Analysis
- max time kernel
149s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
27/07/2026, 04:59
General
- Target Pot.exe
- Size 3.5MB
- Sample260727-fmlrqswale
- SHA256 d4a19d173398b559250956d1b1b7ae07e6c8fbb76c635d78f88b2d110a809c9a
Malware Config
Extracted
-
ratonrat
-
v4.0.0
-
jqylrmzn8r.localto.net:7090
-
HnV2YZWrek49QwDcph9Cz3C
-
assist
false
-
box
false
-
box_icon
No icon
-
box_msg
Hello, i'm the description of your raton client message box
-
box_title
Hello, im a title for your message box
-
defender
true
-
delay
0
-
hide_file
false
-
open_website
false
-
process_critical
true
-
raw
silly21
-
reconnect
3
-
startup
true
-
tag
Infected
-
uac
false
-
vm
false
-
website
https://t.me/sillyisafed
Signatures
- Family: RatonRAT
RatonRAT is an information stealer written in C#.
- Detects RatonRAT payload 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Pot.exe"C:\Users\Admin\AppData\Local\Temp\Pot.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Pot" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Local\Temp\Pot.exe\"" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\Pot.exe"C:\Users\Admin\AppData\Local\Temp\Pot.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2528-10-0x00007FFDE4FE0000-0x00007FFDE5984000-memory.dmp
memory/2528-12-0x00007FFDE4FE0000-0x00007FFDE5984000-memory.dmp
memory/2528-13-0x00007FFDE4FE0000-0x00007FFDE5984000-memory.dmp
memory/2528-11-0x00007FFDE4FE0000-0x00007FFDE5984000-memory.dmp
memory/6104-4-0x00007FFDE4FE0000-0x00007FFDE5984000-memory.dmp
memory/6104-5-0x00007FFDE4FE0000-0x00007FFDE5984000-memory.dmp
memory/6104-6-0x00007FFDE4FE0000-0x00007FFDE5984000-memory.dmp
memory/6104-7-0x00007FFDE4FE0000-0x00007FFDE5984000-memory.dmp
memory/6104-8-0x00007FFDE4FE0000-0x00007FFDE5984000-memory.dmp
memory/6104-9-0x00007FFDE4FE0000-0x00007FFDE5984000-memory.dmp
memory/6104-0-0x00007FFDE516F000-0x00007FFDE5170000-memory.dmp
memory/6104-3-0x00000158531A0000-0x00000158531A8000-memory.dmp
memory/6104-2-0x00007FFDE4FE0000-0x00007FFDE5984000-memory.dmp
memory/6104-1-0x00000158511A0000-0x000001585152C000-memory.dmp
memory/6104-14-0x00007FFDE4FE0000-0x00007FFDE5984000-memory.dmp
memory/6104-15-0x00007FFDE4FE0000-0x00007FFDE5984000-memory.dmp