Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20250502-en - resource tags
- submitted
27/05/2025, 13:11
General
- Target 2025-05-27_4d5370f0310d9097f545ab21359dc88d_ryuk.exe
- Size 662KB
- Sample250527-qfc65atxcv
- SHA256 531e61e5376d7e7aff0a33752074fc1914039273545ddbeeb408866ad8889270
Malware Config
Extracted
-
valleyrat_s2
-
1.0
-
27.124.17.227:466
-
27.124.17.229:445
-
127.0.0.1:80
-
campaign_date
2025. 5.25
Signatures
- ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Valleyrat_s2 family
- Adds Run key to start application 2 TTPs 3 IoCs
- Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-05-27_4d5370f0310d9097f545ab21359dc88d_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2025-05-27_4d5370f0310d9097f545ab21359dc88d_ryuk.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\svchost.exe"C:\Windows\System32\svchost.exe"2⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\2025-05-27_4d5370f0310d9097f545ab21359dc88d_ryuk.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2025-05-27_4d5370f0310d9097f545ab21359dc88d_ryuk.exeC:\Users\Admin\AppData\Local\Temp\2025-05-27_4d5370f0310d9097f545ab21359dc88d_ryuk.exe2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\svchost.exe"C:\Windows\System32\svchost.exe"3⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\ProgramData\anonymous\run\Windows_Edge.lnk1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
kernelquick.sys
memory/564-0-0x000001DCE69C0000-0x000001DCE6A4D000-memory.dmp
memory/564-3-0x000001DCE8670000-0x000001DCE86FB000-memory.dmp
memory/564-2-0x000001DCE8670000-0x000001DCE86FB000-memory.dmp
memory/564-33-0x000001DCE8AE0000-0x000001DCE8B48000-memory.dmp
memory/564-1-0x000001DCE8670000-0x000001DCE86FB000-memory.dmp
memory/564-18-0x000001DCE8670000-0x000001DCE86FB000-memory.dmp
memory/564-7-0x000001DCE8670000-0x000001DCE86FB000-memory.dmp
memory/564-27-0x000001DCE8670000-0x000001DCE86FB000-memory.dmp
memory/564-11-0x000001DCE8670000-0x000001DCE86FB000-memory.dmp
memory/564-12-0x000001DCE8A70000-0x000001DCE8AD2000-memory.dmp
memory/564-14-0x000001DCE8AE0000-0x000001DCE8B48000-memory.dmp
memory/564-13-0x000001DCE8AE0000-0x000001DCE8B48000-memory.dmp
memory/564-21-0x000001DCE8AE0000-0x000001DCE8B48000-memory.dmp
memory/3088-6-0x0000023A95600000-0x0000023A9568B000-memory.dmp
memory/3088-17-0x0000023A95840000-0x0000023A958A8000-memory.dmp
memory/3088-16-0x0000023A95840000-0x0000023A958A8000-memory.dmp
memory/3088-15-0x0000023A95600000-0x0000023A9568B000-memory.dmp
memory/3088-23-0x0000023A95600000-0x0000023A9568B000-memory.dmp
memory/3088-24-0x0000023A95840000-0x0000023A958A8000-memory.dmp
memory/3088-9-0x0000023A95600000-0x0000023A9568B000-memory.dmp
memory/3088-30-0x0000023A95600000-0x0000023A9568B000-memory.dmp
memory/3088-4-0x0000023A95600000-0x0000023A9568B000-memory.dmp
memory/3088-5-0x0000023A95600000-0x0000023A9568B000-memory.dmp
memory/3088-34-0x0000023A95840000-0x0000023A958A8000-memory.dmp
memory/3088-36-0x0000000180000000-0x000000018003C000-memory.dmp
memory/3088-51-0x0000023A95840000-0x0000023A958A8000-memory.dmp