ratonrat | 6588536328bdb7dee32d273c13a5ee1928632caaf206f58abf347c3ccdac2968

Analysis

user interaction
yes
max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 12:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MINTED HACKING GUIDE AND TOOLS.exe
Size 594KB
Sample260722-pwcd4avfph
SHA256 6588536328bdb7dee32d273c13a5ee1928632caaf206f58abf347c3ccdac2968
MD5 914de4d7ef9b230363a414082ef5b806
SHA1 f342dfbc853ee6c6c064ea4718ab1b89c8adba28
SHA512 d1fc3065763c889cd8a48f8ebe2aa3baf92b6e5db201829fcdbee84e887097bac6f61825d0184029f64cf01a10f9c12d95a54664caea07a86e181e2f2636af50
SSDEEP 12288:7ErR3374rIkzE7tnXknXQaBFJi4RkTAJ0MK86WoLb66OPfD9piItqr:yL4kkA7lXkXDDuAOFhWSApif
TLSH
T1D4D40204B7FC3605F7BECB3E59F090480FB6B2934A60D21C9D82D4AA1675B429964FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

costura defense_evasion execution ratonrat packer persistence stealer

Malware Config

Extracted

Family

ratonrat

Version

Free

s7yhs0kdub.localto.net:4383

Mutex

yBhFY7pSws4MAg5YAFnln9r

Attributes

assist
false
box
true
box_icon
Information
box_msg
HACKING TOOLS OPENING
box_title
Hello
defender
true
delay
0
hide_file
true
open_website
false
process_critical
true
raw
silly21
reconnect
3
startup
true
tag
Infected
uac
false
vm
true
website
https://t.me/sillyisafed

Signatures

Family: RatonRAT
RatonRAT is an information stealer written in C#.
stealer ratonrat

Detects RatonRAT payload 2 IoCs

resource	yara_rule
behavioral2/memory/6324-1-0x000002322AE10000-0x000002322AEAA000-memory.dmp	family_ratonrat
behavioral2/files/0x000e00000001c484-10.dat	family_ratonrat

Executes dropped EXE 2 IoCs

pid	Process
4420	MINTED HACKING GUIDE AND TOOLS.exe
7144	MINTED HACKING GUIDE AND TOOLS.exe

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral2/files/0x000e00000001c484-10.dat	costura

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3120	cmd.exe

Delays execution with timeout.exe 3 IoCs

defense_evasion

pid	Process
3516	timeout.exe
4228	timeout.exe
1404	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4048	schtasks.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6324 wrote to memory of 3120	6324	MINTED HACKING GUIDE AND TOOLS.exe	90
PID 3120 wrote to memory of 4764	3120	cmd.exe	92
PID 3120 wrote to memory of 3516	3120	cmd.exe	93
PID 3120 wrote to memory of 4228	3120	cmd.exe	94
PID 3120 wrote to memory of 4420	3120	cmd.exe	95
PID 3120 wrote to memory of 1404	3120	cmd.exe	96
PID 4420 wrote to memory of 4048	4420	MINTED HACKING GUIDE AND TOOLS.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\MINTED HACKING GUIDE AND TOOLS.exe
"C:\Users\Admin\AppData\Local\Temp\MINTED HACKING GUIDE AND TOOLS.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\cleanup_UXu421hqHuFsppSzt9jC2CHgFFXAaQ.bat""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3120
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4764
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3516
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4228
- - C:\Users\Admin\AppData\Roaming\PlatformRuntime\MINTED HACKING GUIDE AND TOOLS.exe
    "C:\Users\Admin\AppData\Roaming\PlatformRuntime\MINTED HACKING GUIDE AND TOOLS.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4420
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "MINTED HACKING GUIDE AND TOOLS" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Roaming\PlatformRuntime\MINTED HACKING GUIDE AND TOOLS.exe\"" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4048
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1404

C:\Users\Admin\AppData\Roaming\PlatformRuntime\MINTED HACKING GUIDE AND TOOLS.exe
"C:\Users\Admin\AppData\Roaming\PlatformRuntime\MINTED HACKING GUIDE AND TOOLS.exe"
1⤵
- Executes dropped EXE
PID:7144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MINTED HACKING GUIDE AND TOOLS.exe

Path C:\Users\Admin\AppData\Roaming\PlatformRuntime\MINTED HACKING GUIDE AND TOOLS.exe
Size 594KB
SHA256 6588536328bdb7dee32d273c13a5ee1928632caaf206f58abf347c3ccdac2968
MD5 914de4d7ef9b230363a414082ef5b806
SHA1 f342dfbc853ee6c6c064ea4718ab1b89c8adba28
SHA512 d1fc3065763c889cd8a48f8ebe2aa3baf92b6e5db201829fcdbee84e887097bac6f61825d0184029f64cf01a10f9c12d95a54664caea07a86e181e2f2636af50
SSDEEP 12288:7ErR3374rIkzE7tnXknXQaBFJi4RkTAJ0MK86WoLb66OPfD9piItqr:yL4kkA7lXkXDDuAOFhWSApif
TLSH
T1D4D40204B7FC3605F7BECB3E59F090480FB6B2934A60D21C9D82D4AA1675B429964FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cleanup_UXu421hqHuFsppSzt9jC2CHgFFXAaQ.bat

Path C:\Users\Admin\AppData\Roaming\Temp\cleanup_UXu421hqHuFsppSzt9jC2CHgFFXAaQ.bat
Size 622B
SHA256 e8feb97576619659544c2c85c7fe560bc47c0c36fd1eba66c8d1ee9198b21cb1
MD5 e573d4b074c9e759f3bb384cc0ae1b1b
SHA1 05e1427e03ed367bcc0f5400fc7934107aaa6a37
SHA512 dd7c2adef24e6a8dfa705d462be00f3c297cd2cb9882923746d1b173631e785acbc2d554e9cf37732f6c54bf55bc1919fad8dede484602559e269c8c89b7bfe2
TLSH
T14DF04406A2CB8718100095371AB3B0CC91EA40DAFE97F6213A30C46A579680BA2D3382
MD5 SHA1 SHA512 TLSH

Submit Download

memory/6324-0-0x00007FF9353AF000-0x00007FF9353B0000-memory.dmp

Download

memory/6324-1-0x000002322AE10000-0x000002322AEAA000-memory.dmp

Download

memory/6324-2-0x000002322CAD0000-0x000002322CADA000-memory.dmp

Download

memory/6324-3-0x00007FF935220000-0x00007FF935BC4000-memory.dmp

Download

memory/6324-4-0x00007FF935220000-0x00007FF935BC4000-memory.dmp

Download

memory/6324-7-0x00007FF935220000-0x00007FF935BC4000-memory.dmp

Download

memory/6324-9-0x00007FF935220000-0x00007FF935BC4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads