BeepRAT TCC In-Memory Shellcode Loader with Persistence via WindowsUpdateTempFileCleanUp

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the BeepRAT malware using the Tiny C Compiler (tcc.exe) to execute shellcode directly from memory. The rule identifies TCC execution from non-standard directories (specifically within %LOCALAPPDATA%\TCC) using specific flags (-nostdlib -run), and correlates this activity with the creation of an elevated scheduled task named 'WindowsUpdateTempFileCleanUp' used for persistence.