Analysis
- user interaction
yes - max time kernel
43s - max time network
41s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
29/10/2026, 19:32
General
- Target RsquareRAT.exe
- Size 72.2MB
- Sample261029-x9eqdaev2t
- SHA256 185489f9c0b05d0903cfae6988a2e9e3ed60ebd5ba299bf0cce752fd5f15df4c
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 4 IoCs
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RsquareRAT.exe"C:\Users\Admin\AppData\Local\Temp\RsquareRAT.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c vol C:\2⤵
- Executes a command shell one-liner
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
D3DCompiler_47_cor3.dll
PresentationNative_cor3.dll
vcruntime140_cor3.dll
wpfgfx_cor3.dll
memory/2228-110-0x000001A551940000-0x000001A551980000-memory.dmp
memory/2228-78-0x0000019D3B240000-0x0000019D3B340000-memory.dmp
memory/2228-23-0x0000019D36D60000-0x0000019D36DB0000-memory.dmp
memory/2228-39-0x0000019D36DB0000-0x0000019D36DD0000-memory.dmp
memory/2228-59-0x0000019D3AD70000-0x0000019D3AD90000-memory.dmp
memory/2228-71-0x0000019D3B090000-0x0000019D3B0B0000-memory.dmp
memory/2228-90-0x0000019D3B3F0000-0x0000019D3B420000-memory.dmp
memory/2228-86-0x000001A552180000-0x000001A5528F0000-memory.dmp
memory/2228-82-0x0000019D3B0C0000-0x0000019D3B110000-memory.dmp
memory/2228-98-0x000001A551810000-0x000001A5518D0000-memory.dmp
memory/2228-126-0x000001A552950000-0x000001A552960000-memory.dmp
memory/2228-130-0x000001A552BE0000-0x000001A552D40000-memory.dmp
memory/2228-31-0x0000019D39C70000-0x0000019D39CC0000-memory.dmp
memory/2228-15-0x0000019D371E0000-0x0000019D37400000-memory.dmp
memory/2228-139-0x000001A5534E0000-0x000001A553750000-memory.dmp
memory/2228-122-0x000001A5529B0000-0x000001A5529F0000-memory.dmp
memory/2228-118-0x000001A5519B0000-0x000001A551A10000-memory.dmp
memory/2228-94-0x0000019D3B420000-0x0000019D3B440000-memory.dmp
memory/2228-8-0x0000019D38390000-0x0000019D392E0000-memory.dmp
memory/2228-106-0x0000019D3B110000-0x0000019D3B120000-memory.dmp
memory/2228-27-0x0000019D37400000-0x0000019D37440000-memory.dmp
memory/2228-102-0x000001A551710000-0x000001A551730000-memory.dmp
memory/2228-114-0x000001A551980000-0x000001A5519A0000-memory.dmp
memory/2228-19-0x0000019D39A90000-0x0000019D39BF0000-memory.dmp
memory/2228-67-0x0000019D3B060000-0x0000019D3B090000-memory.dmp
memory/2228-63-0x0000019D3ADB0000-0x0000019D3ADD0000-memory.dmp
memory/2228-55-0x0000019D3AD30000-0x0000019D3AD50000-memory.dmp
memory/2228-51-0x0000019D39CD0000-0x0000019D39CF0000-memory.dmp
memory/2228-47-0x0000019D39CC0000-0x0000019D39CD0000-memory.dmp
memory/2228-43-0x0000019D3ACB0000-0x0000019D3AD30000-memory.dmp
memory/2228-35-0x000001A54F4C0000-0x000001A54FCB0000-memory.dmp
memory/2228-144-0x000001A5563C0000-0x000001A556440000-memory.dmp
memory/2228-148-0x000001A556440000-0x000001A556490000-memory.dmp
memory/2228-152-0x000001A556590000-0x000001A556640000-memory.dmp
memory/2228-156-0x000001A5566B0000-0x000001A556720000-memory.dmp
memory/2228-160-0x000001A553190000-0x000001A5531A0000-memory.dmp
memory/2228-164-0x000001A556490000-0x000001A5564C0000-memory.dmp
memory/2228-168-0x0000019D36D30000-0x0000019D36D40000-memory.dmp
memory/2228-172-0x000001A556A30000-0x000001A556C00000-memory.dmp
memory/2228-176-0x000001A553230000-0x000001A553240000-memory.dmp
memory/2228-180-0x000001A5567B0000-0x000001A5567D0000-memory.dmp
memory/2228-184-0x000001A556C00000-0x000001A556C30000-memory.dmp
memory/2228-12-0x000001A54DDA0000-0x000001A54ECC0000-memory.dmp