Analysis
- max time kernel
299s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
18/08/2026, 14:18
General
- Target LETTER OF INDEFINITE SUSPENSION.js
- Size 18KB
- Sample260818-rmqapsvwes
- SHA256 917f4e19362e5683c347e8033b76c10e51f0d4f1c5f4a6062e3eadceddb7a439
Malware Config
Extracted
-
ratonrat
-
Free
-
64.89.160.127:100
-
tD8dixcGKJLShttu7f19umz
-
assist
false
-
box
false
-
box_icon
No icon
-
box_msg
Hello, i'm the description of your raton client message box
-
box_title
Hello, im a title for your message box
-
defender
false
-
delay
0
-
hide_file
true
-
open_website
false
-
process_critical
false
-
reconnect
3
-
startup
true
-
tag
Infected
-
uac
false
-
vm
false
-
website
https://t.me/sillyisafed
Signatures
- Family: RatonRAT
RatonRAT is an information stealer written in C#.
- Detects RatonRAT payload 1 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of NtCreateThreadExHideFromDebugger 8 IoCs
- Costura .NET executable packer 1 IoCs
Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\LETTER OF INDEFINITE SUSPENSION.js"1⤵
- Badlisted process makes network request
-
C:\Users\Admin\AppData\Local\Temp\84cb\vlc.exe"C:\Users\Admin\AppData\Local\Temp\84cb\vlc.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "svbiq9evdadx3w" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\84cb\vlc.exe" /f2⤵
- Adds Run key to start application
-
-
C:\Users\Admin\AppData\Local\Temp\84cb\vlc.exeC:\Users\Admin\AppData\Local\Temp\84cb\vlc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
84cb.zip
libvlc.dll
vlc.exe
memory/4548-369-0x00007FFBD2530000-0x00007FFBD254D000-memory.dmp
memory/4548-53-0x00007FFBE1EE0000-0x00007FFBE2143000-memory.dmp
memory/4548-54-0x00007FFBDF3A0000-0x00007FFBDF741000-memory.dmp
memory/4548-52-0x00007FF6345A9000-0x00007FF6345AA000-memory.dmp
memory/4548-370-0x0000019038550000-0x00000190385EA000-memory.dmp
memory/4548-371-0x0000019038680000-0x000001903868A000-memory.dmp
memory/4548-374-0x00007FF6344C0000-0x00007FF6345C3000-memory.dmp
memory/4596-375-0x00007FFBE1EE0000-0x00007FFBE2143000-memory.dmp
memory/4596-376-0x00007FFBDF3A0000-0x00007FFBDF741000-memory.dmp
memory/4596-421-0x000001CDF59A0000-0x000001CDF5A3D000-memory.dmp
memory/4596-692-0x00007FF6344C0000-0x00007FF6345C3000-memory.dmp