Analysis
- max time kernel
149s - max time network
146s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
11/11/2026, 02:39
General
- Target ratonClient.exe
- Size 2.8MB
- Sample261111-c5ffwstt3l
- SHA256 1dd4583041678750db57c1ddc12ee8ee6d0894333200cf816af250cbcacf1f78
Malware Config
Extracted
-
ratonrat
-
Free
-
h5yy5tyq34t.localto.net:5101
-
5w2RH8MYbGDAOxcz2H7PaXg
-
assist
false
-
box
false
-
box_icon
No icon
-
box_msg
Hello, i'm the description of your raton client message box
-
box_title
Hello, im a title for your message box
-
defender
false
-
delay
0
-
hide_file
false
-
open_website
false
-
process_critical
false
-
raw
silly21
-
reconnect
3
-
startup
false
-
tag
Infected
-
uac
false
-
vm
false
-
website
https://t.me/sillyisafed
Signatures
- Family: RatonRAT
RatonRAT is an information stealer written in C#.
- Detects RatonRAT payload 1 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ratonClient.exe"C:\Users\Admin\AppData\Local\Temp\ratonClient.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
naudio.wasapi.dll
newtonsoft.json.dll
stuff.dll
system.buffers.dll
memory/2088-54-0x00000288A9FC0000-0x00000288A9FE2000-memory.dmp
memory/2088-51-0x00000288AA030000-0x00000288AA0E4000-memory.dmp
memory/2088-0-0x000002888DA20000-0x000002888DCF6000-memory.dmp
memory/2088-56-0x00000288A9FB0000-0x00000288A9FBA000-memory.dmp
memory/2088-45-0x00000288A9A30000-0x00000288A9A3A000-memory.dmp
memory/2088-63-0x00000288AA0F0000-0x00000288AA10A000-memory.dmp
memory/2088-1-0x00000288A9AA0000-0x00000288A9AB0000-memory.dmp
memory/2088-60-0x00000288AA130000-0x00000288AA162000-memory.dmp
memory/2088-64-0x00000288A9AA0000-0x00000288A9AB0000-memory.dmp