Analysis
- max time kernel
900s - max time network
845s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
07/10/2026, 20:28
General
- Target Raton Proff v4.2 crack/Builder/clientForNull.exe
- Size 1.3MB
- Sample261007-y82desfx2p
- SHA256 adf4a41c8900d5a0316555023ce8acafaebc9d761a4ebe0b5385b4f936db8e05
Malware Config
Extracted
-
ratonrat
-
Professional
-
silly1
-
assist
silly11
-
box
silly8
-
box_icon
silly10
-
box_msg
silly9
-
box_title
silly17
-
defender
silly23
-
delay
silly5
-
hide_file
silly7
-
open_website
silly13
-
password
silly20
-
process_critical
silly6
-
raw
silly21
-
reconnect
silly22
-
startup
silly4
-
tag
silly16
-
uac
silly11
-
vm
silly15
-
website
silly14
Signatures
- Family: RatonRAT
RatonRAT is an information stealer written in C#.
- Detects RatonRAT payload 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Raton Proff v4.2 crack\Builder\clientForNull.exe"C:\Users\Admin\AppData\Local\Temp\Raton Proff v4.2 crack\Builder\clientForNull.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
stuff.dll
memory/2260-0-0x00007FFF1072F000-0x00007FFF10730000-memory.dmp
memory/2260-1-0x00000207BB710000-0x00000207BB860000-memory.dmp
memory/2260-2-0x00007FFF105A0000-0x00007FFF10F44000-memory.dmp
memory/2260-24-0x00007FFF105A0000-0x00007FFF10F44000-memory.dmp
memory/2260-25-0x00007FFF105A0000-0x00007FFF10F44000-memory.dmp
memory/2260-33-0x00007FFF105A0000-0x00007FFF10F44000-memory.dmp
memory/2260-49-0x00000207D5FF0000-0x00000207D5FFA000-memory.dmp
memory/2260-55-0x00007FFF105A0000-0x00007FFF10F44000-memory.dmp
memory/2260-56-0x00007FFF105A0000-0x00007FFF10F44000-memory.dmp
memory/2260-57-0x00007FFF105A0000-0x00007FFF10F44000-memory.dmp