84f835138f55c3553002c90f5c75d1cff1c1ccae38
MD5 1ec094b76e4581fd34e6b0c4f0d6324d
SHA1 59499fde3cf380ae4624df48d52df95e200a242c
SHA512 7048fd13125b16de29db274074808a1c603f97bde51c50a077004ad18b133048a208820995117b072625ec9eae514e3959698f78ea088c21e118df653acb4d08
TLSH
T1CBF0C801328AC70E191055AB4EF6B0CCD19E98577E5977923B34C40A1773437A6D3793
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2160-11-0x00007FFCCC270000-0x00007FFCCCC14000-memory.dmp

Download

memory/2160-12-0x00007FFCCC270000-0x00007FFCCCC14000-memory.dmp

Download

memory/2160-13-0x00007FFCCC270000-0x00007FFCCCC14000-memory.dmp

Download

memory/2160-14-0x00007FFCCC270000-0x00007FFCCCC14000-memory.dmp

Download

memory/2160-15-0x00007FFCCC270000-0x00007FFCCCC14000-memory.dmp

Download

memory/2160-17-0x00007FFCCC270000-0x00007FFCCCC14000-memory.dmp

Download

memory/5544-3-0x0000024160AF0000-0x0000024160AFA000-memory.dmp

Download

memory/5544-6-0x00007FFCCC270000-0x00007FFCCCC14000-memory.dmp

Download

memory/5544-7-0x00007FFCCC270000-0x00007FFCCCC14000-memory.dmp

Download

memory/5544-2-0x00007FFCCC270000-0x00007FFCCCC14000-memory.dmp

Download

memory/5544-9-0x00007FFCCC270000-0x00007FFCCCC14000-memory.dmp

Download

memory/5544-1-0x000002415EDE0000-0x000002415EE7A000-memory.dmp

Download

memory/5544-0-0x00007FFCCC3FF000-0x00007FFCCC400000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads