Analysis
- user interaction
yes - max time kernel
127s - max time network
129s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
02/11/2026, 00:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5zd03862.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
5zd03862.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
5zd03862.exe
Resource
win11-20260911-en
windows11-21h2-x64
13 signatures
150 seconds
General
- Target 5zd03862.exe
- Size 2.8MB
- Sample261102-a9rnlsgt5j
- SHA256 e2d110f7070b641f00e0ade25f47faf3e08a81d7312700a2a2db576ad744f65c
- MD5 76d9b8b64112a597f58864cff991dcad
- SHA1 d0802346fbd92f3653fc40147f61762e81d31619
- SHA512 512952cd038bcfc7273872e41cc43a98152112500cc2b33954589745ffffc38289d9502a14a939fd931f944c205318a1288c7cb71498310eb8fa8bac9233cdea
- SSDEEP 49152:/DfwvTe25L7RKmko3TYNhNpC5YsOTBQQnRQwI/A:/DaTe25L7RKhOkPeqBHuc
- TLSH T116D57B14FD8765F2E803157144A772BF27229D091F36DB87EA407A6EFA7B6D10D3220A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
ratonrat
Version
-
Free
C2
-
2.56.165.133:444
Mutex
-
qsoF4nA3fekYyctui0GqWrV
Attributes
-
assist
false
-
box
false
-
box_icon
No icon
-
box_msg
Hello, i'm the description of your raton client message box
-
box_title
Hello, im a title for your message box
-
defender
false
-
delay
0
-
hide_file
false
-
open_website
false
-
process_critical
false
-
raw
silly21
-
reconnect
3
-
startup
true
-
tag
Infected
-
uac
false
-
vm
false
-
website
https://t.me/sillyisafed
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
resource yara_rule behavioral2/memory/6076-38-0x0000000023E40000-0x0000000023ED9000-memory.dmp family_donutloader - Detects RatonRAT payload 1 IoCs
resource yara_rule behavioral2/memory/6076-40-0x0000000028100000-0x000000002819A000-memory.dmp family_ratonrat - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 5140 powershell.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000\Control Panel\International\Geo\Nation 5zd03862.exe - Executes dropped EXE 1 IoCs
pid Process 6076 OneDrive.exe - Costura .NET executable packer 1 IoCs
Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.
resource yara_rule behavioral2/memory/6076-40-0x0000000028100000-0x000000002819A000-memory.dmp costura - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 6032 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5zd03862.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OneDrive.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5140 powershell.exe 5140 powershell.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 25 IoCs
description pid Process Token: SeDebugPrivilege 5140 powershell.exe Token: SeIncreaseQuotaPrivilege 5140 powershell.exe Token: SeSecurityPrivilege 5140 powershell.exe Token: SeTakeOwnershipPrivilege 5140 powershell.exe Token: SeLoadDriverPrivilege 5140 powershell.exe Token: SeSystemProfilePrivilege 5140 powershell.exe Token: SeSystemtimePrivilege 5140 powershell.exe Token: SeProfSingleProcessPrivilege 5140 powershell.exe Token: SeIncBasePriorityPrivilege 5140 powershell.exe Token: SeCreatePagefilePrivilege 5140 powershell.exe Token: SeBackupPrivilege 5140 powershell.exe Token: SeRestorePrivilege 5140 powershell.exe Token: SeShutdownPrivilege 5140 powershell.exe Token: SeDebugPrivilege 5140 powershell.exe Token: SeSystemEnvironmentPrivilege 5140 powershell.exe Token: SeRemoteShutdownPrivilege 5140 powershell.exe Token: SeUndockPrivilege 5140 powershell.exe Token: SeManageVolumePrivilege 5140 powershell.exe Token: 33 5140 powershell.exe Token: 34 5140 powershell.exe Token: 35 5140 powershell.exe Token: 36 5140 powershell.exe Token: SeDebugPrivilege 4152 taskmgr.exe Token: SeSystemProfilePrivilege 4152 taskmgr.exe Token: SeCreateGlobalPrivilege 4152 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe 4152 taskmgr.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 5952 wrote to memory of 6032 5952 5zd03862.exe 84 PID 6032 wrote to memory of 6076 6032 cmd.exe 86 PID 6076 wrote to memory of 6128 6076 OneDrive.exe 87 PID 6076 wrote to memory of 4992 6076 OneDrive.exe 89 PID 6076 wrote to memory of 5140 6076 OneDrive.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\5zd03862.exe"C:\Users\Admin\AppData\Local\Temp\5zd03862.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\ProgramData\OneDrive.exe"2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\ProgramData\OneDrive.exeC:\ProgramData\OneDrive.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" -AddExclusion -ExclusionPath C:\ProgramData4⤵PID:6128
-
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" -AddExclusion -Path C:\ProgramData4⤵PID:4992
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\""4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5140
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4152
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\OneDrive.exe
- Size 2.8MB
- SHA256 e2d110f7070b641f00e0ade25f47faf3e08a81d7312700a2a2db576ad744f65c
- MD5 76d9b8b64112a597f58864cff991dcad
- SHA1 d0802346fbd92f3653fc40147f61762e81d31619
- SHA512 512952cd038bcfc7273872e41cc43a98152112500cc2b33954589745ffffc38289d9502a14a939fd931f944c205318a1288c7cb71498310eb8fa8bac9233cdea
- SSDEEP 49152:/DfwvTe25L7RKmko3TYNhNpC5YsOTBQQnRQwI/A:/DaTe25L7RKhOkPeqBHuc
- TLSH T116D57B14FD8765F2E803157144A772BF27229D091F36DB87EA407A6EFA7B6D10D3220A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MpCmdRun.log
- Size 1KB
- SHA256 f066e7b42e4ba4b0cd4119f2c7e2581fb3e6c55efc9cc35a34d713ca573caee6
- MD5 d5f992ea43efa9f15dd7c70c5b802ac8
- SHA1 4374e7185c6f40fc18ae24b61578f503db5bb1c6
- SHA512 453b9c58d86734cb2787ec2d2d28a0b00bed322a4ca77bffc8844b1b74a24489a6ae3d651c5abc35b6e466880fd9e5de70bce169b2a3e040645e2cf0dd29c609
- TLSH T11431C0032BFD0285B6F29B52A9F38932D637BCA51A785D4D6689921C08FDD40DC25F73
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hu2wosjr.vvg.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH