Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
03/09/2026, 12:24
General
- Target ratonClient.exe
- Size 594KB
- Sample260903-pk3f5sgp21
- SHA256 1da97a3cf71a5607e3861ced845d26da38270ccddd0b7e97d8f7d4bb37763fa4
Malware Config
Extracted
-
ratonrat
-
Professional
-
10.14.246.51:8080
-
sXvOfjnX2aCKAfGhYvBZURs
-
assist
false
-
box
false
-
box_icon
Error
-
box_msg
I'm the message box description
-
box_title
Hello World
-
defender
true
-
delay
0
-
hide_file
false
-
open_website
false
-
password
t.me/junk_code
-
process_critical
false
-
raw
silly21
-
reconnect
3
-
startup
true
-
tag
Infected
-
uac
false
-
vm
false
-
website
https://t.me/example
Signatures
- Family: RatonRAT
RatonRAT is an information stealer written in C#.
- Detects RatonRAT payload 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ratonClient.exe"C:\Users\Admin\AppData\Local\Temp\ratonClient.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "ratonClient" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Local\Temp\ratonClient.exe\"" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\ratonClient.exe"C:\Users\Admin\AppData\Local\Temp\ratonClient.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3080-1-0x000001607D040000-0x000001607D0DA000-memory.dmp
memory/3080-0-0x00007FFBB5A1F000-0x00007FFBB5A20000-memory.dmp
memory/3080-2-0x000001607ED70000-0x000001607ED7A000-memory.dmp
memory/3080-3-0x00007FFBB5890000-0x00007FFBB6234000-memory.dmp
memory/3080-4-0x00007FFBB5890000-0x00007FFBB6234000-memory.dmp
memory/3080-5-0x00007FFBB5890000-0x00007FFBB6234000-memory.dmp
memory/3080-6-0x00007FFBB5890000-0x00007FFBB6234000-memory.dmp
memory/3080-8-0x00007FFBB5890000-0x00007FFBB6234000-memory.dmp
memory/5584-7-0x00007FFBB5890000-0x00007FFBB6234000-memory.dmp
memory/5584-9-0x00007FFBB5890000-0x00007FFBB6234000-memory.dmp