Analysis
- user interaction
yes - max time kernel
600s - max time network
597s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/08/2026, 01:15
General
- Target Injector.exe
- Size 4.2MB
- Sample260809-bmpfea1yas
- SHA256 458fcbf0fdf64a3ced695a477d7e60e716a1dc8119da8dabd112154aaa8b5a11
Malware Config
Extracted
-
ratonrat
-
Free
-
byfrontech-41453.portmap.host:41453
-
5lDaUDoDzwzMZnSdx548J3h
-
assist
false
-
box
true
-
box_icon
Information
-
box_msg
Injected
-
box_title
xd
-
defender
false
-
delay
0
-
hide_file
false
-
open_website
false
-
process_critical
false
-
raw
silly21
-
reconnect
3
-
startup
false
-
tag
Infected
-
uac
false
-
vm
false
-
website
https://t.me/sillyisafed
Signatures
- Family: RatonRAT
RatonRAT is an information stealer written in C#.
- Detects RatonRAT payload 2 IoCs
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
-
C:\Users\Admin\AppData\Local\Temp\Injector.exe"C:\Users\Admin\AppData\Local\Temp\Injector.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Local\Temp\Injector.exe"C:\Users\Admin\AppData\Local\Temp\Injector.exe"2⤵
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004D01⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
aforge.video.directshow.dll
naudio.core.dll
naudio.dll
naudio.wasapi.dll
naudio.winforms.dll
naudio.winmm.dll
newtonsoft.json.dll
stuff.dll
system.buffers.dll
memory/1712-9-0x00000000003D0000-0x00000000003E1000-memory.dmp
memory/1712-8-0x0000000000400000-0x000000000046A000-memory.dmp
memory/4080-7-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
memory/4080-93-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
memory/4080-47-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
memory/4080-27-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
memory/4080-58-0x000000001E8F0000-0x000000001E8FA000-memory.dmp
memory/4080-64-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
memory/4080-65-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
memory/4080-66-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
memory/4080-68-0x0000000023130000-0x000000002313A000-memory.dmp
memory/4080-0-0x00007FF8EA99F000-0x00007FF8EA9A0000-memory.dmp
memory/4080-75-0x00000000255A0000-0x0000000025654000-memory.dmp
memory/4080-11-0x000000001D9E0000-0x000000001DC4A000-memory.dmp
memory/4080-81-0x0000000025510000-0x0000000025532000-memory.dmp
memory/4080-83-0x0000000026D60000-0x0000000026D92000-memory.dmp
memory/4080-5-0x000000001D310000-0x000000001D5E2000-memory.dmp
memory/4080-89-0x0000000025560000-0x000000002557A000-memory.dmp
memory/4080-90-0x0000000026760000-0x0000000026850000-memory.dmp
memory/4080-42-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
memory/4080-6-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
memory/4080-92-0x00000000232B0000-0x00000000232C6000-memory.dmp
memory/4080-107-0x0000000023340000-0x0000000023374000-memory.dmp
memory/4080-4-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
memory/4080-114-0x0000000023300000-0x0000000023314000-memory.dmp
memory/4080-3-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
memory/4080-2-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
memory/4080-100-0x00000000232A0000-0x00000000232AE000-memory.dmp
memory/4080-120-0x0000000026760000-0x0000000026850000-memory.dmp
memory/4080-121-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
memory/4080-124-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
memory/4080-126-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
memory/4080-132-0x000000001CB50000-0x000000001CB58000-memory.dmp
memory/4080-1-0x0000000000F00000-0x000000000133C000-memory.dmp
memory/4080-145-0x0000000026760000-0x0000000026850000-memory.dmp
memory/4080-157-0x0000000026760000-0x0000000026850000-memory.dmp
memory/4080-188-0x0000000026760000-0x0000000026850000-memory.dmp