Analysis
- user interaction
yes - max time kernel
598s - max time network
598s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
09/08/2026, 01:15
General
- Target Injector.exe
- Size 4.2MB
- Sample260809-bmpfea1yas
- SHA256 458fcbf0fdf64a3ced695a477d7e60e716a1dc8119da8dabd112154aaa8b5a11
Malware Config
Extracted
-
ratonrat
-
Free
-
byfrontech-41453.portmap.host:41453
-
5lDaUDoDzwzMZnSdx548J3h
-
assist
false
-
box
true
-
box_icon
Information
-
box_msg
Injected
-
box_title
xd
-
defender
false
-
delay
0
-
hide_file
false
-
open_website
false
-
process_critical
false
-
raw
silly21
-
reconnect
3
-
startup
false
-
tag
Infected
-
uac
false
-
vm
false
-
website
https://t.me/sillyisafed
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: RatonRAT
RatonRAT is an information stealer written in C#.
- Detects DonutLoader 1 IoCs
- Detects RatonRAT payload 2 IoCs
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Looks up external IP address via web service 1 TTPs 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\Injector.exe"C:\Users\Admin\AppData\Local\Temp\Injector.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Local\Temp\Injector.exe"C:\Users\Admin\AppData\Local\Temp\Injector.exe"2⤵
- Checks BIOS information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\Injector.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_e8a190f7a8c948898d62ec9cf60f6a06.cs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7640.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC420591535BD947E8A558F4EACBBBC741.TMP"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
aforge.video.directshow.dll
naudio.core.dll
naudio.wasapi.dll
naudio.winforms.dll
naudio.winmm.dll
newtonsoft.json.dll
stuff.dll
system.buffers.dll
RES7640.tmp
CSC420591535BD947E8A558F4EACBBBC741.TMP
guardian_src_e8a190f7a8c948898d62ec9cf60f6a06.cs
memory/3604-53-0x0000000001610000-0x0000000001676000-memory.dmp
memory/3604-57-0x0000000003140000-0x0000000003146000-memory.dmp
memory/3604-56-0x0000000003150000-0x0000000003160000-memory.dmp
memory/3604-55-0x000000001C260000-0x000000001C2C6000-memory.dmp
memory/3604-54-0x0000000003150000-0x0000000003160000-memory.dmp
memory/3604-52-0x0000000000400000-0x000000000046A000-memory.dmp
memory/3604-2-0x0000000000400000-0x000000000046A000-memory.dmp
memory/3872-66-0x0000000003AE0000-0x0000000003AF0000-memory.dmp
memory/3872-74-0x0000000024370000-0x0000000024424000-memory.dmp
memory/3872-70-0x00000000242A0000-0x00000000242AA000-memory.dmp
memory/3872-78-0x0000000024320000-0x0000000024352000-memory.dmp
memory/3872-0-0x0000000000940000-0x0000000000D7C000-memory.dmp
memory/3872-81-0x0000000024300000-0x000000002431A000-memory.dmp
memory/3872-83-0x000000001CA00000-0x000000001CA16000-memory.dmp
memory/3872-48-0x000000001E390000-0x000000001E39A000-memory.dmp
memory/3872-87-0x000000001C9F0000-0x000000001C9FE000-memory.dmp
memory/3872-4-0x0000000003AE0000-0x0000000003AF0000-memory.dmp
memory/3872-3-0x000000001D4B0000-0x000000001D71A000-memory.dmp
memory/3872-95-0x000000001CA60000-0x000000001CA74000-memory.dmp
memory/3872-1-0x000000001CDE0000-0x000000001D0B2000-memory.dmp
memory/3872-91-0x000000001CA80000-0x000000001CAB4000-memory.dmp
memory/3872-98-0x000000001CC00000-0x000000001CC22000-memory.dmp