Analysis
- max time kernel
150s - max time network
146s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
28/10/2026, 16:36
General
- Target Datenschutz_und_Sicherheit_28.10.2026.vbs
- Size 15.8MB
- Sample261028-t4eawaev5r
- SHA256 88d29233f8bdff4add18e12e2929dffb0b9a4a2ce7ae10e8f419a1f1a5f6b014
Malware Config
Extracted
-
ratonrat
-
Free
-
ly0pcjyp.free.pwrp.cc:12204
-
SlOPlcX9lHQMwe3updFRFp3
-
assist
false
-
box
false
-
box_icon
No icon
-
box_msg
empty
-
box_title
empty
-
defender
true
-
delay
0
-
hide_file
true
-
open_website
false
-
process_critical
true
-
raw
silly21
-
reconnect
3
-
startup
true
-
tag
Infected
-
uac
false
-
vm
true
-
website
https://t.me/sillyisafed
Signatures
- Family: RatonRAT
RatonRAT is an information stealer written in C#.
- Detects RatonRAT payload 2 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 3 IoCs
- Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs
Payload decoded via CertUtil.
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Delays execution with timeout.exe 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Datenschutz_und_Sicherheit_28.10.2026.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\certutil.exe"C:\Windows\System32\certutil.exe" -decode "C:\Users\Admin\AppData\Roaming\ratonClient.b64" "C:\Users\Admin\AppData\Roaming\ratonClient.exe"2⤵
- Deobfuscate/Decode Files or Information
-
-
C:\Users\Admin\AppData\Roaming\ratonClient.exe"C:\Users\Admin\AppData\Roaming\ratonClient.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\cleanup_JqY60OvX8I4YNNhNrzea7OT2DRIFq1.bat""3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe"C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe"4⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass "Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe'"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "ratonClient" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe\"" /rl HIGHEST /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak4⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe"C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient.exe"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Deobfuscate/Decode Files or Information
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
ratonClient.exe.log
aforge.dll
aforge.video.directshow.dll
aforge.video.dll
costura.dll
microsoft.win32.registry.dll
naudio.asio.dll
naudio.core.dll
naudio.dll
naudio.midi.dll
naudio.wasapi.dll
naudio.winforms.dll
naudio.winmm.dll
newtonsoft.json.dll
stuff.dll
system.buffers.dll
system.memory.dll
system.numerics.vectors.dll
system.resources.extensions.dll
system.runtime.compilerservices.unsafe.dll
system.security.accesscontrol.dll
system.security.principal.windows.dll
__PSScriptPolicyTest_qw3lv2vq.ygw.ps1
cleanup_JqY60OvX8I4YNNhNrzea7OT2DRIFq1.bat
ratonClient.b64
ratonClient.exe
memory/664-97-0x000001D3574D0000-0x000001D3574EC000-memory.dmp
memory/664-90-0x000001D33DDC0000-0x000001D33DDE2000-memory.dmp
memory/664-98-0x000001D3577B0000-0x000001D357863000-memory.dmp
memory/664-99-0x000001D3574F0000-0x000001D3574FA000-memory.dmp
memory/664-100-0x000001D357520000-0x000001D35753C000-memory.dmp
memory/664-101-0x000001D357500000-0x000001D35750A000-memory.dmp
memory/664-102-0x000001D357560000-0x000001D35757A000-memory.dmp
memory/664-103-0x000001D357510000-0x000001D357518000-memory.dmp
memory/664-104-0x000001D357540000-0x000001D357546000-memory.dmp
memory/664-105-0x000001D357550000-0x000001D35755A000-memory.dmp
memory/2800-5-0x00000221E5CB0000-0x00000221E5F1A000-memory.dmp
memory/2800-6-0x0000022181AA0000-0x0000022181AB0000-memory.dmp
memory/2800-50-0x0000022200150000-0x000002220015A000-memory.dmp