Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
11/11/2026, 02:39
General
- Target ratonClient.exe
- Size 2.8MB
- Sample261111-c5ffwstt3l
- SHA256 1dd4583041678750db57c1ddc12ee8ee6d0894333200cf816af250cbcacf1f78
Malware Config
Extracted
-
ratonrat
-
Free
-
h5yy5tyq34t.localto.net:5101
-
5w2RH8MYbGDAOxcz2H7PaXg
-
assist
false
-
box
false
-
box_icon
No icon
-
box_msg
Hello, i'm the description of your raton client message box
-
box_title
Hello, im a title for your message box
-
defender
false
-
delay
0
-
hide_file
false
-
open_website
false
-
process_critical
false
-
raw
silly21
-
reconnect
3
-
startup
false
-
tag
Infected
-
uac
false
-
vm
false
-
website
https://t.me/sillyisafed
Signatures
- Family: RatonRAT
RatonRAT is an information stealer written in C#.
- Detects RatonRAT payload 1 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ratonClient.exe"C:\Users\Admin\AppData\Local\Temp\ratonClient.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
aforge.video.directshow.dll
naudio.core.dll
naudio.wasapi.dll
naudio.winforms.dll
naudio.winmm.dll
newtonsoft.json.dll
stuff.dll
system.buffers.dll
memory/5504-76-0x000001F0DBFC0000-0x000001F0DBFF2000-memory.dmp
memory/5504-1-0x000001F0C0DA0000-0x000001F0C1076000-memory.dmp
memory/5504-57-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
memory/5504-58-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
memory/5504-59-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
memory/5504-49-0x000001F0DB800000-0x000001F0DB80A000-memory.dmp
memory/5504-61-0x000001F0DBDC0000-0x000001F0DBE74000-memory.dmp
memory/5504-67-0x000001F0DB900000-0x000001F0DB922000-memory.dmp
memory/5504-0-0x00007FFEFB8BF000-0x00007FFEFB8C0000-memory.dmp
memory/5504-69-0x000001F0DB8F0000-0x000001F0DB8FA000-memory.dmp
memory/5504-82-0x000001F0DBFA0000-0x000001F0DBFBA000-memory.dmp
memory/5504-26-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
memory/5504-56-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
memory/5504-84-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
memory/5504-55-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
memory/5504-86-0x000001F0DBF80000-0x000001F0DBF96000-memory.dmp
memory/5504-4-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
memory/5504-100-0x000001F0DC140000-0x000001F0DC174000-memory.dmp
memory/5504-3-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
memory/5504-107-0x000001F0DC120000-0x000001F0DC134000-memory.dmp
memory/5504-2-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
memory/5504-83-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
memory/5504-93-0x000001F0DB950000-0x000001F0DB95E000-memory.dmp
memory/5504-113-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
memory/5504-114-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp