Analysis
- max time kernel
58s - max time network
60s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
23/07/2026, 19:21
General
- Target 9a22b9b833b1048edc16f3bf8176ae0d5ded3a36bb43ffdc1bfe9ed8fc367374.exe
- Size 2.4MB
- Sample260723-x2sbhatwf1
- SHA256 9a22b9b833b1048edc16f3bf8176ae0d5ded3a36bb43ffdc1bfe9ed8fc367374
Malware Config
Extracted
-
ratonrat
-
Professional
-
tcp.niceports.shop:28745
-
2C8GCmvzxTN9kfLzOqXRhWk
-
assist
true
-
box
false
-
box_icon
Error
-
box_msg
I'm the message box description
-
box_title
Hello World
-
defender
false
-
delay
0
-
hide_file
true
-
open_website
false
-
password
t.me/junk_code
-
process_critical
false
-
raw
silly21
-
reconnect
3
-
startup
true
-
tag
Infected
-
uac
true
-
vm
false
-
website
https://t.me/example
Signatures
- Family: RatonRAT
RatonRAT is an information stealer written in C#.
- Detects RatonRAT payload 2 IoCs
- Executes dropped EXE 2 IoCs
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Delays execution with timeout.exe 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a22b9b833b1048edc16f3bf8176ae0d5ded3a36bb43ffdc1bfe9ed8fc367374.exe"C:\Users\Admin\AppData\Local\Temp\9a22b9b833b1048edc16f3bf8176ae0d5ded3a36bb43ffdc1bfe9ed8fc367374.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\cleanup_ZV6CDkbTiAr9Ke5M90tgM3AoEKBTBM.bat""2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak3⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\PlatformRuntime\9a22b9b833b1048edc16f3bf8176ae0d5ded3a36bb43ffdc1bfe9ed8fc367374.exe"C:\Users\Admin\AppData\Roaming\PlatformRuntime\9a22b9b833b1048edc16f3bf8176ae0d5ded3a36bb43ffdc1bfe9ed8fc367374.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "9a22b9b833b1048edc16f3bf8176ae0d5ded3a36bb43ffdc1bfe9ed8fc367374" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Roaming\PlatformRuntime\9a22b9b833b1048edc16f3bf8176ae0d5ded3a36bb43ffdc1bfe9ed8fc367374.exe\"" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak3⤵
- Delays execution with timeout.exe
-
-
-
C:\Users\Admin\AppData\Roaming\PlatformRuntime\9a22b9b833b1048edc16f3bf8176ae0d5ded3a36bb43ffdc1bfe9ed8fc367374.exe"C:\Users\Admin\AppData\Roaming\PlatformRuntime\9a22b9b833b1048edc16f3bf8176ae0d5ded3a36bb43ffdc1bfe9ed8fc367374.exe"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
aforge.dll
aforge.video.directshow.dll
aforge.video.dll
costura.dll
microsoft.win32.registry.dll
naudio.asio.dll
naudio.core.dll
naudio.dll
naudio.midi.dll
naudio.wasapi.dll
naudio.winforms.dll
naudio.winmm.dll
newtonsoft.json.dll
stuff.dll
system.buffers.dll
system.memory.dll
system.numerics.vectors.dll
system.resources.extensions.dll
system.runtime.compilerservices.unsafe.dll
system.security.accesscontrol.dll
system.security.principal.windows.dll
9a22b9b833b1048edc16f3bf8176ae0d5ded3a36bb43ffdc1bfe9ed8fc367374.exe
cleanup_ZV6CDkbTiAr9Ke5M90tgM3AoEKBTBM.bat
memory/1848-87-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
memory/1848-88-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
memory/1848-86-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
memory/1848-85-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
memory/1848-62-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
memory/1848-63-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
memory/1848-92-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
memory/1848-90-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
memory/1848-89-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
memory/3012-38-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
memory/3012-35-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
memory/3012-4-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
memory/3012-3-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
memory/3012-2-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
memory/3012-1-0x000002399D250000-0x000002399D4C6000-memory.dmp
memory/3012-0-0x00007FFB0BAEF000-0x00007FFB0BAF0000-memory.dmp
memory/3012-50-0x00000239B7C60000-0x00000239B7C6A000-memory.dmp
memory/3012-59-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp
memory/3012-60-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp