Analysis
- user interaction
yes - max time kernel
39s - max time network
23s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
29/10/2026, 19:32
General
- Target RsquareRAT.exe
- Size 72.2MB
- Sample261029-x9eqdaev2t
- SHA256 185489f9c0b05d0903cfae6988a2e9e3ed60ebd5ba299bf0cce752fd5f15df4c
Malware Config
Signatures
- Loads dropped DLL 4 IoCs
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RsquareRAT.exe"C:\Users\Admin\AppData\Local\Temp\RsquareRAT.exe"1⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c vol C:\2⤵
- Executes a command shell one-liner
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
D3DCompiler_47_cor3.dll
PresentationNative_cor3.dll
vcruntime140_cor3.dll
wpfgfx_cor3.dll
memory/3368-94-0x000001F716770000-0x000001F716790000-memory.dmp
memory/3368-118-0x000001F717E20000-0x000001F717E80000-memory.dmp
memory/3368-71-0x000001F716350000-0x000001F716370000-memory.dmp
memory/3368-67-0x000001F7163A0000-0x000001F7163D0000-memory.dmp
memory/3368-63-0x000001F716310000-0x000001F716330000-memory.dmp
memory/3368-82-0x000001F716410000-0x000001F716460000-memory.dmp
memory/3368-90-0x000001F716740000-0x000001F716770000-memory.dmp
memory/3368-86-0x000001F7171B0000-0x000001F717920000-memory.dmp
memory/3368-98-0x000001F7168E0000-0x000001F7169A0000-memory.dmp
memory/3368-126-0x000001F717EC0000-0x000001F717ED0000-memory.dmp
memory/3368-130-0x000001F7180D0000-0x000001F718230000-memory.dmp
memory/3368-122-0x000001F717D80000-0x000001F717DC0000-memory.dmp
memory/3368-39-0x000001F754220000-0x000001F754240000-memory.dmp
memory/3368-52-0x000001F758AD0000-0x000001F758AF0000-memory.dmp
memory/3368-139-0x000001F7192E0000-0x000001F719550000-memory.dmp
memory/3368-59-0x000001F7162D0000-0x000001F7162F0000-memory.dmp
memory/3368-114-0x000001F716A20000-0x000001F716A40000-memory.dmp
memory/3368-110-0x000001F717D20000-0x000001F717D60000-memory.dmp
memory/3368-106-0x000001F7169A0000-0x000001F7169B0000-memory.dmp
memory/3368-102-0x000001F7167E0000-0x000001F716800000-memory.dmp
memory/3368-7-0x000001F7571E0000-0x000001F758130000-memory.dmp
memory/3368-79-0x000001F716590000-0x000001F716690000-memory.dmp
memory/3368-55-0x000001F758B20000-0x000001F758B40000-memory.dmp
memory/3368-15-0x000001F756030000-0x000001F756250000-memory.dmp
memory/3368-31-0x000001F7589E0000-0x000001F758A30000-memory.dmp
memory/3368-47-0x000001F758AC0000-0x000001F758AD0000-memory.dmp
memory/3368-43-0x000001F758A30000-0x000001F758AB0000-memory.dmp
memory/3368-35-0x000001F759A80000-0x000001F75A270000-memory.dmp
memory/3368-27-0x000001F756250000-0x000001F756290000-memory.dmp
memory/3368-23-0x000001F755A90000-0x000001F755AE0000-memory.dmp
memory/3368-19-0x000001F758830000-0x000001F758990000-memory.dmp
memory/3368-144-0x000001F714270000-0x000001F71450E000-memory.dmp
memory/3368-146-0x000001F71BD80000-0x000001F71BE00000-memory.dmp
memory/3368-150-0x000001F719020000-0x000001F719070000-memory.dmp
memory/3368-154-0x000001F71BF70000-0x000001F71C020000-memory.dmp
memory/3368-158-0x000001F71C090000-0x000001F71C100000-memory.dmp
memory/3368-162-0x000001F718F90000-0x000001F718FA0000-memory.dmp
memory/3368-166-0x000001F71C130000-0x000001F71C160000-memory.dmp
memory/3368-170-0x000001F717F30000-0x000001F717F40000-memory.dmp
memory/3368-178-0x000001F71C190000-0x000001F71C1A0000-memory.dmp
memory/3368-175-0x000001F71C430000-0x000001F71C600000-memory.dmp
memory/3368-182-0x000001F71BE80000-0x000001F71BEA0000-memory.dmp
memory/3368-186-0x000001F71C600000-0x000001F71C630000-memory.dmp
memory/3368-11-0x000001F712950000-0x000001F713870000-memory.dmp
memory/3368-193-0x000001F714270000-0x000001F71450E000-memory.dmp