Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
03/08/2026, 10:41
General
- Target ratonClient.exe
- Size 1.3MB
- Sample260803-mrl2mawzhy
- SHA256 51cc91c1cf6cf9f8fd608fb392c2cf883f0a0e137f9e9e973f8d4101031bf244
Malware Config
Extracted
-
ratonrat
-
Professional
-
tcp.niceports.shop:23108
-
350508kqaRX2cNYjJprwvi3
-
assist
true
-
box
false
-
box_icon
Error
-
box_msg
I'm the message box description
-
box_title
Hello World
-
defender
true
-
delay
0
-
hide_file
true
-
open_website
false
-
password
t.me/junk_code
-
process_critical
true
-
raw
silly21
-
reconnect
3
-
startup
true
-
tag
Infected
-
uac
true
-
vm
true
-
website
https://t.me/example
Signatures
- Family: RatonRAT
RatonRAT is an information stealer written in C#.
- Detects RatonRAT payload 2 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Looks for VMWare Tools registry key 2 TTPs 2 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 2 IoCs
- Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Delays execution with timeout.exe 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 48 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ratonClient.exe"C:\Users\Admin\AppData\Local\Temp\ratonClient.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\cleanup_up5TqxzlwvAIEL7hJ4tcBt6EpZymcr.bat""2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak3⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe"C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe"3⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass "Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "ratonClient" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe\"" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak3⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe"C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass "Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "ratonClient" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe\"" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
aforge.dll
aforge.video.directshow.dll
aforge.video.dll
costura.dll
microsoft.win32.registry.dll
naudio.asio.dll
naudio.core.dll
naudio.dll
naudio.midi.dll
naudio.wasapi.dll
naudio.winforms.dll
naudio.winmm.dll
newtonsoft.json.dll
stuff.dll
system.buffers.dll
system.memory.dll
system.numerics.vectors.dll
system.resources.extensions.dll
system.runtime.compilerservices.unsafe.dll
system.security.accesscontrol.dll
system.security.principal.windows.dll
__PSScriptPolicyTest_5axv1zbl.riu.ps1
ratonClient.exe
cleanup_up5TqxzlwvAIEL7hJ4tcBt6EpZymcr.bat
memory/3620-39-0x00007FFEC4ED0000-0x00007FFEC5874000-memory.dmp
memory/3620-0-0x00007FFEC505F000-0x00007FFEC5060000-memory.dmp
memory/3620-59-0x00007FFEC4ED0000-0x00007FFEC5874000-memory.dmp
memory/3620-38-0x00007FFEC4ED0000-0x00007FFEC5874000-memory.dmp
memory/3620-31-0x00007FFEC4ED0000-0x00007FFEC5874000-memory.dmp
memory/3620-24-0x00007FFEC4ED0000-0x00007FFEC5874000-memory.dmp
memory/3620-2-0x00007FFEC4ED0000-0x00007FFEC5874000-memory.dmp
memory/3620-50-0x000001D3BC520000-0x000001D3BC52A000-memory.dmp
memory/3620-1-0x000001D3A1C40000-0x000001D3A1D92000-memory.dmp
memory/3964-97-0x000001CE9A4D0000-0x000001CE9A582000-memory.dmp
memory/4264-84-0x0000020AA65D0000-0x0000020AA65F2000-memory.dmp
memory/4264-89-0x0000020AA6A50000-0x0000020AA6A5A000-memory.dmp
memory/4264-88-0x0000020AA6990000-0x0000020AA6A42000-memory.dmp
memory/4264-87-0x0000020AA6660000-0x0000020AA667E000-memory.dmp