Analysis
- max time kernel
164s - max time network
161s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
23/07/2026, 06:23
General
- Target file_77b5757ae75eb20b.exe
- Size 2.5MB
- Sample260723-g5ralsxtfy
- SHA256 c854317fdfc61855002f0cca0cba147c979a56878b8b211c5d512218877d680c
Malware Config
Extracted
-
ratonrat
-
Professional
-
16.170.169.119:8080
-
GPMEaht28D0drQKjxak6e0p
-
assist
false
-
box
false
-
box_icon
Error
-
box_msg
I'm the message box description
-
box_title
Hello World
-
defender
false
-
delay
0
-
hide_file
false
-
open_website
false
-
process_critical
false
-
raw
silly21
-
reconnect
3
-
startup
true
-
tag
Infected
-
uac
false
-
vm
false
-
website
https://t.me/example
Signatures
- Family: RatonRAT
RatonRAT is an information stealer written in C#.
- Detects RatonRAT payload 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file_77b5757ae75eb20b.exe"C:\Users\Admin\AppData\Local\Temp\file_77b5757ae75eb20b.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/700-0-0x0000000074CC2000-0x0000000074CC3000-memory.dmp
memory/700-1-0x0000000000D50000-0x0000000000FCE000-memory.dmp
memory/700-2-0x0000000005FC0000-0x000000000657A000-memory.dmp
memory/700-3-0x0000000005AD0000-0x0000000005B36000-memory.dmp
memory/700-4-0x0000000074CB0000-0x000000007546C000-memory.dmp
memory/700-5-0x0000000006780000-0x00000000069F6000-memory.dmp
memory/700-6-0x0000000074CC2000-0x0000000074CC3000-memory.dmp
memory/700-7-0x0000000074CB0000-0x000000007546C000-memory.dmp