Analysis
- user interaction
yes - max time kernel
149s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
21/09/2026, 17:28
General
- Target ratonBinded.exe
- Size 11.9MB
- Sample260921-v2aeksvt7p
- SHA256 d13ac483eba31885fe6d7eff5c4c26de8a0a1542dac420ab7654e15f522286af
Malware Config
Extracted
-
ratonrat
-
Professional
-
86.100.111.230:3373
-
T87STatfMISIyHpgW0eWw8s
-
assist
false
-
box
false
-
box_icon
Error
-
box_msg
I'm the message box description
-
box_title
Hello World
-
defender
false
-
delay
0
-
hide_file
false
-
open_website
false
-
password
t.me/junk_code
-
process_critical
false
-
raw
silly21
-
reconnect
3
-
startup
false
-
tag
Infected
-
uac
false
-
vm
false
-
website
https://t.me/example
Signatures
- Family: RatonRAT
RatonRAT is an information stealer written in C#.
- Detects RatonRAT payload 3 IoCs
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 4 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks for any installed AV software in registry 1 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ratonBinded.exe"C:\Users\Admin\AppData\Local\Temp\ratonBinded.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\RuntimeCache\98b412da\ratonClient.exe"C:\Users\Admin\AppData\Roaming\RuntimeCache\98b412da\ratonClient.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\RuntimeCache\98b412da\neverlose.temp.exe"C:\Users\Admin\AppData\Roaming\RuntimeCache\98b412da\neverlose.temp.exe"2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Checks for any installed AV software in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "MicrosoftEdgeUpdate_w9bdv" /tr "\"C:\Users\Admin\AppData\Roaming\RuntimeCache\98b412da\neverlose.temp.exe\"" /sc ONLOGON /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Program Files\7-Zip\7z.exe"C:\Program Files\7-Zip\7z.exe" a "-pd28dfcb2c9d8271a" -mhe=on -t7z -mx9 "C:\Users\Admin\AppData\Local\Temp\vg__s4z4jf\535cb1-Admin.7z" "C:\Users\Admin\AppData\Local\Temp\vg__s4z4jf\organized\*"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\RuntimeCache\98b412da\neverlose.temp.exeC:\Users\Admin\AppData\Roaming\RuntimeCache\98b412da\neverlose.temp.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\RuntimeCache\98b412da\neverlose.temp.exe"C:\Users\Admin\AppData\Roaming\RuntimeCache\98b412da\neverlose.temp.exe"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
1Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
naudio.wasapi.dll
newtonsoft.json.dll
stuff.dll
system.buffers.dll
535cb1-Admin.7z
History.txt
Bookmarks.txt
history.txt
email_clients.txt
Desktop.txt
Documents.txt
Downloads.txt
Music.txt
Pictures.txt
Videos.txt
items.txt
items.txt
items.txt
items.txt
items.txt
items.txt
items.txt
Antivirus.txt
MAC Addresses.txt
System Info.txt
Task List.txt
neverlose.temp.exe
ratonClient.exe
memory/3488-8-0x00007FFDEA900000-0x00007FFDEB2A4000-memory.dmp
memory/3488-37-0x00007FFDEA900000-0x00007FFDEB2A4000-memory.dmp
memory/3488-1-0x0000000000D00000-0x00000000018F0000-memory.dmp
memory/3488-10-0x00007FFDEA900000-0x00007FFDEB2A4000-memory.dmp
memory/3488-2-0x00007FFDEA900000-0x00007FFDEB2A4000-memory.dmp
memory/3488-0-0x00007FFDEAA8F000-0x00007FFDEAA90000-memory.dmp
memory/3488-36-0x00007FFDEA900000-0x00007FFDEB2A4000-memory.dmp
memory/4184-121-0x000001E874AA0000-0x000001E874AAA000-memory.dmp
memory/4184-114-0x000001E874520000-0x000001E87452A000-memory.dmp
memory/4184-103-0x00007FFDEA900000-0x00007FFDEB2A4000-memory.dmp
memory/4184-128-0x000001E874B70000-0x000001E874C24000-memory.dmp
memory/4184-9-0x000001E859B20000-0x000001E859D96000-memory.dmp
memory/4184-135-0x000001E874B10000-0x000001E874B42000-memory.dmp
memory/4184-39-0x00007FFDEA900000-0x00007FFDEB2A4000-memory.dmp
memory/4184-141-0x000001E874AF0000-0x000001E874B0A000-memory.dmp
memory/4184-142-0x000001E874AB0000-0x000001E874AD2000-memory.dmp