Analysis
-
max time kernel
299s -
max time network
290s -
platform
windows10-2004_x64 -
resource
win10v2004-20250313-en -
resource tags
-
submitted
01/04/2025, 01:21
General
-
Target
AI自动化办公表格制作生成工具安装包/steam_api64.dll
-
Size
107KB
-
MD5
3198b729513bf5a65e39be989298079b
-
SHA1
a79a312a5c8884ec4b51aa4d776ba5793de09ffc
-
SHA256
d6387be78d258a820e4cb35ec53c65d52a813b63147488629b56269f6648adc1
-
SHA512
05c6431a07aad1f276431d99beb4f4dd8e247bde96084cbe5ae0bce01ca262827e96a9187aec4d3dd41c08afde594d1bb98217dfe09718bb4eb3907e0f2bde2e
-
SSDEEP
3072:bw0WMZYV7iTQbXAukRJtps7Fo/3e6Uege/EYpVPVZ:bw0xGVQGXAu2iQV9
Malware Config
Extracted
valleyrat_s2
1.0
43.225.58.178:6666
43.225.58.178:8888
43.225.58.178:7777
-
campaign_date
2025. 3.30
Signatures
-
ValleyRat
ValleyRat stage2 is a backdoor written in C++.
-
Valleyrat_s2 family
-
Blocklisted process makes network request 3 IoCs
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\AI自动化办公表格制作生成工具安装包\steam_api64.dll,#11⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32.exe2⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
516KB
-
Filesize
164KB
-
Filesize
164KB
-
Filesize
164KB
-
Filesize
164KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
284KB
-
Filesize
164KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
164KB
-
Filesize
312KB