Analysis
- max time kernel
149s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
20/09/2026, 22:31
General
- Target Microsoft.exe
- Size 34KB
- Sample260920-2fewhatyat
- SHA256 b96de86c33ee90bb9bc6af9d9eb774e245603bac1a8c19dc0456a0e7f767a4bc
Malware Config
Extracted
-
ratonrat
-
Free
-
helptapreview-52188.portmap.host:52188
-
HsaPlyOkViGcbtUBxeBRMKo
-
assist
true
-
box
false
-
box_icon
No icon
-
box_msg
empty
-
box_title
empty
-
defender
false
-
delay
0
-
hide_file
true
-
open_website
false
-
process_critical
false
-
raw
silly21
-
reconnect
3
-
startup
true
-
tag
Infected
-
uac
true
-
vm
true
-
website
https://t.me/sillyisafed
Signatures
- Family: RatonRAT
RatonRAT is an information stealer written in C#.
- Detects RatonRAT payload 2 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Downloads MZ/PE file 1 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 3 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Delays execution with timeout.exe 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 44 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Microsoft.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft.exe"1⤵
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftUpdater.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftUpdater.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\cleanup_hI2i6PbEWxl2yZ1ZPfpvwtuNOFjk9P.bat""3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\PlatformRuntime\MicrosoftUpdater.exe"C:\Users\Admin\AppData\Roaming\PlatformRuntime\MicrosoftUpdater.exe"4⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "MicrosoftUpdater" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Roaming\PlatformRuntime\MicrosoftUpdater.exe\"" /rl HIGHEST /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\AppData\Roaming\PlatformRuntime\MicrosoftUpdater.exe"C:\Users\Admin\AppData\Roaming\PlatformRuntime\MicrosoftUpdater.exe"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
aforge.dll
aforge.video.directshow.dll
aforge.video.dll
costura.dll
microsoft.win32.registry.dll
naudio.asio.dll
naudio.core.dll
naudio.dll
naudio.midi.dll
naudio.wasapi.dll
naudio.winforms.dll
naudio.winmm.dll
newtonsoft.json.dll
stuff.dll
system.buffers.dll
system.memory.dll
system.numerics.vectors.dll
system.resources.extensions.dll
system.runtime.compilerservices.unsafe.dll
system.security.accesscontrol.dll
system.security.principal.windows.dll
MicrosoftUpdater.exe
cleanup_hI2i6PbEWxl2yZ1ZPfpvwtuNOFjk9P.bat
memory/3052-19-0x00007FF977FF0000-0x00007FF978994000-memory.dmp
memory/3052-14-0x000000001C820000-0x000000001C8D2000-memory.dmp
memory/3052-60-0x00007FF977FF0000-0x00007FF978994000-memory.dmp
memory/3052-0-0x00007FF97817F000-0x00007FF978180000-memory.dmp
memory/3052-4-0x00007FF977FF0000-0x00007FF978994000-memory.dmp
memory/3052-5-0x00000000025C0000-0x00000000025E2000-memory.dmp
memory/3052-6-0x00007FF977FF0000-0x00007FF978994000-memory.dmp
memory/3052-7-0x00007FF977FF0000-0x00007FF978994000-memory.dmp
memory/3052-8-0x00007FF977FF0000-0x00007FF978994000-memory.dmp
memory/3052-9-0x00007FF977FF0000-0x00007FF978994000-memory.dmp
memory/3052-25-0x00007FF977FF0000-0x00007FF978994000-memory.dmp
memory/3052-24-0x00007FF977FF0000-0x00007FF978994000-memory.dmp
memory/3052-23-0x00007FF977FF0000-0x00007FF978994000-memory.dmp
memory/3052-21-0x00007FF977FF0000-0x00007FF978994000-memory.dmp
memory/3052-20-0x00007FF977FF0000-0x00007FF978994000-memory.dmp
memory/3052-1-0x0000000000380000-0x000000000038E000-memory.dmp
memory/3052-18-0x00007FF977FF0000-0x00007FF978994000-memory.dmp
memory/3052-16-0x00007FF977FF0000-0x00007FF978994000-memory.dmp
memory/3052-17-0x000000001CB60000-0x000000001CB6A000-memory.dmp
memory/3052-12-0x00007FF977FF0000-0x00007FF978994000-memory.dmp
memory/3052-15-0x00007FF977FF0000-0x00007FF978994000-memory.dmp
memory/3052-13-0x000000001C740000-0x000000001C75E000-memory.dmp
memory/4348-119-0x00007FF977FF0000-0x00007FF978994000-memory.dmp
memory/4348-93-0x00007FF977FF0000-0x00007FF978994000-memory.dmp
memory/4348-92-0x00007FF977FF0000-0x00007FF978994000-memory.dmp
memory/4348-83-0x00000256ED9D0000-0x00000256ED9DA000-memory.dmp
memory/4348-34-0x00000256D2FD0000-0x00000256D323A000-memory.dmp
memory/4348-36-0x00007FF977FF0000-0x00007FF978994000-memory.dmp
memory/4348-72-0x00007FF977FF0000-0x00007FF978994000-memory.dmp
memory/4348-71-0x00007FF977FF0000-0x00007FF978994000-memory.dmp
memory/4348-35-0x00007FF977FF0000-0x00007FF978994000-memory.dmp
memory/5732-117-0x0000020CB7720000-0x0000020CB772A000-memory.dmp
memory/5732-118-0x0000020CB77F0000-0x0000020CB78A4000-memory.dmp
memory/5732-120-0x0000020CB78B0000-0x0000020CB78E2000-memory.dmp
memory/5732-121-0x0000020CB7980000-0x0000020CB799A000-memory.dmp
memory/5732-122-0x0000020CB7770000-0x0000020CB7786000-memory.dmp
memory/5732-123-0x0000020CB7760000-0x0000020CB776E000-memory.dmp
memory/5732-124-0x0000020CB7930000-0x0000020CB7964000-memory.dmp
memory/5732-125-0x0000020CB78F0000-0x0000020CB7904000-memory.dmp