Analysis
- user interaction
yes - max time kernel
134s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 00:50
General
- Target rat.exe
- Size 2.5MB
- Sample260804-a7e7ssej3w
- SHA256 e14bb83f6f8e7493ea61d1a9297fd39345cedf41e4b5047ee58187ca4d2c716d
Malware Config
Extracted
-
ratonrat
-
Professional
-
185.69.122.235:10012
-
i0EfLmQkdxEPxXqP2XsDtKe
-
assist
true
-
box
false
-
box_icon
Error
-
box_msg
I'm the message box description
-
box_title
Hello World
-
defender
true
-
delay
0
-
hide_file
true
-
open_website
false
-
password
t.me/junk_code
-
process_critical
true
-
raw
silly21
-
reconnect
3
-
startup
true
-
tag
Infected
-
uac
true
-
vm
true
-
website
https://t.me/example
Signatures
- Family: RatonRAT
RatonRAT is an information stealer written in C#.
- Detects RatonRAT payload 2 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 2 IoCs
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Delays execution with timeout.exe 3 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 43 IoCs
- Suspicious use of AdjustPrivilegeToken 24 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\rat.exe"C:\Users\Admin\AppData\Local\Temp\rat.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\cleanup_S5d1qXKtX1sXtz5ypInNoSXwJTuo6Z.bat""2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak3⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak3⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\PlatformRuntime\rat.exe"C:\Users\Admin\AppData\Roaming\PlatformRuntime\rat.exe"3⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass "Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Roaming\PlatformRuntime\rat.exe'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "rat" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Roaming\PlatformRuntime\rat.exe\"" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak3⤵
- Delays execution with timeout.exe
-
-
-
C:\Users\Admin\AppData\Roaming\PlatformRuntime\rat.exe"C:\Users\Admin\AppData\Roaming\PlatformRuntime\rat.exe"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
aforge.dll
aforge.video.directshow.dll
aforge.video.dll
costura.dll
microsoft.win32.registry.dll
naudio.asio.dll
naudio.core.dll
naudio.dll
naudio.midi.dll
naudio.wasapi.dll
naudio.winforms.dll
naudio.winmm.dll
newtonsoft.json.dll
stuff.dll
system.buffers.dll
system.memory.dll
system.numerics.vectors.dll
system.resources.extensions.dll
system.runtime.compilerservices.unsafe.dll
system.security.accesscontrol.dll
system.security.principal.windows.dll
rat.exe
cleanup_S5d1qXKtX1sXtz5ypInNoSXwJTuo6Z.bat
memory/3584-48-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp
memory/3584-25-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp
memory/3584-61-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp
memory/3584-56-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp
memory/3584-50-0x00000185E8680000-0x00000185E868A000-memory.dmp
memory/3584-0-0x00007FFB528AF000-0x00007FFB528B0000-memory.dmp
memory/3584-47-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp
memory/3584-60-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp
memory/3584-24-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp
memory/3584-2-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp
memory/3584-1-0x00000185CDC80000-0x00000185CDEFC000-memory.dmp
memory/5352-84-0x0000024A36220000-0x0000024A36242000-memory.dmp
memory/5352-89-0x0000024A362F0000-0x0000024A3630E000-memory.dmp
memory/5352-90-0x0000024A36550000-0x0000024A36602000-memory.dmp
memory/5352-91-0x0000024A36310000-0x0000024A3631A000-memory.dmp