Analysis
-
max time kernel
300s -
max time network
290s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
01/04/2025, 01:21
General
-
Target
AI自动化办公表格制作生成工具安装包/双击安装.exe
-
Size
253KB
-
MD5
c20383afabfbd60298b6b2385237a008
-
SHA1
902438f6bcc919f98b195f4de2560a311ff5dcd0
-
SHA256
a8a42814c253ca5e93e81be5bd69149ff71b9ac3024420614fba37fb0834b3c0
-
SHA512
e844938501c7fe3da490e5d5b0172077829715d137ee1f9b770bbaf1ae1700ed0cb532da819beeba04ce7df926b9c81bc194bf7d5c3eb8c57625dc4aa8dc2bd2
-
SSDEEP
3072:oehT3vurb+DJte4ytrYwFK8zk9J7TL6WxBEC7AVUAQ/J5foY46pjQ02WO9Fc43Lx:Xz4qDJte4yZjQ8zknFnkX+zohQs9BZ2u
Malware Config
Extracted
valleyrat_s2
1.0
43.225.58.178:6666
43.225.58.178:8888
43.225.58.178:7777
-
campaign_date
2025. 3.30
Signatures
-
ValleyRat
ValleyRat stage2 is a backdoor written in C++.
-
Valleyrat_s2 family
-
Blocklisted process makes network request 3 IoCs
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\AI自动化办公表格制作生成工具安装包\双击安装.exe"C:\Users\Admin\AppData\Local\Temp\AI自动化办公表格制作生成工具安装包\双击安装.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\rundll32.exerundll32.exe2⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
516KB
-
Filesize
164KB
-
Filesize
164KB
-
Filesize
164KB
-
Filesize
164KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
284KB
-
Filesize
164KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
164KB
-
Filesize
312KB