Analysis
- user interaction
yes - max time kernel
149s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
07/10/2026, 16:47
General
- Target ratonClient.exe
- Size 2.5MB
- Sample261007-vawthac18p
- SHA256 a77efc54be00bc21bd3c9f951fd224cbdb1a5c288a1936c5301bb6efa06083cd
Malware Config
Extracted
-
ratonrat
-
Professional
-
Reez121010-42691.portmap.host:42691
-
prrJLrGMzgbNCtMIdU1WmoV
-
assist
false
-
box
false
-
box_icon
Error
-
box_msg
I'm the message box description
-
box_title
Hello World
-
defender
true
-
delay
0
-
hide_file
true
-
open_website
false
-
password
t.me/junk_code
-
process_critical
true
-
raw
silly21
-
reconnect
3
-
startup
true
-
tag
Infected
-
uac
false
-
vm
false
-
website
https://t.me/example
Signatures
- Family: RatonRAT
RatonRAT is an information stealer written in C#.
- Detects RatonRAT payload 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 2 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Delays execution with timeout.exe 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 24 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ratonClient.exe"C:\Users\Admin\AppData\Local\Temp\ratonClient.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\cleanup_1LV0fBUoklUJMBeOzV8fE3HmTM7iHJ.bat""2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak3⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe"C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe"3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass "Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe'"4⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "ratonClient" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe\"" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak3⤵
- Delays execution with timeout.exe
-
-
-
C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe"C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
aforge.dll
aforge.video.directshow.dll
aforge.video.dll
costura.dll
microsoft.win32.registry.dll
naudio.asio.dll
naudio.core.dll
naudio.dll
naudio.midi.dll
naudio.wasapi.dll
naudio.winforms.dll
naudio.winmm.dll
newtonsoft.json.dll
stuff.dll
system.buffers.dll
system.memory.dll
system.numerics.vectors.dll
system.resources.extensions.dll
system.runtime.compilerservices.unsafe.dll
system.security.accesscontrol.dll
system.security.principal.windows.dll
__PSScriptPolicyTest_ee4uydtx.hli.psm1
ratonClient.exe
cleanup_1LV0fBUoklUJMBeOzV8fE3HmTM7iHJ.bat
memory/960-55-0x00007FFF6C690000-0x00007FFF6D034000-memory.dmp
memory/960-56-0x00007FFF6C690000-0x00007FFF6D034000-memory.dmp
memory/960-58-0x00007FFF6C690000-0x00007FFF6D034000-memory.dmp
memory/960-1-0x000002267A170000-0x000002267A3EC000-memory.dmp
memory/960-47-0x000002267CAB0000-0x000002267CABA000-memory.dmp
memory/960-24-0x00007FFF6C690000-0x00007FFF6D034000-memory.dmp
memory/960-23-0x00007FFF6C690000-0x00007FFF6D034000-memory.dmp
memory/960-0-0x00007FFF6C81F000-0x00007FFF6C820000-memory.dmp
memory/960-59-0x00007FFF6C690000-0x00007FFF6D034000-memory.dmp
memory/4848-84-0x000001E660820000-0x000001E660842000-memory.dmp
memory/4848-87-0x000001E660890000-0x000001E6608AE000-memory.dmp
memory/4848-88-0x000001E660EE0000-0x000001E660F92000-memory.dmp
memory/4848-89-0x000001E660860000-0x000001E66086A000-memory.dmp