BeepRAT TCC Shellcode Loader Executing config.ini.c from LocalAppData

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•7

Detects the use of the Tiny C Compiler (tcc.exe) with command-line arguments to compile and execute shellcode from a 'config.ini.c' file located in the %LOCALAPPDATA%\TCC directory. This technique is specifically associated with BeepRAT to execute code directly in memory while attempting to evade security controls like AMSI, ETW, and WLDP.