valleyrat_s2 | d6387be78d258a820e4cb35ec53c65d52a813b63147488629b56269f6648adc1

General

Target

d6387be78d258a820e4cb35ec53c65d52a813b63147488629b56269f6648adc1.dll
Size

107KB
MD5

3198b729513bf5a65e39be989298079b
SHA1

a79a312a5c8884ec4b51aa4d776ba5793de09ffc
SHA256

d6387be78d258a820e4cb35ec53c65d52a813b63147488629b56269f6648adc1
SHA512

05c6431a07aad1f276431d99beb4f4dd8e247bde96084cbe5ae0bce01ca262827e96a9187aec4d3dd41c08afde594d1bb98217dfe09718bb4eb3907e0f2bde2e
SSDEEP

3072:bw0WMZYV7iTQbXAukRJtps7Fo/3e6Uege/EYpVPVZ:bw0xGVQGXAu2iQV9

Score

10^/10

valleyrat_s2 backdoor

Malware Config

Extracted

Family

valleyrat_s2

Version

1.0

C2

43.225.58.178:6666

43.225.58.178:8888

43.225.58.178:7777

Attributes

campaign_date
2025. 3.30

Signatures

ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2
Valleyrat_s2 family
valleyrat_s2

Blocklisted process makes network request 3 IoCs

flow	pid	Process
2	2592	rundll32.exe
3	2592	rundll32.exe
4	2592	rundll32.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	rundll32.exe
File opened (read-only)	\??\M:	rundll32.exe
File opened (read-only)	\??\R:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe
File opened (read-only)	\??\Z:	rundll32.exe
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\P:	rundll32.exe
File opened (read-only)	\??\T:	rundll32.exe
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\Y:	rundll32.exe
File opened (read-only)	\??\H:	rundll32.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\N:	rundll32.exe
File opened (read-only)	\??\Q:	rundll32.exe
File opened (read-only)	\??\S:	rundll32.exe
File opened (read-only)	\??\U:	rundll32.exe
File opened (read-only)	\??\B:	rundll32.exe
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\X:	rundll32.exe
File opened (read-only)	\??\E:	rundll32.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2624 set thread context of 2592	2624	rundll32.exe	30

Suspicious behavior: EnumeratesProcesses 49 IoCs

pid	Process
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2592	rundll32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2592	2624	rundll32.exe	30
PID 2624 wrote to memory of 2592	2624	rundll32.exe	30
PID 2624 wrote to memory of 2592	2624	rundll32.exe	30
PID 2624 wrote to memory of 2592	2624	rundll32.exe	30

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d6387be78d258a820e4cb35ec53c65d52a813b63147488629b56269f6648adc1.dll,#1
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\system32\rundll32.exe
  rundll32.exe
  2⤵
  - Blocklisted process makes network request
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2592-2-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/2592-0-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/2592-4-0x00000000022F0000-0x0000000002371000-memory.dmp

Filesize
516KB

Download
memory/2592-3-0x00000000002C0000-0x00000000002E9000-memory.dmp

Filesize
164KB

Download
memory/2592-5-0x00000000002C0000-0x00000000002E9000-memory.dmp

Filesize
164KB

Download
memory/2592-6-0x00000000002C0000-0x00000000002E9000-memory.dmp

Filesize
164KB

Download
memory/2592-8-0x0000000002380000-0x00000000023C7000-memory.dmp

Filesize
284KB

Download
memory/2592-7-0x00000000002C0000-0x00000000002E9000-memory.dmp

Filesize
164KB

Download
memory/2592-9-0x0000000002470000-0x00000000024BE000-memory.dmp

Filesize
312KB

Download
memory/2592-10-0x0000000002470000-0x00000000024BE000-memory.dmp

Filesize
312KB

Download
memory/2592-11-0x0000000002470000-0x00000000024BE000-memory.dmp

Filesize
312KB

Download
memory/2592-12-0x0000000002470000-0x00000000024BE000-memory.dmp

Filesize
312KB

Download
memory/2592-13-0x0000000002470000-0x00000000024BE000-memory.dmp

Filesize
312KB

Download
memory/2592-14-0x00000000002C0000-0x00000000002E9000-memory.dmp

Filesize
164KB

Download
memory/2592-15-0x00000000002C0000-0x00000000002E9000-memory.dmp

Filesize
164KB

Download
memory/2592-16-0x0000000002470000-0x00000000024BE000-memory.dmp

Filesize
312KB

Download

Analysis

Sharing